armsvc.exe detected as virus

[chuckw1960]

As of today, many in my organization are getting a virus detection on armsvc.exe, we use Windows 7 and various versions of Acrobat. We use AVG Cloudcare.

[mikek355200]

Same here. Have had a couple users report this so far.

[rperrystl]

I have had this happen on 4 systems so far, windows 7 and 8.1. Is there a newer version of this file?

[rperrystl]

This might not be a false positive. I deleted the armsvc.exe from quarantine and rebooted. I then loaded reader dc and selected "repair installation" which replaced the file. Now checking armsvc.exe causes no reaction from avg. Still investigating...

[dinoact]

Interesting.

I just did a repair installation and now getting this error. File modified date change from 2/7/2017 to 4/25/2017. New MSI in the cache folder.

[chuckw1960]

I have been instructing my users to select "protect me" as I don't know why this file is being flagged by AVG and others.

This issue is coming up almost exactly a week after Adobe messed up AdobeGCClient.exe, see the discussion below

AdobeGCClient.exe

It would be nice to see someone from Adobe chime in on this!

[rperrystl]

After deleting and repairing my armsvc.exe date is 2/3/17, prior it was 4/25/17. This is still likely a false positive, as malwarebytes doesn't detect either. But AVG detects the 4/25/17 version as Adware Generic8.FLO. This seems to have started with the virus database downloaded this morning.

[rperrystl]

Just started up a machine that hadn't been used today, checked the armsvc.exe date, 2/3/17. Checked with AVG, no threat detected. 20 min later, AVG detected a threat, checked the file, now dated 4/25/17. This must be an update pushed out by Adobe today...

[dinoact]

We've had this come up on 2 systems so far. I reported it as a false positive to AVG/Avast. Not sure how long that takes to turn around though.

[grahsysadmin]

How long does it take for someone from Adobe to reply to these threads? Would like to know something ASAP

[LeoUpdaterX]

If file version is 1.824.22.5037 and digital signature shows up as "OK", the file should be valid.

All files in C:\Program Files (x86)\Common Files\Adobe\ARM\1.0 should be the same version and have valid digital signatures.

Most likely false positive as mentioned on this thread.

[rperrystl]

That could explain why Adobe issued the update, the 2/3/17 version of the armsvc.exe on my PC has a certificate that expires on 5/7/17

[chuckw1960]

So after starting this thread this morning, monitoring throughout the day, still no response from Adobe Staff.

LeoAdobeX, at least you have a higher level rating than everyone else replying but "Most likely false positive as mentioned on this thread" doesn't help me much.

I have an old version of the file and never got the A/V warning. So what is causing this "false positive" with the new version of the file? How is this newer version of the file getting on some of my users computers and not one others" Why is no one from Adobe offering input? Why has Adobe been putting out updated files that cause issues like this? What is the solution?

See this from last week  AdobeGCClient.exe

At the end of the day, all I have is questions.

Until I hear some sort of solution to this I'm  advising my users to select "Protect me"

[grahsysadmin]

This has us taking a lot more serious look at Foxit instead, we're about to migrate to new PCs and we're not fans of how steep Adobe products are these days on a never-ending subscription.

[LeoUpdaterX]

chuckw1960,

With regard to complains from A/V - would you agree that it is something that A/V should correct if the file is valid?

armsvc.exe is a part of Adobe Reader and Acrobat Updater

Starting with Adobe Acrobat Reader DC and Adobe Acrobat DC, Updater also supports Services installed with these products.

Updater will self-update, unless all of the above supported products installed on the system prohibited from being updated automatically by either preferences or policy (search for bUpdater on the forums; it has been referenced frequently)

This could explain why you see it updated on some systems and not on others.

[Guest]

FYI, We have a small office of 14 and half of the employees are out today in a training.  I've have 4 computers so far that have had the AVG pop up asking to Protect or Allow the armsvc.exe.  One told me she allowed it earlier and just emailed me saying she's getting myway as her automatic web browser and ads popping.

[AshuMittal]

Hi all,

We are looking into this on priority. Will share an update soon.

Thanks,

-ashu

[AshuMittal]

Hi all,

Please note that we did release an update to Acrobat Updater yesterday, and the deliverable is digitally signed by an Adobe Certificate. It is being incorrectly flagged by AVG and we are in touch with them to get this false-positive rectified.

Thanks,

-ashu

[Mohd Amish]

We need armsvc.exe binary from your machine which is being flagged as virus to investigate it at our end.

I have sent direct messages to all of you with the steps to send the file to me. Thanks.

[chuckw1960]

Mohd,

So with the latest post from Dhwaj, do you still need the file sent to you?

[Mohd Amish]

If the issue is resolved for you as per the steps suggested by Dhwaj then there is no need to send the file else if it is still not working for you please send us the file to investigate the issue at our end. Thanks.

[dhagrawa]

Hi All,

The issue is resolved now with the new Virus Database version: 4776/14432 (5/4/2017, 1:01 PM). Please reinstall AVG if you are still facing the issue.

Please let us know if you are still getting this binary treated as a threat.

Thanks,

Dhwaj

[MichaelTKerwin]

I am still having this issue with AVG Server ... haven't been able to run Adobe DC Reader for almost a month now