PhotoshopPrefsManager.exe being detected as a virus threat

[Shahriar5C96]

hi,

Our cyber security team keeps detecting the following file as a threat:

PhotoshopPrefsManager.exe

Can you please provide some information about this and let me know whether if this file will cause any problems on my computer and why it may be detected as a threat? 

[kglad]

if the file was part of a package downloaded from a secure adobe.com server, it's probably an antivirus program error.  contact your av maker and report a probable false-positive.

[SullivanChrisJ]

I would expect Adobe to work with the major anti-virus providers so every one of their users doesn't have to deal with this personally. Cylance is quarantining this file - and has been doing so for months. 

[kglad]

they probably do, but cylance doesn't appear to be a major player.  and their reputation isn't great, https://www.wizcase.com/antivirus/cylance/

[andrew.hoeveler]

I'm also having the same issue with Acronis Cyber Protect Home Office. I don't think you could rightfully call Acronis a "non-major player". So again... why isn't Adobe working with anti-virus makers to stop this from happening?

[kglad]

what's the assessment of virustotal?

[andrew.hoeveler]

what does "assessment of virustotal" mean?

[kglad]

read this thread.

[andrew.hoeveler]

I am reading this thread. 

Do you mean click the link below to go to virustotal.com? There is no explanation of what that link is, nor what I'm supposed to be uploading. Could you please be more specific in your replies? Thanks. 

[kglad]

upload the file you suspect contains a virus.

[Abambo]

@kglad means this: https://community.adobe.com/t5/enterprise-teams-discussions/photoshopprefsmanager-exe-being-detected...

[Abambo]

I am reading this thread. 

Do you mean click the link below to go to virustotal.com? There is no explanation of what that link is, nor what I'm supposed to be uploading. Could you please be more specific in your replies? Thanks. 

By @andrew.hoeveler

Virustotal: google knows all. Virustotal is a site where you can upload your file, and it checks against multiple AV. I suppose that the deal is, that Virustotal provides to the AV access to the data you upload. That's OK for me.

[Abambo]

What about having major AV providers working with Adobe? I never heard of Cylance, but that doesn't really mean that it's bad. It should have a possibility to whitelist programs you think that are OK. If you have doubts, you can use a service like Virus Total: https://www.virustotal.com/gui/home/upload. Says CYLANCE undetected (green)!

[Brittany30326901qwlx]

Just for some context here, Cylance is a machine learning antivirus. When configured correctly, it is a highly effective tool. However, it does take a HIGHLY knowledgeable person to build out the configuration and deploy it without issue. For general antivirus big hitters, yes, Adobe should work with them, but Cylance relies heavily on detection, approvals (whitelisting), and monitoring of alerts. Because even if it is a legitimate program that cylance knows of, if it tries to perform an action that is unexpected or tries to pull information that Cylance deems to be a threat level increase, it can really block it at any time. The only way to ensure it continues properly is to mark it as "safe" in the portal. This performs an explicit allow, whitelist, approval, whatever the preferred term is.

[Mark.Spiteri]

Hi all, I am the admin of our Cylance depoyment and I too face this issue. The problem seems to be that new temporary versions are created over and over again. As a new version is created in a new folder the site-wide "allow" rule I place is ignored.

These are from one PC. (MM/DD/YYYY)

• C:\adobeTemp\ETRF0FE.tmp\1\Application\PhotoshopPrefsManager.exe
  • Running: No
  • Creation Time (UTC): 7/9/2023 11:33:41 PM

• C:\adobeTemp\ETRE660.tmp\1\Application\PhotoshopPrefsManager.exe
  • Running: No
  • Creation Time (UTC): 6/27/2023 4:43:23 AM

• C:\adobeTemp\ETRC1AE.tmp\1\Application\PhotoshopPrefsManager.exe
  • Running: No
  • Creation Time (UTC): 6/26/2023 4:46:57 AM

• C:\adobeTemp\ETR8141.tmp\1\Application\PhotoshopPrefsManager.exe
  • Running: No
  • Creation Time (UTC): 7/14/2023 6:59:13 AM

• C:\adobeTemp\ETR4F94.tmp\1\Application\PhotoshopPrefsManager.exe
  • Running: No
  • Creation Time (UTC): 7/1/2023 4:30:12 AM

• C:\adobeTemp\ETRD66C.tmp\1\Application\PhotoshopPrefsManager.exe
  • Running: No
  • Creation Time (UTC): 7/2/2023 4:28:17 AM

• C:\adobeTemp\ETR9D30.tmp\1\Application\PhotoshopPrefsManager.exe
  • Running: No
  • Creation Time (UTC): 7/10/2023 11:30:49 PM

• C:\adobeTemp\ETRD624.tmp\1\Application\PhotoshopPrefsManager.exe
  • Running: No
  • Creation Time (UTC): 7/8/2023 11:36:11 PM

• C:\adobeTemp\ETRD30D.tmp\1\Application\PhotoshopPrefsManager.exe
  • Running: No
  • Creation Time (UTC): 7/16/2023 6:53:18 AM

• C:\adobeTemp\ETR14CA.tmp\1\Application\PhotoshopPrefsManager.exe
  • Running: No
  • Creation Time (UTC): 7/15/2023 6:56:10 AM

• C:\adobeTemp\ETR4689.tmp\1\Application\PhotoshopPrefsManager.exe
  • Running: No
  • Creation Time (UTC): 7/19/2023 6:44:56 AM

• C:\adobeTemp\ETR841A.tmp\1\Application\PhotoshopPrefsManager.exe
  • Running: No
  • Creation Time (UTC): 6/24/2023 4:51:57 AM

• C:\adobeTemp\ETR5A2A.tmp\1\Application\PhotoshopPrefsManager.exe
  • Running: No
  • Creation Time (UTC): 7/7/2023 11:39:20 PM

• C:\Program Files\Adobe\Adobe Photoshop 2023\PhotoshopPrefsManager.exe
  • Running: No
  • Creation Time (UTC): 6/28/2023 4:42:44 AM

Why does it need to create so many versions?