Adobe Cryto Mining Operations

[richardk71696431]

Hey -

I just updated my Creative Cloud apps, and found that my AV blocked Adobe from running an app called "CoinMiner."

I think this means either Adobe is doing this intentionally (bad) or someone hacked your update files and Adobe is doing this unintentionally (very bad).

I have blocked this application, so feel free to take whatever action you think is appropriate.

Richard

[es1010]

I can't submit them - the files are too large.  --Eileen

[Reggie_Edit]

What files were you trying to submit and where Eileen?

There are 2 files detected by our M$ AV:

REDDecoder-x86.dll

REDDecoder-x64.dll

Microsoft premier support allows 1gb uploads. I can't imagine these two files are larger than than that!

[es1010]

We have several reports of the software being tagged PUA:Win32/CoinMiner.  We are packaging the software for the device license.  CoinMiner is being found in different software packages - packaged by different techs.  It is being found in different builds too.  I have one from 2016 and 2017 that it is getting tagged with the CoinMiner virus. 

PUA:Win32/CoinMiner 2/20/2018

containerfile:_C:\Users\username\Desktop\ADVCCJan2018.zip;file:_C:\Users\username\Desktop\ADVCCJan2018.zip->ADVCCJan2018/Build/HD/AEFT15.0.1/AdobeAfterEffects15AllTrial.zip->1/universal/Professional/Support Files/REDDecoder-x64.dll;file:_C:\Users\username\Desktop\ADVCCJan2018.zip->ADVCCJan2018/Build/HD/AEFT15.0.1/AdobeAfterEffects15AllTrial.zip->1/universal/Professional/Support Files/REDDecoder-x86.dll;file:_C:\Users\username\Desktop\ADVCCJan2018.zip->ADVCCJan2018/Build/HD/AME12.0.1/AdobeMediaEncoder12AllTrial.zip->1/universal/App/REDDecoder-x64.dll;file:_C:\Users\username\Desktop\ADVCCJan2018.zip->ADVCCJan2018/Build/HD/AME12.0.1/AdobeMediaEncoder12AllTrial.zip->1/universal/App/REDDecoder-x86.dll;file:_C:\Users\username\Desktop\ADVCCJan2018.zip->ADVCCJan2018/Build/HD/AUDT11.0.1/AdobeAudition11All.zip->1/universal/App/REDDecoder-x64.dll;file:_C:\Users\username\Desktop\ADVCCJan2018.zip->ADVCCJan2018/Build/HD/AUDT11.0.1/AdobeAudition11All.zip->1/universal/App/REDDecoder-x86.dll;file:_C:\Users\username\De NT AUTHORITY\NETWORK SERVICE

[Test Screen Name]

Please check the digital signature on the specific file that is giving the report. What signer? What date? Does it show as valid when you click Details?

[sparshagrwal]

Hi,

First update your Anti Virus and then try to re-install your latest product. I have tried with latest Windows defender (ver. 1.261.1547.0) and it installed without any issue.

[rossb17369478]

I'm sorted now after a magical reboot it no longer detects as a virus