NOD32 3.0 messing up Adobe CS3 applications (false positives)

Discussion in 'ESET NOD32 Antivirus' started by dscrap, May 22, 2008.

Thread Status:
Not open for further replies.
  1. dscrap

    dscrap Registered Member

    Joined:
    Nov 3, 2004
    Posts:
    156
    For some odd reason NOD32 is giving me alerts that Adobe Acrobat 8, Dreamweaver CS3, and Photoshop CS3 contain viruses... I did a little searching and the particular files xxxxxxxFNP.dll all pertain to the FLEXnet Publisher licensing Adobe uses. I use these products everyday for work and never had a problem with previous versions of NOD32. I have NOD32 3.0.642.0 and have had it installed since it came out and never had a problem until today. I had to uninstall all three Adobe applications and reinstall them. I also had to exclude the entire Adobe folder so it doesn't get messed up again. I hope the powers that be at ESET get this taken care of quickly. I hate leaving folders excluded especially ones that I use daily...

    Has anyone else had a similar experience? Any suggestions?

    Thanks
     
  2. Coolur

    Coolur Registered Member

    Joined:
    May 22, 2008
    Posts:
    1
    Re: NOD32 3.0 messing up Adobe CS3 applications

    Just to confirm Nod32 V3 has done the same thing to all my Adobe CS3 suite....

    God damit I now need to re-install CS3 suite, what a pain in the ass this is!!!

    Coolur
     
  3. bafranksbro

    bafranksbro Registered Member

    Joined:
    May 22, 2008
    Posts:
    8
    Re: NOD32 3.0 messing up Adobe CS3 applications

    Yes I got the same thing but luckily it didn't ruin my installs since it asked me first before doing anything. It was popping up with alerts all over the place for things other than Adobe stuff as well.
     
  4. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Re: NOD32 3.0 messing up Adobe CS3 applications

    We're on the ball, the problem is being investigated and should be resolved shortly with a newer engine update. If some files have been mistakenly quarantined, you can restore them manually.

    We apologize for the inconvenience.
     
  5. dj01

    dj01 Registered Member

    Joined:
    May 22, 2008
    Posts:
    1
    I'm having the same problem this morning. So, the work-around is to exclude the Adobe folder? I agree with dscrap, that makes me nervous. I'm running WinXP Pro. Last week I downloaded SP3. I did not have any problems until this AM, but Windows Secrets is reporting that XP SP3 triggers false positives in security apps.
     
  6. nevsie

    nevsie Registered Member

    Joined:
    May 22, 2008
    Posts:
    4
    well i am getting this as well on all items in the CS3 suite. wonderful that i can put the files back from quarantine but it messes up my licenses and i have to go through a long repair / re-install process hoping that this will work. More annoyingly, i bet i en up in exactly the same position at the end of this as it will keep causing the same problems. even the repair / re-install process is jumping up with 100's of false positives... this is annoying and whats more plenty of work time unable to do anything...
     
  7. Eric Covarrubias

    Eric Covarrubias Registered Member

    Joined:
    May 22, 2008
    Posts:
    1
    Re: NOD32 3.0 messing up Adobe CS3 applications

    Obviously you are aware of the issue. Just letting you know we're being hit as well... design shop with 15 developers who will be unable to work unless we disable AV :/
     
  8. redpaint

    redpaint Registered Member

    Joined:
    May 22, 2008
    Posts:
    1
    Location:
    Scotland
    We have also been affected by this team of 4 developers. Managed to exclude the Adobe CS3 folder but have wasted the entire morning tracking this error down.
     
  9. dorgane

    dorgane Registered Member

    Joined:
    Oct 17, 2007
    Posts:
    362
    Make update 3121 ;)
    it good now (for me lol) ;)
     
  10. The_Worst

    The_Worst Registered Member

    Joined:
    Jan 18, 2008
    Posts:
    4
    Luckily the programs work after the files have been restored from quarantine.
     
  11. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    The problem has been identified and fixed with update 3121. It was not actually a typical false positive caused by signatures or heuristics, hence it took us some time to figure out the cause.
     
  12. RonInMi

    RonInMi Registered Member

    Joined:
    May 22, 2008
    Posts:
    2
    The problem occured for me too, with Acrobat 8.1. I have installed the new update, but I found that excluding the C:\Program Files\Adobe folder allowed me to run Acrobat again before I got the update. If anyone continues to have a problem, try that for now.
     
  13. mlittle1105

    mlittle1105 Registered Member

    Joined:
    May 22, 2008
    Posts:
    29
    What an incredible waste of time and energy you folks have produced for your users. :mad:

    Please advise as to how to release items from Quarantine (I see no such option in my ESET NOD32 Antivirus interface) or restore them manually. I first tried running Adobe CS3 apps at six o'clock this morning and have been getting these errors. I made the mistake of assuming that NOD32 was running properly, and so I told it to remove the items it was claiming were "threats."

    But even now that you've issued the update, I still cannot launch any CS3 apps.
     
  14. mlittle1105

    mlittle1105 Registered Member

    Joined:
    May 22, 2008
    Posts:
    29
    UPDATED: I finally found the Quarantine panel in the Advanced interface. I found the items which were quarantined, clicked on them and selected the "RELEASE" button.

    Nothing happens.

    Additional attempts to launch CS3 apps result in the same errors.

    Please advise.
     
  15. mlittle1105

    mlittle1105 Registered Member

    Joined:
    May 22, 2008
    Posts:
    29
    What a monumental PITA this has been.

    After several minutes, the Adobe items were finally "released" from Quarantine. Now I get to re-enter all of my serial numbers and re-register the software. Lovely. If I'm lucky, I might actually get to start working on some of my client projects before Noon today.

    Tell me... where can I send my invoice for the three hours I lost today dealing with this nonsense?
     
  16. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    There is no "Release" option in the quarantine context menu. Did you mean "Restore"?
     

    Attached Files:

    • q.jpg
      q.jpg
      File size:
      6 KB
      Views:
      3,654
  17. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Unfortundately, this seems to be a part of Adobe's anti-piracy technique.
     
  18. GAN

    GAN Registered Member

    Joined:
    Mar 3, 2007
    Posts:
    355
    I had the same problem with the file "AcrobatFNP.dll" from Adobe Acrobat 3D version 8.1.2. This is why i have the cleaning level set to the lowest setting. Then i see a popup instead of automatic deletion.

    Gan
     
  19. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    The reaction would be same even at the default cleaning level - a prompt window with action selection would appear.
     
  20. mlittle1105

    mlittle1105 Registered Member

    Joined:
    May 22, 2008
    Posts:
    29

    Yeah, the nerve of those folks over at Adobe... trying to prevent piracy and all. Clearly, they should have anticipated that your company would be releasing a security update that would result in their apps not being able to launch.
     
  21. mlittle1105

    mlittle1105 Registered Member

    Joined:
    May 22, 2008
    Posts:
    29
    By the way, you guys have released three security updates today. In all three instances, within 30 seconds of my computer notifying me of the update, it has frozen up, and I've had to manually re-boot. What's up with this?
     
  22. thismonk

    thismonk Registered Member

    Joined:
    May 22, 2008
    Posts:
    1
    Guys, this is not an obscure piece of software or obscure configuration. Please test your updates properly.
     
  23. edwin3333

    edwin3333 Registered Member

    Joined:
    Aug 29, 2007
    Posts:
    244
    I had several with AcrobatFNP.dll die, as well as ONSSI ImageImportService.exe and sqlserv.exe -- That is Microsoft SQL server 7.0 (MSDE 2000)

    Starting 35 minutes ago, my remote control solution, WINVNC, has started to delete. This really helps me while I try to recover from the 3120 pattern file.

    The interesting thing is that this only is affecting my Nod32 3.0 machines. I have many 2.7 also, and they are not having the problem with 3120.
     
  24. dscrap

    dscrap Registered Member

    Joined:
    Nov 3, 2004
    Posts:
    156
    Well it is nice to see that ESET found the problem and made updates... I am now at Update 3123 (20080522). I haven't yet removed the exclusion for my Adobe folder. It took several hours to uninstall and reinstall all of CS3 so I am a bit weary. Has anyone had success with the updates?

    Thanks
     
  25. Darken

    Darken Registered Member

    Joined:
    May 16, 2007
    Posts:
    52
    Location:
    Canada
    Yes, all seem to works fine without problem with Nod32 3.0.657 and Adobe CS3 under Vista. No data loss.

    Signature database: 3118 (20080521) to 3122 (20080522).
     
Thread Status:
Not open for further replies.