10 Replies Latest reply on May 26, 2011 7:31 PM by slowdownsandcrash

    How do I get rid of this malware?

    unhappycamper1234 Level 1

      I'm referring to the Adobe Reader updater.  Ever since I accidentally opened a PDF file in Adobe Reader 9.34 (I usually use a more lightweight alternative PDF reader), my computer now keeps contacting armdl.adobe.com and downloading small files (usually 100-200 KB) called AdbeRdr940_en_US.msi.  It does this over and over and over again, constantly and without stopping.  I can only assume that it's trying to download and install the latest version of Adobe Reader.

       

      Since I don't want to waste my bandwidth downloading 200+ meg for an update to a program that I don't even use, I turned off anything remotely resembling automatic updates in Adobe Reader.  It didn't help.

       

      So I uninstalled Adobe Reader completely, assuming that that would stop the problem.  It's still trying to download the update.  This is unnacceptable behavior; any program that continues to "call home" for whatever reason even after it's been uninstalled is by definition malware.

       

      I could always block adobe.com at the hosts file, but I'd rather clean my system of this infection properly.

       

      Somebody PLEASE tell me how to stop this unwanted and inexcusable behavior.

       

      For reference, I'm running Windows XP 32-bit, SP3.  I've also seen the same behavior on a computer running Windows 7.

        • 1. Re: How do I get rid of this malware?
          LeoAdobeX Adobe Employee

          There are numerous topics on this site as to how properly disable Updater.

          Start Reader, open Edit\Preferences menu, find Updater and select "disable automatic updates"

           

          AdbeRdr940_en_US.msi you have mentioned is ~40MB.

          The small files that Updater is downloading are Manifests and they are ~25K for Reader.

           

          If you properly uninstall Reader and do not have any other Reader or Acrobat on the system, Updater was suppose to be uninstalled.

          Looks like you may have to perfom cleanup also described many times on this site.

          • 2. Re: How do I get rid of this malware?
            atosbur Level 1

            Like any other application, Adobe Reader also has an updater, called Adobe Reader Updater. It checks for updates on a regular basis. Since Reader 940 recently got released, the updater found the Reader 940 update and then later downloaded it. Probably it might have thrown you some sort of diaog called "Update is ready to install" Unless you install the 940 update, the updater would keep on showing the bubble message from the system tray. You can anytime, right click on the system tray updater icon and close it.

             

            I do not agree with the fact you mentioned that the updater keeps on downloading AdbeRdr940_en_US.msi file at an regular interval. My understanding is that if this file was downloaded once, the updater does not re-download it again.

            The download location on XP is C:\Documents and Settings\All Users\Application Data\Adobe\Reader\9.3\ARM, You may check the downloaded app at above mentioned place.

             

            The fact that you mentioned even on uninstalling Reader 934, the updater is downloading the said file is because you might have other Acrobat family product is installed and they are using the same updater.

             

            At any point of time, you may choose to stop the automatic updating of the apps by the following steps,

            1. Launch Reader

            2. Navigate to Edit>Preference>Updater and then select the third option, i.e. "Do not download or install updates automatically" and press Ok.

             

            However, it's always a good idea to update the Reader to the most recent version, which addresses various customer issues.

             

            Hope, it helps you to decide that the Adobe Reader Updater is not a malware.

            • 3. Re: How do I get rid of this malware?
              ~graffiti Adobe Community Professional & MVP

              Simple.

               

              If you use a different PDF reader, remove Adobe Reader.

               

              But if you're going to keep Adobe Reader then you'll want to do the updates since fixing security issues is the norm for the updates.

              • 4. Re: Adobe Reader installer is malware: software which hijacks your computer and cannot be shut off.
                testtesttestesetstwta111 Level 1

                unhappycamper1234 is right, when a program is so annoying and user unfriendly it stops becoming useful software and becomes malware. I see Malware as software which hijacks your computer and cannot be shut off.

                 

                For day to day use I avoid adobe as much as possible, slow load times and extremely poor intergration with outlook is one of multiple reasons. Foxit reader is superior in almost all ways.  Unfortunately like inferior internet explorer, all applications are made for inferior adobe reader, so you need adobe  reader installed in  case a program does not work correctly in reader.

                 

                The above instructions do not work. There is no updater button in edit >> preferences Adobe 7.0 (I have this old version because the problems printing pdfs in outlook -- problems which I still have anyway and becasue every successive version of adbode is bigger and more bloated)

                Adobe_7.0_preferences_no_installer_option[1].PNG

                No installer option in Adobe Reader 7.0

                 

                • Why doesn't Adobe Installer give a short warning on installer pop up  and then allow people to disable this malware?


                • Why doesn't Adobe have detailed instructions on their website on how to disable installer for each adober version?


                • Why do users who want to disable this installer have to depend on forums?

                 

                If adobe were to build better software in the first place, they would not have to force people to install updates regularly because they are probably worried about legal liability if they do not make these updates mandantory.

                 

                 

                Maybe this install icon is coming from Adobe Acrobat Pro? This installer pop up does not tell me.

                 

                Adobe has become a victim of its own success, with a near monolopy on PDF creation and reading, it has not innovated the way other competitive software companies have been forced too. Superior programs like Foxit reader are attempting to break this monopoly. I look forward to the day when Adobe's near monopoly is broken and I never have to deal with adobe again.

                 

                UPDATE

                 

                The updater appears to come from adobe pro. Hopefully I will not see this message again. Thank you for the help.

                 

                adobe pro preferences updater option.PNG

                • 5. Re: Adobe Reader installer is malware: software which hijacks your computer and cannot be shut off.
                  pwillener Level 8

                  testtesttestesetstwta111 wrote:

                   

                  Foxit reader is superior in almost all ways.

                   

                  Indeed - it even installs free spyware on your system!

                  • 6. Re: How do I get rid of this malware?
                    enter another screen name Level 1

                    Installing an application does not give it permission to use the internet connection.  People install Adobe Reader to display the contents in a window.  Anything more than that is a breach of your customer’s rights.  If it can’t display the contents of a newer version, then it could ask to check for an update.  The application should be designed and written simply enough that it does not endanger security or violate privacy.

                    • 7. Re: How do I get rid of this malware?
                      pwillener Level 8

                      enter another screen name wrote:

                       

                      Anything more than that is a breach of your customer’s rights.

                       

                      And where are these "rights" defined?

                      • 8. Re: How do I get rid of this malware?
                        Bernd Alheit Adobe Community Professional & MVP
                        Installing an application does not give it permission to use the internet connection.

                        When you accept the EULA of Adobe Reader you accept the use of the internet connection. Look at 7.2 of the EULA.

                        • 9. Re: How do I get rid of this malware?
                          enter another screen name Level 1

                          The Adobe Acrobat Reader 6.0 EULA does not state the Software will automatically connect to the internet to check for updates, yet it does.  That is beside the point. Stating it in a long legalese EULA document doesn’t build customer trust.  If we can’t trust Adobe to not do what isn’t necessary, such as automatically connect to the internet, we aren’t going to trust that our information will be protected.  The best way to build trust is through transparency.  The Software should prompt for permission (when it can’t display the contents created by a newer version) and disclose exactly what information is being transmitted.  Information that Adobe might consider non-personal identifying information could still be considered private by users or could be used for malicious purposes in the wrong hands.  Having a checkbox to automatically check for updates might be a desirable option for some people, but should not be the default for every unsuspecting user.

                          • 10. Re: Adobe Reader installer is malware: software which hijacks your computer and cannot be shut off.
                            slowdownsandcrash Level 1

                            ʇɐb ɹəuəllıʍ wrote:

                            "Indeed - it even installs free spyware on your system!   "

                             

                            And that makes it different from Adobe Reader ?

                             

                            Reguardless:  14 million people chose it over Adobe last year, according to cnet.com/Foxit-Reader.