Adobe Reader update

| 15 Comments | No TrackBacks

if you've reached this post looking for info about adobearm.exe check out a newer post here.

I am in Adobe update hell right now. Adobe released their quarterly security update for Adobe Acrobat and Reader and I have more questions than answers.

Adobe says that it is adding a dormant updater in Reader that they will use to test a new updater methodology. A post on another board mentions BITS. I suspect that is the new tech. I'd like to know if I disable updates via the Adobe Customization (Tuner) tool will that disable this new method as well? I haven't seen any info.

When 9.1 released, it was possible to download a version without Adobe Air. I dont see that option anymore.

Adobe Reader 9.2 is both a full update and a msp (patch update). According to this "The Adobe Reader MUI 9.2 patch can be deployed over any of versions 9.1.0, 9.1.1, 9.1.2, 9.1.3 directly." However I'm getting an error applying to 9.1.3. A bit of searching finds this article. While it is talking about AIPs (Administrative Install Points) the consensus seems to be that you can't put 9.2 on 9.1.3 because its a security patch.

And lastly, while tuning the full version of 9.2 for deployment, I found a new exe in the HKLM Run key. AdobeArm.exe is now starting at each boot. I typically delete reader_sl.exe when I'm creating a Adobe Reader install. I'd like to know what AdobeArm.exe is before I deleted it.

Sorry about posting more questions than answers. I try not do that too often. I'm off to check Adobe Forums for answers.

No TrackBacks

TrackBack URL: http://www.infosecblog.org/mt-tb20071121.pl/945

15 Comments

Going through the same process here myself.

FYI you can get the version without AIR etc from their FTP here:

ftp://ftp.adobe.com/pub/adobe/reader/win/9.x/9.2/enu/

At least it doesn't seem to have installed AIR or Acrobat.com for my test systems...

I was over at that link yesterday. What bothers me is that I believe 9.1 had two EXEs in the ftp site one with and one without AIR. Now we just have one.

You're right though, I could have just installed that exe and seen if AIR was now installed. Haven't dont that yet.

http://www.adobe.com/aboutadobe/pressroom/pressreleases/200811/111708ARMAdobeFlash.html
You can probably do without adobearm.exe unless you are running on an ARM processor, which is mostly mobile devices.

thanks for that. I had google the process name and Adobe ARM. Sometimes you just want some confirmation. I'll kill it in the package.

My security program just caught Adobe ARM looking at my email folder. I guess this is one of the new great features with the update.

10/16/2009 11:25:34 AM: The process 'C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe' (as user Domain\user) attempted to access 'C:\EMAIL\PERSONAL FOLDERS.PST'. The attempted access was a read (operation = OPEN/READ). The operation was denied. [2435]

AdobeARM.exe is not related to the ARM device - it's the new Acrobat and Adobe Reader Manager which is responsible for managing future updates and controlling various features such as JavaScript execution.

Cool - one more useless background process that I removed from the Run section of the Registry...

Another waste of resources. moving to FoxIT Reader as I type.

Sumatra PDF viewer is even faster than Foxit Reader, in my opinion. It's very light on features, but if you just want to view PDF's, it's great.

Is it necessary to keep it on startup?

Hey Niche: It is not necessary to keep "Adobe ARM" on startup. I have two Windows machines running XP Pro and XP Home and I disabled "Adobe ARM" on the XP Pro machine and nothing bad happened. I suggest you go to www.download.com amd download Advanced SystemCare which is free and has the best startup manager I have found to date. SystemCare not only shows you which programs start up but also shows you all the programs that would start up if you allowed them to do it. Thus, if you do screw something up, it is really easy to undo it.

@Freddy: One of the most annoying problems bei Sumatra is the poor implementation of Zoom. No zoom tool (selection zoom) and sometimes the program crashes when trying to zoom in by a factor bigger than 400%
I had the program installed in my machine but only for one day.

After seeing AdobeARM.exe in XP Pro SP3 Startup list, it was disabled and the computer restarted. Windows got stuck before reaching the sign in menu. Another Restart in Normal mode got the same results. The computer was restarted in Safe Mode without problems and Restored to a date a few days earlier. The computer was restarted in Normal mode without problems. AdobeARM.exe was again disabled in the Startup list and restarted, and again, the computer got hung up before reaching the signin. Subsequent Restore to an early Nov-09 date worked just fine and the AdobeARM.exe was not on the Startup list. Any Adobe products on the Startup list are and were disabled during all of the above operations, other than AdobeARM.exe.

Conclusion: AdobeARM.exe can cause Windows XP Pro SP3 to hang up upon startup when on the Startup list but disabled.

Please investigate this instead of screaming and yelling about things you don't know about. In the link it is explained what Adobe ARM does. Now get over it.

http://www.adobe.com/aboutadobe/pressroom/pressreleases/200811/111708ARMAdobeFlash.html

If you'd read the other comments you would have seen that URL already published. Another commenter then pointed out that ARM processors for mobile devices have little to do with Windows Desktop applications. According to another commenter AdobeArm.exe is used for updates and blocking malicious javascript. That's a bad combination. Companies that manage updates will want to turn off update prompts. However, I'd prefer to leave updates of known malicious javascript.

This post has a ridicious amount of Google Juice right now, so I"m going to post a followup.

Leave a comment

Archives

Please contact me by leaving a comment where appropriate. Otherwise, you can click here to reveal an email address for me.
Got Backups? Get Safe Online Remember Rick Rescorla
Powered by Movable Type 4.31-en

About this Entry

This page contains a single entry by Roger published on October 15, 2009 10:18 PM.

Comcast to warn of infected machines was the previous entry in this blog.

Barracuda's Purchase of Purewire is the next entry in this blog.

Find recent content on the main index or look in the archives to find all content.