topic Adobe Creative Cloud File - Retrospective Quarantine Failure in Endpoint Security

Adobe Creative Cloud File - Retrospective Quarantine Failure

John71357 — Fri, 22 Oct 2021 14:52:04 GMT

Hi All,

We are being bombarded with retrospective quarantine failure alerts on multiple Endpoints for a file that is part of Adobe Creative Cloud - we believe it is a false positive but cannot fetch copy of the file to sandbox and confirm - anyone else having this issue?

0dc2a84e33199c78d83110a5f009fbd46f15726c9791f5aaee89ade44cf585b6

30a73ff6e72699f5a5daf1961504adc79aa5bda3fb80339e75e554301bb2e53a

Re: Adobe Creative Cloud File - Retrospective Quarantine Failure

Ken Stieers — Fri, 22 Oct 2021 15:01:02 GMT

Yep... the client install cleaned up the files, so I don't have any examples either.

Re: Adobe Creative Cloud File - Retrospective Quarantine Failure

SReed2020 — Fri, 22 Oct 2021 15:16:44 GMT

This is happening at my company too.

Re: Adobe Creative Cloud File - Retrospective Quarantine Failure

mblume — Fri, 22 Oct 2021 15:36:06 GMT

I am seeing this issue as well. Multiple detection events related to .aamdownload file extension, files located in temp. All files retro-quarantined failure due to them being temp and likely no longer available when the engine attempted to quarantine. Events are still actively happening.

Re: Adobe Creative Cloud File - Retrospective Quarantine Failure

SReed2020 — Fri, 22 Oct 2021 15:35:56 GMT

Now with all the Adobe Creative Cloud detections and subsequent quarantine failures, PCs are starting to be isolated!

A month or two ago, didn't we get a bunch of Adobe Creative Cloud false positives that an email was sent out about?

Re: Adobe Creative Cloud File - Retrospective Quarantine Failure

Brad.Shaw — Fri, 22 Oct 2021 15:52:53 GMT

You are correct @SReed2020 this did happen a couple of months ago as well. Super frustrating.

Re: Adobe Creative Cloud File - Retrospective Quarantine Failure

stealthmode — Sat, 23 Oct 2021 15:54:26 GMT

This was a false positive and has been rectified. The files are no longer being marked as malicious. You might have to wait a while for the endpoint cache to expire.