0xc0000428 - Bad Image error message when running Microsoft Remote Assistance tool MSRA.exe

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

Upon running MSRA.exe from %windows%\System32, a pop up window with an error message regarding "msra.exe - Bad Image" appears.  If the user clicks OK and continues, MSRA launches normally. 

 

----------------------

msra.exe - Bad Image

C:\Program Files\Manufacturer\Endpoint Agent\clpbm64.dll is either not

designed to run on Windows or it contains an error.  Try installing the

program again using the original installation media or contact your system

administrator or the software vendor for support. Error status 0xc0000428

-----------------------

Cause

The root cause is unknown. Symantec DLP Endpoint Agent is not currently believed to be reponsible for this error message, as the issue appears to affect not only the DLP Endpoint Agent, but other applications which may inject into MSRA.exe as well. 

Resolution

Microsoft Remote Assistance (MSRA.exe) has minimal threat vector for data loss.  Chats with MSRA.exe are performed between internal, trusted users who initiate Support Sessions.  File attachments are not possible to transfer for MSRA.exe and session data will be printed.  

Since there is no threat vector for Personally Identifiable Information (PII), it is possible to exclude MSRA.exe from Clipboard and Print Channels to successfully work around this issue.  Once excluded, the pop-up error should no longer occur, as DLP Endpoint Agent will no longer inject into MSRA.exe for channel monitoring.