CB Defense: FLTLIB.DLL pop up error when opening windows applications when endpoint is running Defense and BitDefender

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

The pop up FLTLIB.DLL error is seen when opening any Windows application such as 'cmd' or Control Panel and when clicking 'OK' everything reverts to normal. Putting Defense into bypass stops error appearing.


 

Environment

• CB Defense: Windows Sensor
• OS version: Windows Workstation and Server versions running BitDefender

Cause

BitDefender prevents all applications from using fltlib.dll from windows/system32/ and instead forces them to use it's own libraries in the BitDefender directory. The problem is that fltlib.dll is missing from their directory. Any sort of bypass policy configured in Defense could not fix this as the file simply isn't present in BitDefender directory - current finding is that it does not copy that file when it sees another AV (like PSC).

Resolution

1. Go to BitDefender policy - Anti malware - > Settings - > and disable Advanced Threat Control 
2. Best practice would be to set up mutual exclusions in both Defense and PSC