Carbon Black Cloud: BSOD's occurring with 3.7.x Windows sensors

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• BSOD crashing occurring either on system startup or randomly afterwards
• Message may be displayed on Blue Screen noting ctifile.sys failed

  Stop code: SYSTEM SERVICE EXCEPTION
  What failed: ctifile.sys

• Analysis of dump file notes image name ctifile.sys

  IMAGE_NAME: ctifile.sys
  

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: 3.7.x.x
• Microsoft Windows: All Versions

Cause

This is issue UAV-2453

Resolution

• This is fixed in Windows sensor 3.8.0.535 and higher
• If upgrade is not possible, the only current workarounds are to revert to an earlier 3.6 sensor version or place the sensor in full bypass mode.