Cb Protection: Error: "Bad Image"

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Receiving error: "Bad Image - <Process> is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support."
• Error stops when Cb Protection agent is uninstalled or in "disabled" state

Environment

• Cb Protection Agent: 7.x and Higher
• Microsoft Windows: All Supported Versions

Cause

Blocking a file that is attempting to launch

Resolution

1. Determine if the error occurs when a certain action is being done.
2. Check for block events around the time the error occurred.
   1. Login to the Cb Protection Console
   2. Navigate to Reports > Events
   3.  Use saved view "Blocked Files (All)
   4. Add filter 
      • Source is <NameOfComputerWithError>
3. Check for "silent" rules:
   1. Navigate to Rules > Software Rules > Custom tab
   2. Add filter "Action contains silent"
   3. If there are any "Block Silently" rules, test if they are the cause by disabling them or moving the computer to a policy that the rule doesn't apply to