Endpoint Standard: Netscan.exe Crashes on Execution When CB Defense Sensor Is Installed.

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• The 64-bit version of netscan.exe errors out on execution when CB Defense is installed.
• Event viewer logs shows Application error for netscan.exe while it is executed.

Environment

• Endpoint Standard Sensor: 3.6.0.1719
• Microsoft Windows: All Supported Versions

Cause

Ctiuser.dll acts as a faulting module by causing the crash of netscan.exe.

Resolution

• Creating an API bypass rule for C:\PortableApps\netscan\64-bit\netscan.exe resolves the issue.
• Upgrading the sensor to  3.6.0.1979 and above resolves the issue.