Carbon Black Cloud: RepUX.exe error on 3.6 Sensor version and 3.7 Beta version.(Error: The application was unable to start correctly (0xc0000022))

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Windows error: 'Repux.exe - Application Error: The application was unable to start correctly (0xc0000022) click ok to close the application' when Symantec 14 version is installed.

 

Environment

• Carbon Black Cloud Sensor version: 3.6.x and 3.7 Beta version.
  • Endpoint Standard 
  • Enterprise EDR 
  • Audit & Remediation

Cause

This is due to Symantec attempting to inject their DLL into RepUX on launch. Our tamper protection prevents the load (due to the DLL being located in an unsafe location) and so it causes application launch to fail.

Resolution

Adding Proper Exclusions to Symantec drivers, DLL and program location will resolve this issue.