Cb Protection: Blocks on Adobe plug-ins

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Execution blocks from files in C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins

Environment

• CB Protection Agent: 8.0 Patch 6 and Lower

Cause

The order and timing of operations when Adobe is creating/updating the API files is causing the Agent to treat the files as deleted; The Agent "re-discovers" the file as unapproved when Adobe tries to execute.

Resolution

Upgrade to 8.0 Patch 7 or Higher