CB Response: cbcomms driver failed to stop during uninstall

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Tid[04AC] 2018-09-25 14:36:39 (i): Deleting file \SystemRoot\system32\drivers\cbk7.sys 
Tid[04AC] 2018-09-25 14:36:39 (i): Unable to delete '\SystemRoot\system32\drivers\cbk7.sys' WinError[0x00000003]

This issue only happens on sensors which were previously upgraded using the Server UI.

When using the Server UI to uninstall a sensor, the cbcomms driver is never stopped nor removed from the system.

Environment

• CB Response Windows sensor: 6.0.x, 6.1.x

Cause

This is a known bug.

Resolution

Upgrade to 6.2.0+ Windows sensor.