Sensor uninstall throws errors when Trend Micro Agent is running

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Sensor uninstall shows below error:

  [root~]# sudo /opt/carbonblack/response/bin/sensoruninstall.sh
  
  ## Found tar
  ## Using rpm as package manager
  
  Unloading old version of sensor ...
  
  Failed to execute operation: No such file or directory
  ## Stopping daemon...
  Warning: cbdaemon.service changed on disk. Run 'systemctl daemon-reload' to reload units.
  error reading information on service cbdaemon: No such file or directory
  ## Stopping kernel module
  rmmod: ERROR: could not remove 'cbsensor': Device or resource busy
  rmmod: ERROR: could not remove module cbsensor: Device or resource busy
  ## Deleting kernel modules from disk
  depmod: ERROR: fstatat(6, dsa_filter.ko): No such file or directory
  depmod: ERROR: fstatat(6, dsa_filter_hook.ko): No such file or directory
  ## Uninstall phase 1 completed

• List of modules shows below Trend Micro modules:

  gsch
  redirfs
  bmhook
  tmhook
  dsa_filter
  dsa_filter_hook

Environment

• EDR (formerly CB Response) Sensor: All Supported Versions
• Linux OS: All Supported Versions

Cause

The cbsensor module fails to unload because of the Trend Micro Agent modules loaded in the kernel

Resolution

Manually unload the modules:

1. Stop the TrendMicro and cbdaemon:

   service ds_agent stop
   service cbdaemon stop

2. Manually unload sensor module:

   rmmod cbsensor
   rmmod cbsensor

3. Run the uninstall:

   sudo /opt/carbonblack/response/bin/sensoruninstall.sh

Additional Information

The sensor module unload command needs to be executed twice