Still Analyzing Execution Blocks With OneDrive

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Agent is enforcing Block Events on OneDrive DLL files similar to:

File c:\users\...\appdata\local\microsoft\onedrive\...\vcruntime140.dll [1234...ABCD] was blocked because Cb Protection Agent did not have time to analyze it.

Environment

• App Control Windows Agent: Versions 8.1.0 to 8.6.x
• App Control Console: All Supported Versions

Cause

A defect in the Agent caused Microsoft OneDrive application binaries to be blocked, causing the Agent unable to analyze

Resolution

This issue was tracked under EP-11127 and resolved with the release of Agent version 8.7.0. Upgrading the Agent to the latest version will resolve the issue.