Carbon Black Cloud: Bad Image Errors After Sensor Upgrade

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Error "Carbon Black Cloud Sensor: RepUx.exe - Bad Image" after upgrade/reboot
• Error details: C:\Program Files (x86)\Common Files\Microsoft Shared\INK\PENUSA.DLL is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support. Error status 0xc0000022.

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Windows Sensor: 3.5.0.1523 and Higher
• Windows OS: All Supported Versions
• Windows 10 Tablet Mode enabled

Cause

Carbon Black tamper rules block Windows from shimming UX applications to load various tablet (pen input) support dlls into them.
 

Resolution

• The current workaround is to disable "Sensor UI: Detail message" in the Carbon Black Cloud Policy > Sensor tab.
• The fix for this issue has been made available in sensor version 3.5.0.1786.

Additional Information

https://community.carbonblack.com/t5/Knowledge-Base/CB-PSC-How-to-manually-hide-the-local-UI/ta-p/72713
https://community.carbonblack.com/t5/Knowledge-Base/CB-ThreatHunter-How-to-hide-the-local-UI-via-the-policies/ta-p/72924