Carbon Black Cloud: How to Remove Known Malware Using the Malware Removal Page

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

To successfully remove malware from the Malware Removal page using the Carbon Black Cloud Web Console

Environment

• Carbon Black Cloud Web Console: All Versions (formerly Predictive Security Cloud or PSC)
• Carbon Black Cloud Sensor: All Supported Versions
  • Endpoint Standard (formerly CB Defense)
  • Enterprise EDR (formerly CB ThreatHunter)
  • Audit & Remediation (formerly CB LiveOps)
• Microsoft Windows: All Supported Versions
• Apple macOS: All Supported Versions
• Linux: All Supported Versions

Resolution

1. Log into the Carbon Black Cloud Web Console.
2. Navigate to Enforce > Malware Removal
3. Search and locate the hash in question
4. Click on the chevron to the right of the row.
5. Select "Delete application".

Additional Information

• Malware is not removed immediately.  It is scheduled and then removed during the next sensor check-in.
• Once the malware has been deleted it will no longer be found under the Detected tab.  Instead, it will appear on the Deleted tab.