Security News Crowdstrike update causes Windows Enterprise computer outage worldwide

[SpiderWeb]

Content source

https://www.abc.net.au/news/2024-07-19/technology-shutdown-abc-media-banks-institutions/104119960

A large number of major organizations around the world that rely on Crowdstrike Falcon for security have come to a screeching halt as the endpoint client received an update today. Affected workstations are greeted by a Blue Screen of Death caused by "csagent.sys", Crowdstrike Falcon system level driver.

Official announcement on their portal: https://supportportal.crowdstrike.c...s-crashes-related-to-Falcon-Sensor-2024-07-19

 

[victorieraja]

Please restore the system to old date, it will work

 

[Viking]

I am just hearing about this on the radio.

 

[Browchay]

Worldwide crash on Crowdstrike as they move into the ransomware business :-D

An older fix last time this happened .. Rename the win32 crowdstrike driver folder ... boost to safe mode and command prompt

 

[Alexius]

A large number of major organizations around the world that rely on Crowdstrike Falcon for security have come to a screeching halt as the endpoint client received an update today. Affected workstations are greeted by a Blue Screen of Death caused by "csagent.sys", Crowdstrike Falcon system level driver.

Official announcement on their portal: https://supportportal.crowdstrike.c...s-crashes-related-to-Falcon-Sensor-2024-07-19

Can't access the support portal and my laptop won't start with their stupid error. So if you do have access to the support portal message copy pasta it here so we can see as well.

 

[narek138]

Worldwide crash on Crowdstrike as they move into the ransomware business :-D

An older fix last time this happened .. Rename the win32 crowdstrike driver folder ... boost to safe mode and command prompt

A more detailed steps on that fix bro? Facing this issue at the moment.

 

[cartaphilus]

Well I guess they are living up to their name. They sure striked the crowd.

 

[narek138]

Worldwide crash on Crowdstrike as they move into the ransomware business :-D

An older fix last time this happened .. Rename the win32 crowdstrike driver folder ... boost to safe mode and command prompt

A more detailed steps on that fix bro? Facing this issue at the moment.

 

[cartaphilus]

If you are running personal then yeah use any fix but if you are in corporate environment then I would wait for the official solution. It just happened so give them a few to hopefully push a patch?

Otherwise are you running bitlocker or any encryption at boot system?

If not then do you have access to another PC? There you can make a USB bootable Linux. Boot into it, navigate to crowd strike directory, find win32 folder and rename it to win23. Then restart the pc and boot into Windows.

 

[royalram8ram]

Can't access the support portal and my laptop won't start with their stupid error. So if you do have access to the support portal message copy pasta it here so we can see as well.

If you’re stuck in a Blue Screen of Death or Recovery loop, boot to the Safe mode and rename the crowdstrike folder c:\windows\system32\drivers\crowstrike to something else, and reboot your PC. This will resolve the Blue Screen of Death error.

 

[rajeesh_ck]

has some workarounds mentioned

 

[narek138]

Okay, then i guess we will need to wait. Please post a fix here as well, Support portal is not working out for me.

 

[Jenicek24]

Go into in safe mode, or CMD : C:\Windows\System32\Drivers. Rename Crowdstrike to Crowdstrike_something. Start windows

 

[jalr85]

Can't access the support portal and my laptop won't start with their stupid error. So if you do have access to the support portal message copy pasta it here so we can see as well.

 

[SpiderWeb]

Okay, then i guess we will need to wait. Please post a fix here as well, Support portal is not working out for me.

Apologies. I was trying to find a reliable and official source for a temporary solution. I think this Crowdstrike staff on Reddit is the best so far:

11:27 PM PT:

CrowdStrike Engineering has identified a content deployment related to this issue and reverted those changes.

Workaround Steps:

1. Boot Windows into Safe Mode or the Windows Recovery Environment
2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory
3. Locate the file matching “C-00000291*.sys”, and delete it.
4. Boot the host normally.

Support Forum message:

Blue Screen of Death:

 

[Rogan]

Workaround Steps:​

1. Boot Windows into Safe Mode or the Windows Recovery Environment
2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory
3. Locate the file matching “C-00000291*.sys”, and delete it.
4. Boot the host normally.

 

[narek138]

It worked. Thanks everyone hope in the future they will test their updates before deploying them to users.

 

[narek138]

A large number of major organizations around the world that rely on Crowdstrike Falcon for security have come to a screeching halt as the endpoint client received an update today. Affected workstations are greeted by a Blue Screen of Death caused by "csagent.sys", Crowdstrike Falcon system level driver.

Official announcement on their portal: https://supportportal.crowdstrike.c...s-crashes-related-to-Falcon-Sensor-2024-07-19

Thanks alot you saved my day.

 

[Chesty Puller]

Workaround Steps:​

1. Boot Windows into Safe Mode or the Windows Recovery Environment
2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory
3. Locate the file matching “C-00000291*.sys”, and delete it.
4. Boot the host normally.

I'm trying to get permission from my IT before I do that, I've been on hold for an hour now... This is gonna cost a lot of people a lot of money.

 

[techie92354]

A large number of major organizations around the world that rely on Crowdstrike Falcon for security have come to a screeching halt as the endpoint client received an update today. Affected workstations are greeted by a Blue Screen of Death caused by "csagent.sys", Crowdstrike Falcon system level driver.

Official announcement on their portal: https://supportportal.crowdstrike.c...s-crashes-related-to-Falcon-Sensor-2024-07-19

Link on Crowdstrike website not publicly accessible. You have to have a support login.