Crowdstrike update causes Windows Enterprise computer outage worldwide

News Archive
45 Replies 13,374 Views
SpiderWeb

SpiderWeb

Level 13
Verified
Top Poster
Well-known
Forum Veteran
Content source
https://www.abc.net.au/news/2024-07-19/technology-shutdown-abc-media-banks-institutions/104119960
A large number of major organizations around the world that rely on Crowdstrike Falcon for security have come to a screeching halt as the endpoint client received an update today. Affected workstations are greeted by a Blue Screen of Death caused by "csagent.sys", Crowdstrike Falcon system level driver.

Official announcement on their portal: https://supportportal.crowdstrike.c...s-crashes-related-to-Falcon-Sensor-2024-07-19
 
SpiderWeb said:
A large number of major organizations around the world that rely on Crowdstrike Falcon for security have come to a screeching halt as the endpoint client received an update today. Affected workstations are greeted by a Blue Screen of Death caused by "csagent.sys", Crowdstrike Falcon system level driver.

Official announcement on their portal: https://supportportal.crowdstrike.c...s-crashes-related-to-Falcon-Sensor-2024-07-19
Click to expand...
Can't access the support portal and my laptop won't start with their stupid error. So if you do have access to the support portal message copy pasta it here so we can see as well.
 
Browchay said:
Worldwide crash on Crowdstrike as they move into the ransomware business :-D

An older fix last time this happened .. Rename the win32 crowdstrike driver folder ... boost to safe mode and command prompt
Click to expand...
A more detailed steps on that fix bro? Facing this issue at the moment.
 
If you are running personal then yeah use any fix but if you are in corporate environment then I would wait for the official solution. It just happened so give them a few to hopefully push a patch?

Otherwise are you running bitlocker or any encryption at boot system?

If not then do you have access to another PC? There you can make a USB bootable Linux. Boot into it, navigate to crowd strike directory, find win32 folder and rename it to win23. Then restart the pc and boot into Windows.
 
Alexius said:
Can't access the support portal and my laptop won't start with their stupid error. So if you do have access to the support portal message copy pasta it here so we can see as well.
Click to expand...
If you’re stuck in a Blue Screen of Death or Recovery loop, boot to the Safe mode and rename the crowdstrike folder c:\windows\system32\drivers\crowstrike to something else, and reboot your PC. This will resolve the Blue Screen of Death error.
 
Alexius said:
Can't access the support portal and my laptop won't start with their stupid error. So if you do have access to the support portal message copy pasta it here so we can see as well.
Click to expand...
 

Attachments

  • IMG_6814.jpeg
    IMG_6814.jpeg
    69.6 KB · Views: 394
narek138 said:
Okay, then i guess we will need to wait. Please post a fix here as well, Support portal is not working out for me.
Click to expand...
Apologies. I was trying to find a reliable and official source for a temporary solution. I think this Crowdstrike staff on Reddit is the best so far:



11:27 PM PT:

CrowdStrike Engineering has identified a content deployment related to this issue and reverted those changes.

Workaround Steps:

  1. Boot Windows into Safe Mode or the Windows Recovery Environment
  2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory
  3. Locate the file matching “C-00000291*.sys”, and delete it.
  4. Boot the host normally.
Click to expand...

Support Forum message:

msg.png


Blue Screen of Death:

IMG_5102.jpg
 
Last edited:

Workaround Steps:​

  1. Boot Windows into Safe Mode or the Windows Recovery Environment
  2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory
  3. Locate the file matching “C-00000291*.sys”, and delete it.
  4. Boot the host normally.
 
Rogan said:

Workaround Steps:​

  1. Boot Windows into Safe Mode or the Windows Recovery Environment
  2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory
  3. Locate the file matching “C-00000291*.sys”, and delete it.
  4. Boot the host normally.
Click to expand...
I'm trying to get permission from my IT before I do that, I've been on hold for an hour now... This is gonna cost a lot of people a lot of money.
 
SpiderWeb said:
A large number of major organizations around the world that rely on Crowdstrike Falcon for security have come to a screeching halt as the endpoint client received an update today. Affected workstations are greeted by a Blue Screen of Death caused by "csagent.sys", Crowdstrike Falcon system level driver.

Official announcement on their portal: https://supportportal.crowdstrike.c...s-crashes-related-to-Falcon-Sensor-2024-07-19
Click to expand...
Link on Crowdstrike website not publicly accessible. You have to have a support login.
 
You must log in or register to reply here.

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top