Frank Stallone’s Post

On the Microsoft outage: If your computer is blue-screened (BSOD) because of the CrowdStrike issue, and you have admin rights as well as BitLocker ID Key, here's a fix you can try: 1. Boot Windows into Safe Mode or WRE. 2. Go to C:\Windows\System32\drivers\CrowdStrike 3. Locate and delete file matching "C-00000291*.sys" 4. Boot normally.

Here is another reasonable and quality explanation of the difference between Windows and Linux when it comes to the incident.

Only a lazy person hasn't shared their thoughts on the CrowdStrike incident yet, so here are a couple of interesting tidbits from a not-so-lazy me: Back in April 2010, McAfee had a major mishap when they released DAT 5958 for VirusScan Enterprise. It falsely flagged a core Windows file as a virus, causing chaos everywhere. Trust took a big hit, and just four months later, Intel swooped in and bought McAfee. Funny enough, George Kurtz, the current co-founder and CEO of CrowdStrike, was the CTO of McAfee during that fiasco. And here’s another twist: Microsoft is pointing fingers at the European Commission for forcing them to open access to the Windows kernel back in 2009. They claim this made Windows less secure compared to the super locked-down Apple Mac OS, implying that if it was not for that EU decision - CrowdStrike incident would not have happend. This makes me wonder about the impact of having two operating systems with fully closed kernels (Mac OS and MS) in the market. Could this nudge more people towards using Linux?

We use a Crowdstrike competitor for our MDR services at Connect Cause, so most of our customers are not impacted by this major outage (some are indirectly due to LOB apps and platforms themselves using Crowdstrike). For anyone out there that is using Crowdstrike, if your infrastructure is directly impacted by the issue this morning and your devices are not booting and getting the rollback from Crowdstrike, you can do the following: ::: Boot Windows into Safe Mode or Windows Recovery Environment ::: Navigate to C:\Windows\System32\drivers\CrowdStrike ::: Locate files matching 'C-0000029*.sys', and delete. ::: Reboot. Hope everyone gets back up and running ASAP. #crowdstrike #outage #microsoft #windows

I've noticed every Microsoft employee is on the defence today. And they're right. The recent failure wasn't a Microsoft issue. This could have happened on Linux. It could have happened on a *gasp* Mac. No operating system is proof against these kind of failures. Did CrowdStrike mess up? Oh, for sure. But who are we kidding? Every company messes up. Every person messes up. It sucks, but it happens. There are a few takeaways from this, for sure. For example, why is so much of the world relying on a single product? Why don't critical systems have better redundancies (I'm guessing cost)? In any case, most mistakes are forgivable the first time around. Will there be lessons? Will it repeat itself? Whatever happened, a second time should be inexcusable. I wouldn't want to be the person who has made that particular mistake. I do hope CrowdStrike treat them well. It will speak volumes if they do.

Hi Community, I am sure you have heard about the CrowdStrike outage on the Microsoft Windows host machine, however, if you did not get the chance to know about it. Here is an official information about it. On July 19, 2024, at 04:09 UTC, as part of ongoing operations, CrowdStrike released a sensor configuration update to Windows systems. Sensor configuration updates are an ongoing part of the protection mechanisms of the Falcon platform. This configuration update triggered a logic error resulting in a system crash and blue screen (BSOD) on impacted systems. The sensor configuration update that caused the system crash was remediated on Friday, July 19, 2024, 05:27 UTC. This issue is not the result of or related to a cyberattack. Please visit this link and know more about it. https://lnkd.in/g3xRivQC If someone is facing the #BSOD on windows host because of this outage, please visit the below link and resolve the issue for it. https://lnkd.in/gagBUh9s #Crowdstrike #outage #Microsoft #Windows

If you've been impacted by the #Crowdstrike #Microsoft outage today this is the Official Guidance from Crowdstrike to fix the issue. Steps: 1. Boot Windows into Safe Mode or the Windows Recovery Environment 2. Click See Advanced Repair Options 3. Click Troubleshoot 4. Click Command prompt and navigate to C:\Windows\System32\drivers\Crowdstrike 5. delete “C-00000291*.sys” 6. Boot the system normally. P.s: This works if you don't have Bitlocker active. Hope we are all good?

CrowdStrike - Microsoft ‘Blue Screen of Death (BSOD)’ outage error on Windows. - While there is an outburst of news articles and posts on this event, my thoughts go out to the team who are working hard on resolving this issue.  Being on the other side of a high severity production issue, I totally get the pressure the development and support team must be under right now trying to resolve it.  The experience of having been in such situations gives me the chills... 😰 P.S. Definitely the intensity of pressure they are under must be 100 times more than what we generally experience since it caused a global outage. #CrowdStrike #Microsoft #MicrosoftOutage

#Early finish on a Friday #TGIF I noticed many engineers are blaming the recent outage on #Microsoft, but the real issue lies elsewhere. It was actually an update from #Crowdstrike that caused the problem. This update had a bug in the driver file “C-00000291.sys” which runs in Kernel mode to monitor system activity. Because of this, the bug tried to access an invalid memory location, causing a Blue Screen of Death (BSOD). To fix this issue, you need to manually delete the buggy driver file. #Microsoft is not at fault here. Crowdstrike has provided the following workaround for affected systems: 1. Boot Windows into Safe Mode or the Windows Recovery Environment. 2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory. 3. Locate and delete the file named “C-00000291*.sys”. 4. Boot the host normally. Make sure to follow these steps to resolve the issue.

To resolve the issue caused by the faulty update from CrowdStrike's software, follow these steps: Steps to Fix the Issue: 1. Enter Safe Mode: - Restart your computer. - As it starts, repeatedly press the F8 key (or Shift + F8 for some systems) before the Windows logo appears. - From the Advanced Boot Options menu, select "Safe Mode" and press Enter. 2. Locate and Rename the Problematic File: - Once in Safe Mode, open the Command Prompt or File Explorer. - Navigate to the directory containing the problematic file: C:\Windows\system32\drivers\CrowdStrike\ - Locate the file named `csagent.sys`. - Rename the file to prevent it from causing the crash: - Using Command Prompt: ren csagent.sys csagent.old - Using File Explorer: 1. Right-click on the file `csagent.sys`. 2. Select "Rename" and change the name to `csagent.old`. 3. Restart Your Computer: - Exit Safe Mode and restart your computer normally. 4. Check for Further Updates: - After your computer starts, ensure that all software, including antivirus programs, is up-to-date. Look for any patches or updates from CrowdStrike that address this issue. By following these steps, you should be able to resolve the issue caused by the faulty update from CrowdStrike. Microsoft CrowdStrike Windows 365 #TechUpdate #BSOD #WindowsIssue #CrowdStrike #CyberSecurity #TechSupport #ITSolutions #Windows10 #Microsoft #SafeMode #TechTips #SoftwareUpdate #Antivirus #TechCommunity #TechTroubleshooting #SystemCrash