The worst of it may finally be over, but some people are still dealing with the CrowdStrike chaos.
Last Thursday's event, a Microsoft outage that crippled airlines and financial, health-care and energy companies across the world, resulted for many in a "blue screen of death" on their work computers. In response, Microsoft on Saturday released a recovery tool to help repair Windows machines affected by the bug, a day after CrowdStrike provided instructions for how to fix a crashed PC.
CrowdStrike, a cybersecurity firm whose software protects small businesses and large companies from cyberattacks and other online threats, said it caused the outage when it sent out a software update containing a glitch, crashing Windows computers running the company's software. The bug does not affect Mac and Linux computers.
"We understand the gravity of this situation and are deeply sorry for the inconvenience and disruption," the company said in a statement.
The fallout was massive. Airport travelers were stranded. Hospital appointments have been delayed or canceled. And some employees are still unable to get work done, all because of this software update, which has caused the infamous blue screen of death on Windows PCs with the CrowdStrike glitch.
On LinkedIn on Monday, CrowdStrike posted, "Of the approximately 8.5 million Windows devices that were impacted, a significant number are back online and operational." However, if you're still dealing with the blue screen of death on your PC, there is a fix, which CrowdStrike itself has posted on its website.
If you see this, it means your system crashed.
Microsoft on Saturday released on its Microsoft Download Center a USB tool that it said can help IT administrators with the repair process. The tool requires you to have administrative privileges and a BitLocker recovery key for each Windows PC. Microsoft also posted recovery steps to fix PCs continually restarting because of the faulty CrowdStrike update.
On Friday, CrowdStrike said it has identified the issue and has sent out a fix. "We refer customers to the support portal for the latest updates and will continue to provide complete and continuous updates on our website."
The first thing you should try to solve the blue screen of death is to restart your Windows computer until CrowdStrike's fix comes through. CrowdStrike CEO George Kurtz on Friday appeared on NBC's "Today" show and said "Many of the customers are rebooting the system and it's coming up operational because we fixed it on our end."
This has in fact worked for many people. This user on X had success after rebooting their computers several times. Microsoft has also said that it's received feedback that doing several reboots (as many as 15) has been effective.
However, if you're still having issues even after rebooting, CrowdStrike recommends booting up into safe mode and then deleting the corrupted file. This is what the company details on the CrowdStrike website:
- Boot your Windows computer into Safe Mode or the Windows Recovery Environment.
- Navigate to the %WINDIR%\System32\drivers\CrowdStrike directory.
- Locate the file matching "C-00000291*.sys" and delete it.
- Boot the host normally.
Note: Bitlocker-encrypted hosts may require a recovery key.
If you're dealing with a public cloud or another virtual environment, there's a different fix for you that CrowdStrike recommends, which you can check out over at its website.