• digdilem@lemmy.ml
    link
    fedilink
    English
    arrow-up
    14
    ·
    edit-2
    2 months ago

    It seems to be crowdstrike reacting to the new update.

    We have got ours up by the very manual process of:

    1 Boot into safe mode.

    1. Navigate to C:\windows\system32\drivers\crowdstrike

    2. Delete C-00000291*.sys

    3. Reboot normally

    • Potatisen@lemmy.world
      link
      fedilink
      arrow-up
      1
      ·
      2 months ago

      Maybe a stupid question but why would not reaching an online service (?) blue screen your computer?

      • lmaydev@lemmy.world
        link
        fedilink
        arrow-up
        1
        ·
        edit-2
        2 months ago

        I guess if the code acted as if it got a valid response without checking it could get into a very weird state. Or the code just fails hard.

        At the driver level it’s very easy to kill things.

      • digdilem@lemmy.ml
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 months ago

        It has a privileged service running locally - csagent.sys - that was crashing causing the BSOD.

  • qprimed@lemmy.ml
    link
    fedilink
    English
    arrow-up
    1
    ·
    2 months ago

    so it got backdoored, or QA is trash or both at the same time. hate it when CI builds come so fast you cant verify the latest shipping rootkit