5 ms·
How to Fix the Crowdstrike Thing
- terom 2y agoReboot harder. > Update as of 10:30 UTC on 19 July 2024: We have received reports of successful recovery from some customers attempting multiple Virtual Machine restart operations on affected Virtual Machines. > We've received feedback from customers that several reboots (as many as 15 have been reported) may be required, but overall feedback is that reboots are an effective troubleshooting step at this stage. https://status.cloud.microsoft/ https://status.cloud.microsoft/
- deleted 2y ago[deleted]
- jayknight 2y agoAny indication that this might work for physical computers?
- isjamesalive 2y agoMy physical workstation (a Precision laptop) was affected and a single reboot fixed it. Most of my colleagues weren’t as lucky.
- jayknight 2y agoI think I'm well past 15 on my laptop now. My desktop was unaffected, but I reach over and click restart every once in a while to see if something different happens.
- trilbyglens 2y agoSounds like a race condition that some systems hot and others don't
- canistel 2y agoWorked for me. Working for a few or my colleagues. Reboot again and again.
- bitwize 2y agoIt's amazing how "Did ye try tairnin' it off and on again?" is still the best first-line advice.
- baal80spam 2y agoI'm not the one to bash Microsoft "just because", but this "up to 15 reboots" thingy reminds me that MS most likely doesn't know what's going on in their own damn OS anymore. Related picture - not long ago such a message would've been completely unacceptable, yet here we are. https://i.imgur.com/4rQLcb7.png https://i.imgur.com/4rQLcb7.png
- exe34 2y agosounds like a race condition that you have a fair chance of recreating after 15 reboots?
- smallerize 2y agoBitlocker instructions in a reply, direct link if you don't have a Twitter account: https://twitter.com/Syndikalist/status/1814281141265846772 https://twitter.com/Syndikalist/status/1814281141265846772
- lesuorac 2y agoWell, don't use windows but if you can bypass Bitlocker to modify a kernel extension it seems like you could just bypass Bitlocker to install a keylogger / whatever? With the utility of in a shared computer environment (say school library) you can get the administrative password with enough time.
- millero 2y agoI heard from a friend who knows someone in Crowdstrike that this bug had been sitting there in the kernel driver for years before being hit. Turns out that the flawed data was added in a post-processing step of the configuration update, which is after it's been tested internally but before it's copied to their update servers. Their test setup was fine for the update data itself, it's just that they didn't catch it before it was sent out to production because they were testing the wrong thing. Oops.
- terom 2y ago"post-processing step" aka regex? :) HN comments from a green username citing a friend who knows someone aren't the greatest source, but this sounds so believeable
- OutOfHere 2y agoA test order randomizer could have caused a meta-QA-test to write the test-artifact-file over the actual build artifact file. If so, these meta tests were not supposed to run at this stage, but laziness prevails, and the same test runner looks to have been used for both the main and the meta QA tests.
- Y_Y 2y agoTo save everyone going to that abomination of a site: vx-underground @vxunderground How to fix the Crowdstrike thing: 1. Boot Windows into safe mode 2. Go to C:\Windows\System32\drivers\CrowdStrike 3. Delete C-00000291*.sys 4. Repeat for every host in your enterprise network including remote workers 5. If you're using BitLocker jump off a bridge
- dwattttt 2y agoOr if you actually kept track of these things: pull out the bitlocker recovery key, even if it's on an old USB at the back of a drawer. Ask How I Know
- deleted 2y ago[deleted]