CrowdStrike Update Bricking Windows Computers

Introduction

An update to a product from infosec vendor CrowdStrike is bricking computers running Windows. The Register has found numerous accounts of Windows 10 PCs becoming unbootable after installing the update.

How to Fix the Issue

If your Windows 10 PC has been bricked by the CrowdStrike update, you can try the following steps to fix the issue:

1. Boot your Windows PC into Safe Mode or Windows Recovery Environment.
2. Locate and delete the file matching C:\Windows\system32\drivers\csagentsys.sys.
3. Edit the following key to disable the csagentsys from loading: HKLMSYSTEM\CurrentControlSet\Services\CSAgent\Start from a 1 to a 4.

Once you have completed these steps, your Windows PC should be able to boot normally.

Cause of the Issue

In our tests, Windows Latest observed that csagentsys.sys or C-00000291.sys is causing the problem. The driver walks the list of loaded kernel modules searching for csagentsys, the CrowdStrike Falcon kernel component, and scans the identified file.

It is not yet clear why the CrowdStrike update is causing this issue. The company is investigating the problem and has released a statement saying that it is working on a fix.

Impact of the Issue

The issue has the potential to affect a large number of Windows 10 PCs. CrowdStrike is a popular security vendor, and its products are used by many businesses and individuals.

If you are using a Windows 10 PC, we recommend that you do not install the latest CrowdStrike update until the company has released a fix.