Recovering from CrowdStrike Blue Screen

Overview

On July 19th, 2024, at midnight, CrowdStrike pushed an update to its client that caused some Windows machines with the CrowdStrike software to crash. CrowdStrike updated this within a short window of time, but any machines that accepted the update may require administrative help to be resolved.

If your computer is at a blue screen caused by this issue, please contact us via the number or e-mail bellow and we will walk you through the instructions bellow.

Note: On boot, you may be asked for a Bitlocker Recovery key. You will need to contact us or MassMutual for this information.

• Monday - Thursday 8:30 am - 5:00 pm
• Friday 8:30 am - 1:00 pm
  • help@charteroakfinancial.com
  • (212) 515-4767 (4SOS)
• Need off hours support?
  • Please call MassMutual directly: 1-800-767-1000, ext. 44357 (4HELP)

Recovery Mode

1. After 2 attempted reboots, the computer should be in Recovery mode as below
2. Click on SEE ADVANCED REPAIR OPTIONS
3. Click TROUBLESHOOT
4. Click ADVANCED OPTIONS
5. Click COMMAND PROMPT
6. Enter the BitLocker key.
7. In the command prompt line enter this text exactly:
8. del C:\Windows\System32\drivers\CrowdStrike\C-00000291*.sys
9. Hit Enter
10. You will have a new line. 
11. Type: EXIT
12. Hit Enter
13. Select Turn Off

Alternate method Safe Mode

If the above method doesn't work, you can try the following to attempt to delete the required file.

1. WinRE Screen
2. Troubleshoot
3. Advanced Options
4. Startup Settings
5. click Restart > (at the safemode options after restart)
6. Choose option #6 Safemode with CMD
7. In the command prompt window, type each line below, and press the return key after each line:
   1. c:
   2. cd windows
   3. cd system32
   4. cd drivers
   5. cd crowdstrike
   6. del C-00000291*.sys
   7. exit