CROWDSTRIKE ISSUE JULY 2024

Blue Screen of Death and “Recovery”, “It looks like Windows didn’t load correctly” loop

Please do not create an online booking if you need help urgently.  Please call the call centre below or our emergency engineers on 07902 978030

​

Self Fix

Method 1: Use Safe Mode and delete the affected file

You’ll need to boot to the Safe mode to follow the process. If you’re on the Recovery screen, click on “See advanced repair options” on the Recovery screen. In the Advanced Repair Options menu, select “Troubleshoot,” then choose “Advanced options.” Select “Startup Settings” and click “Restart.” 

Shut down your PC, turn it on, and repeatedly press F8 until the Advanced Boot Options menu. From there, select Safe mode.
In Safe mode, open Command Prompt (admin) or Windows PowerShell (Admin).

In the Command Prompt, type the following command to navigate to the CrowdStrike directory: cd C:\Windows\System32\drivers\CrowdStrike
To delete the affected file, you need to locate the file that matches the pattern C-00000291*.sys.
First, run the following command to find the file matching the pattern: dir C-00000291*.sys.
For example, it may be C-00000291abc.sys.
Once you’ve found the file, delete it using del C-00000291.sys
In the above case, del C-00000291.sys is the name of the file that showed up on our system, and it could be something else for you. To correctly identify the file, make sure you follow the steps and use dir command.

Method 2: Use Safe Mode and rename the CrowdStrike folder
Click on "See advanced repair options" on the Recovery screen.
In the Advanced Repair Options menu, select Troubleshoot.
Next, choose Advanced options.
Select Startup Settings.
Click on Restart.
After your PC restarts, you will see a list of options. Press 4 or F4 to start your PC in Safe Mode.
Open Command Prompt in Safe Mode.
In the Command Prompt, navigate to the drivers directory: cd \windows\system32\drivers
Rename the CrowdStrike folder, use ren CrowdStrike CrowdStrike_old
You can also boot to the Safe mode by shutting down your computer and pressing the F8 key repeatedly until the Advanced Boot Options menu appears. From there, you can select Safe Mode and press Enter. Finally, follow the steps from number seven.
The above guide renames the crowdstrike folder in c:\windows\system32\drivers\crowstrike to CrowdStrike_old, which fixes the problem and allows your PC to boot to the desktop.