Faulty CrowdStrike security update causes BSODs, delays and other inconveniences

Millions of Windows computers all over the world are displaying the dreading blue screen of death (BSOD). These problems are caused by a glitch in the CrowdStrike security software.

In Australia for example the BSODs are disrupting banking institutions, supermarkets, media companies, emergency services and public transportation. Melbourne Airport states that the issue is impacting check-in procedures for some airlines.

“Virgin Australia is aware of a large-scale IT outage impacting multiple airlines and other businesses which is having an impact on our operations. We are working to resolve this issue as soon as possible. We appreciate the patience of all travelers as we work through a solution and will provide an update once more information is known,” the flight carrier says in a statement.

The Australian government says it’s working closely with the national cybersecurity coordinator and will meet with the National Emergency Management Agency shortly.

Reuters reports that several U.S. carriers are grounded due to communication issues. The Federal Aviation Administration (FAA) therefore imposed a “global ground stop on all flights”, including United, Delta, American, and Frontier.

Reports are coming in that the BSODs are causing problems in other countries as well, including Belgium, Germany and the Netherlands.

CrowdStrike has identified the cause that’s responsible for the worldwide outage of Windows computers. According to the cybersecurity firm it’s an issue in the Falcon Sensor software, most likely caused by a recent update of its security software.

“We have widespread reports of BSODs on windows hosts, occurring on multiple sensor versions,” the Austin-based cybersecurity firm CrowdStrike says on its support portal and Reddit. The company promises to keep everyone in the loop.

In the meantime, there is a workaround to temporarily solve the issue:

1. Boot Windows into Safe Mode or the Windows Recovery Environment

2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory

3. Locate the file matching “C-00000291*.sys”, and delete it.

4. Boot the host normally.