How to fix CrowdStrike BSOD issue on Windows PCs

A nasty surprise has often attacked Windows PCs with CrowdStrike’s Falcon Sensor. It causes the feared Blue Screen of Death (BSOD) boot loop. This BSOD issue is troublesome and surprising because CrowdStrike is a well-known name in cybersecurity, defending many types of organizations across the globe.

Normally, their Falcon platform protects against attacks, but this instance makes it an issue. An update that did not go well has caused problems in different sections, such as airlines and healthcare. CrowdStrike has stopped the update, but this raises the question—what happens next?

When you are in this mess, do not worry. There are some ways to fix the CrowdStrike BSOD issue:

1. You should start by booting your computer into Safe Mode or the Windows Recovery Environment.
2. Afterward, go to the C:\Windows\System32\drivers\Crowdstrike folder.
3. Delete any file named “C-00000291*.sys”.
4. After that, you should be able to boot normally.

If the first method does not help, you can try to stop CrowdStrike from starting. To do this,

1. Go to Command Prompt in Recovery options and
2. Change the name of the CrowdStrike folder to Crowdstrike_Old.

Another path to follow is editing the Windows Registry and preventing agents. sys from loading.

1. Boot your Windows PC into Safe Mode or Windows Recovery Environment.
2. Get to Windows Registry.
3. Edit the following key to disable the csagent.sys from loading.
   • HKLM:\SYSTEM\CurrentControlSet\Services\CSAgent\Start from a 1 to a 4

Windows on cloud platforms like AWS EC2: The solution is to detach and attach the EBS volume to a new instance, fixing the problem with the CrowdStrike driver folder. This method also works on instances from the Google Cloud Platform.

It is difficult, but you might make your system work again using these solutions. Let us know if any of these solutions worked for you, and stay close, as we will update this article as soon as new info comes out.