Remove-CrowdStrikeFile.ps1 deletes the faulty CrowdStrike channel file (C-00000291*.sys) that caused the July 19, 2024 global Windows BSOD outage. Boot any affected workstation from the USB drive below and this script runs automatically - no input required.
| File | SHA-256 |
|---|---|
| CrowdStrike_File_Removal_Fix.iso | 01D94B0A4610F45461233BCDF5BA959BFD2E2F94043EF5195B9533EB8670D381 |
Verify after downloading:
Get-FileHash .\CrowdStrike_File_Removal_Fix.iso -Algorithm SHA256
# Expected: 01D94B0A4610F45461233BCDF5BA959BFD2E2F94043EF5195B9533EB8670D381- Download Rufus portable - use
rufusp.exe - Plug in a USB drive (8GB or larger) and open Rufus
- Under Device, select your USB drive
- Under Boot selection, click Select and choose the ISO
- Click Start, select Write in ISO Image mode when prompted
- Click OK - wait for it to finish
Boot the affected workstation from the USB drive.
| Manufacturer | Boot menu key |
|---|---|
| Dell | F12 (F2 = BIOS, not boot menu) |
| HP | F9, or Esc then F9 (F10 = BIOS) |
| Lenovo | F12, or F11 on older models |
Select the USB from the boot menu. The script runs automatically, deletes the bad file, and reboots the workstation. About 5 minutes per workstation. A log is written to C:\Temp\FileDeletionLog.txt on every workstation.
https://blog.soarsystems.cc/the-day-crowdstrike-took-down-the-world-how-we-responded/
Built by Soar Systems - July 2024