Sounds like that biological mRNA “ vaccine ” that attacks its own host.

“ CrowdStrike's endpoint security solution Falcon ”

You mean an Anti Virus solution working off of a blacklist of potential malware.

--

“ overall feedback is that reboots are an effective troubleshooting step at this stage ” :o

No comment

Everybody who authorised (*) having unverified (by their company's IT) updates self-installing on mission critical systems ?

* - careful wording as it's often the bean counters rather than omissions by IT.

Or because your Windows updates were migrated over to your MSP by the powers that be, where you lost all control. Despite asking for filtering you get told "No, as then we'd have to do it for all companies we support" and then when asked "Well do you at least delay the updates a few weeks to make sure they're tested?" and told "Yes" but this turns out to be a lie.

Luckily we never got hit.

good luck booting in to safe mode for VM's in Azure! A big shitty issue with VM's in Azure is the lack of a proper console you're stuck with the serial console when things to titsup at bootup which is pi$$ poor! On prem with esx, hyper-V, AHV or whatever hypervisor you have, and you have a connection issue to a VM just bat up the console

I heard deleting the bios resolves the problem. If that fails remove all physical drives then submerge it in water, 30 minutes should do the trick. Only use fire as a last resort.

I jest ofc but I do love the old turn it off and on again. The multiple and up to 15 times just makes it even crazier. I feel sorry for those that are having to deal with this right now. Who would have thought an update pushed out on a Friday (or just before) could cause so much chaos? When will humanity ever learn not to do this?

I heard deleting the bios resolves the problem.

Wow! I read that as "deleting the boss" - maybe that would be a better bet?

Always.

"The multiple and up to 15 times just makes it even crazier."

It makes the disclaimer easier - if it hasn't righted itself yet then you just haven't tried enough times.

> The multiple and up to 15 times just makes it even crazier.

But does make sense. The theory is that eventually the network stack gets enough time before the next BSOD to have updated to the latest files, which don't trigger the BSOD.

I can also imagine this very much depends on the machine's internet connectivity being very low latency and very high bandwidth.

is this not in the cloud? Should that be an issue? If I was to guess it would be something to do with the propagation of the update.

I really don't know why we are so concerned about the tinkering monkeys stupidly destroying themselves with technology. The world will carry on without them.

I wasn't aware that anyone else but us humans was able to understand English and post on these forums. We humans are concerned about the survival of the human race because it's the one we belong to, and thus its survival is required for our own personal survival.

I'm old enough and cynical enough that I'd happily drink a toast to the end of the shitshow that passes for humanity and raise another glass to our new feline overlords.

"I'm old enough and cynical enough that I'd happily drink a toast to the end of the shitshow that passes for humanity and raise another glass to our new feline overlords."

You mean the Furries ?

No, no! It’s not them. It’s the white mice.

Mines the one with the towel in the pocket.

"We humans are concerned about the survival of the human race because it's the one we belong to, and thus its survival is required for our own personal survival."

True, but I can think of quite a few individuals that the race could easily manage without.

The problem here is that people who own/lease Windows systems, including VMs, are automatically updating software that can bring those systems down. This automated updating system saves tons of money in payroll expenses, but a simple, "Let's try this release on a sandbox and see how things work before we roll it out to every system" would be prudent. If you are an airline, and airport, a healthcare system (NHS, really?), or any other system that must run continuously, you shouldn't be trusting your vendors to be perfect. I understand that business want to save money, but until businesses that own software take some responsibility for maintenance of that software, this kind of problem will continue to happen.

And no, having AI check out the software is not a solution. :-)

True but places like the NHS, you have people in charge in IT that won't listen to their engineers. They appear to think they know best. Like the directors who took bribes from HP back in 2008 to go with HP laptops. The managers who ignored my requests for a HDD crusher of our own, then there was a big breach with sold HDDs. Its always someone else fault when things go wrong, but their idea when things go right so they can get their bullshit promotion.

Peter Principle comes to mind.

Yet on other topics people are screaming that systems are not updating. The trouble with AV, particularly a nebulous cloud based pile of shite is you have no control. That is what a "modern " solution is sold on. Always up to date, no need to interact or manage stuff.

I guess it detected windows, and blocked this malware. Product working as intended.... ;-)

Looking at it more objectively there are several possibilities:

1. Very little is deployed on Linux

2. Simple luck that it was not affected.

I am always stunned at how few people use AV on Linux server or desktop and Mac. They are not invulnerable and the attact vectors are moving to software not the OS.

Flippantly I was quoting Roy: "Hello, IT. Have you tried turning it off and on again?" earlier today... how perverse it is that I was unintentionally providing official support advice.

Thank Frick it's Friday, we can have a nice cool beer on the way home

" ... That's caused Windows machines around the world to become even less useful"

Meeeow !!!

:)

P.S. I wonder if the person responsible for the $12.5bn (as at market opening) slipup is still working for Crowdstrike !!!???

P.P.S. Good time to buy Crowdstrike cheap as they will recover because there is no quick/easy/cheap alternative !!!

Also good time to get into Coffee, Pharma Companies (particularly Migraine Meds) and Keyboards (lots are going to be worn out !!!)

If this market play pays good, please let me know !!! :)

"First, if you have a backup from before 1900 UTC yesterday, just restore that."

And accept that you lost any work, orders taken, despatches made, whatever, since then.

depends if you have anything on the box that changes state, for a large number of bog stand application servers it probably doesn't matter

Equally if it is a database server you then restore the most recent DB backup.... if your DB is not been backed (could be incremental and/or log) up every few minutes your business data is very vulnerable to loss.

Yes. If you have incremental backups you'll be fine. But my point, which I maybe didn't make plain, was that just restoring a pre-1900hrs backup will, on its own, take you back to the state of work then. It will take further action to recover subsequent transactions, whether by restoring incremental backups or by manual re-entry. If, however, data was entered, say from a website, and there was no separate backup of that then it will have been lost. Is there a chance of recovering information from email acknowledgements or did the restore overwrite outbound emails? The system may even start handing out order numbers duplicating those issued between backup and outage.

Restoring a backup image is only the start of getting back.