News for hackers. Stuff that matters.

tomthumb

Wow! How much was the fine??!
Someone on X has shared the kernel stack trace of the crash

The faulting driver in the stack trace was csagent.sys.

Now, Crowdstrike has got two mini filter drivers registered with Microsoft (for signing and allocation of altitude).

1) csagent.sys - Altitude (321410) This altitude falls within the range for Anti-Virus filters. 2) im.sys - Altitude (80680) This altitude falls within the range for access control drivers.

So, it is clear that the driver causing the crash is their AV driver, csagent.sys.

The workaround that CrowdStrike has given is to delete C-00000291*.sys files from the directory: C:\Windows\System32\Drivers\CrowdStrike\

These files being suggested to be deleted are not driver files (.sys files) but probably some kind of virus definition database files.

The reason they name these files with the .sys extension is possibly to leverage Windows System File Checker tool's ability to restore back deleted system files.

This seems to be a workaround and the actual fix might be done in their driver, csagent.sys and the fix will be rolled out later.

Anyone having access a Falcon endpoint might see a change in the timestamp of the driver csagent.sys when the actual fix rolls out.

Bookmarked!
Re:Why the Tech Industry Won't Disrupt Health Care on Monday February 19, 2024 @04:05AM (#39427541)
You can get online consultation with a highly rated doctor in my part of the world. Ever heard of “Practo”?
Re:Show HN: Compilaton of all CSE courses (by NPTEL) on Wednesday January 24, 2024 @04:11AM (#39115286)
This is gold!!
Re:My solopreneur story: zero to $45K/mo in 2 years on Sunday September 24, 2023 @01:59AM (#37630505)
Wow!!
Re:Ask HN: Recent grad, need advice. Please help on Thursday July 27, 2023 @04:28AM (#36890590)
Kokoro Zashi Aru Tokoro Ni Michi Ari.
Re:Ask HN: Recent grad, need advice. Please help on Thursday July 27, 2023 @01:39AM (#36889357)
Drill down on your DSA and start doing problems on leetcode. Be regular with your prep. Side by side, review your web dev course and start building projects. Freecodecamp would be useful here.
Re:Meta’s Microservice Architecture [pdf] on Tuesday July 11, 2023 @07:00AM (#36679236)
The same logic holds true for micro services. Statelessness is the key. But most micro services implementations end up being distributed monoliths
Re:Dark Matter Developers: The Unseen 99% (2012) on Tuesday May 02, 2023 @06:18AM (#35785456)
I work in a peculiarly dark matter technology. Windows File System Encryption drivers. The only book available on this subject (Windows File System Drivers) is Rajeev Nagar’s “Windows NT File System Internals” which was written in 1997 and is still relevant.
Re:Let's build a Chrome extension that steals everything on Wednesday February 22, 2023 @05:19AM (#34893774)
The probable intent of the author of this article is to let devs to know about his book: “Building Browser Extensions”. Ordered mine just now.
Re:Ask HN: Do you develop niche software? on Thursday October 20, 2022 @03:16PM (#33279325)
Does file system encryption drivers sound niche?
Words of wisdom! I have tweeted your first paragraph. Hope you don’t mind..
Re:From Burned Out Tech CEO to Amazon Warehouse Associate on Tuesday October 04, 2022 @12:50AM (#33076795)
Has any one felt that if you do some manual thing every day and which reduces entropy around you, it keeps you sane..
Re:The quantum computing bubble on Tuesday September 06, 2022 @03:36AM (#32734132)
Engineering can never supersede the limits of Physics. Engineering follows Physics.
EducativedotIO
Re:An ex-Googler's guide to dev tools (2020) on Monday July 18, 2022 @12:20AM (#32134623)
There used to be SourceInsight in the MS Windows world.
Is it just me… this website has the snappiest page load!
What are you waiting for..Start something of your own.
Re:Ask HN: What's a Good Gift for Programmers? on Friday December 10, 2021 @02:08AM (#29507246)
Knuth’s AOCP boxed set!
Re:Ask HN: I've decided to shut down my side project! What now? on Thursday December 02, 2021 @02:43PM (#29421408)
I think you should persist with it. Corporates still struggle with this problem. Twitter is you friend for this. Connect with VPs in charge of cloud infra of companies with relatively high number of employees and that lean towards tech.
Re:Ask HN: Approaches to load balancing web sockets? on Saturday October 30, 2021 @06:22AM (#29047594)
Postgres supports clustering and replication.
Re:Ask HN: Approaches to load balancing web sockets? on Saturday October 30, 2021 @05:25AM (#29047323)
If you select the first option (multiple domains), the load balancing would be done by the client ( hit one domain, on failure hit next.)
Re:Modern C++ for C Programmers (2018) on Saturday July 24, 2021 @01:46AM (#27938771)
Andrei also found something else to do after writing the book!
Re:Who are the best programmers in the world? on Thursday July 08, 2021 @01:12PM (#27774976)
Fabrice Bellard is among the very best in the world.
48 year old. Still coding every day! Use C and C++ in my job. Generally kernel mode stuff. Have done good work in Golang and Microservices too!
Re:Computer Science courses with video lectures on Sunday May 16, 2021 @02:46PM (#27175986)
This is a treasure trove!
I used to jog in my 8th grade and during winter I developed a bad cough which won’t go away. Over time it developed into a full blown asthma and now I am in my late 40s and still have it.
Complete lockdown implies very less movement of populace implies less cross transmission implies less Covid 19 patients implies less deaths due to Covid and otherwise. Not rocket science I presume..

Older »