KISA, Emergency Measures for Abnormal Shutdown of Windows Systems,
When there was a failure in the cloud services of the U.S. Microsoft, the message ‘Under Maintenance’ was displayed on the website of Eastar Airlines on the afternoon of the 19th. Yonhap News,
,
,
,
,
, Due to IT service disruptions from U.S. Microsoft, leading to cloud service outages in Korea, the Korea Internet & Security Agency (KISA) has issued emergency guidance for one of the errors, abnormal shutdown of Windows systems (blue screen).,
,
, “On the afternoon of the 19th, KISA posted a notice on its website titled ‘Emergency Guidance Recommendation for Abnormal Shutdown (Blue Screen) due to CrowdStrike product’.” On that day, during the process of updating the CrowdStrike security platform, the world’s top security company, conflicts occurred with MS Windows systems, causing issues with business systems using MS cloud.”,
,
, KISA stated that when an abnormal shutdown occurs during the Falcon product patch, the following measures can be taken: ① Delete problem files in safe mode ② Rename CrowdStrike folder in safe mode ③ Block CS agent service using registry editor.,
,
, “To delete problem files in safe mode, you can search for files matching the ‘C-00000291 *.sys’ pattern and delete them after running command prompt (administrator) or Windows PowerShell (administrator) in safe mode. If you want to rename the CrowdStrike folder in safe mode, you can change the folder name from ‘CrowdStrike’ to ‘ren CrowdStrike CrowdStrike_old’.”,
,
, ‘When using the registry editor to block CS agent service, find the Start entry on the right window of the CS agent key, double-click to edit the value, and change the value data from 1 (service is automatically started) to 4 (service is disabled).’,
,