cancel
Showing results for 
Search instead for 
Did you mean: 
TWYates
New member
2 1 0 0
Message 1 of 7
4,260
Flag Post

HP OMEN KMODE_EXCEPTION_NOT_HANDLED

HP Recommended
OMEN Obelisk 875-0127c and OMEN Obelisk 675-0014
Microsoft Windows 10 (64-bit)

I have seen other posts on this issue, but have yet to find a solution.  We have two OMEN Obelisks, mainly being used to complete school work.  The older one (model 675-0014) entered a BSOD loop about a week and a half ago.  We performed a full clean install (wiped everything), which resolved the problem until tonight.  Within a hour of each other, both computers entered the BSOD loop.  I have attempted system restore points (which either fail, or don't resolve the issue), as well as the options to roll back updates and features.  Nothing has worked thus far.  Neither computer will even boot in safe mode, just endless BSOD loops.  Its the last week of school, and this is causing a huge issue.  Any guidance would be greatly appreciated.

 

Additional information:  Both computers installed an HPSF update today!  Tried to restore to point prior, but neither would successfully restore to an earlier point.

6 REPLIES 6
Keiichi
Level 4
45 45 0 36
Message 2 of 7
Flag Post
HP Recommended

There is a huge thread with many of us trying to pinpoint the issue. 

https://h30434.www3.hp.com/t5/Desktop-Operating-Systems-and-Recovery/KMODE-EXCEPTION-NOT-HANDLED/m-p...

 

We have found a workaround for  now:

-----------------------------------------------------

Okay, so a quick summary so far:

 

For most of us, to reproduce the BSOD, we can manually try to turn off Windows Defender in the GUI and immediately get a BSOD with KMODE, but we are able to log back in.  However, when we get the BSOD unexpectedly, usually we go into a boot loop where we can't even get back into Windows, even with safe mode.  The only way to escape that and log back in WITHOUT doing a system restore OR re-installing windows, is to use the system recovery command prompt and disable Windows Defender.

 

If you are in a BSOD boot loop, follow these instructions from @SaltyLager to disable Windows Defender
https://h30434.www3.hp.com/t5/Desktop-Operating-Systems-and-Recovery/KMODE-EXCEPTION-NOT-HANDLED/m-p...

 

  1.  In the recovery screen - go to troubleshoot - advanced options - command prompt.
  2. Login with your password
  3. In the command prompt enter regedit and press enter.
  4. Double-click hkey local machine
  5. Click file - load hive
  6. Browse to C( was D in my recovery environment):\windows\system32\config
  7. Open software
  8. Enter a Key Name, I used temp
  9. Open the temp key, then expand policies - Microsoft - windows defender
  10. Create a 32bit dword DisableAntiSpyware. Set it to 1
  11. Right click windows defender in the left and create a new key Real-Time Protection and create these 32 bit dwords set to 1
    1. DisableBehaviorMonitoring
    2. DisableOnAccessProtection
    3. DisableScanOnRealtimeEnable
  12. Scroll back up and highlight the temp key, and then click file unload hive.
  13. Then highlight hkey local machine again, and choose load hive. This time load system from the same location, and set Temp\contolset001\services\windefend start to 4

 

If you are still able to log into your computer and want to disable Windows Defender, follow these instructions from @RJWard
https://h30434.www3.hp.com/t5/Desktop-Operating-Systems-and-Recovery/KMODE-EXCEPTION-NOT-HANDLED/m-p...

 

  1. DISABLE TAMPER PROTECTION via Windows Security \ Virus & Threat protection \ Manage settings.  This is important or defender will continue to reactivate.  DO NOT try to turn of defender while you are in here.
  2. Edit the registry via REGEDIT.  There are FOUR entries to make.
    1. Right click on the folder [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defenderin the registry and add a new DWORD (32) "DisableAntiSpyware" and set it to 1
    2.  Right click again on the same folder in the registry and add a new KEY (folder)  "Real-Time Protection"
      1. Right click on the new key from above (Real-Time Protection) and add the following new DWORD(32) values and set each to 1
        1. "DisableBehaviorMonitoring"
        2. "DisableOnAccessProtection"
        3. "DisableScanOnRealtimeEnable"

 

With Windows Defender disabled, you are unprotected and would recommend downloading a free 3rd party software.  Kaspersky, Avast, AVG, McAfee, etc.

0 Kudos
TWYates
Author
New member
2 1 0 0
Message 3 of 7
Flag Post
HP Recommended

Is a temporary answer to use a third party software in lieu of Windows Defender?

0 Kudos
FireBall90
New member
3 3 0 1
Message 4 of 7
Flag Post
HP Recommended

Here are steps I performed on my machine, Not sure if it resolves but sharing for others to try out.

 

Disconnected from Internet, created restore points between each step.
Ran SFC /Scannow (Admin Command prompt)
Uninstalled Samgsung NVM Express Controller Driver under Storage Controllers (Windows defaulted it back to windows driver) (Was an error in my event logs maybe unrelated as not original SSD from when purchased)
KB4556799 - found in control panel > add/remove > installed updates and removed this update. 
Ran windows update hide tool (wushowhide.diagcab)(http://download.microsoft.com/download/f/2/2/f22d5fdb-59cd-4275-8c95-1be17bf70b21/wushowhide.diagcab) and it found KB2267602 to hide.
Connected back to internet to test.

0 Kudos
Keiichi
Level 4
45 45 0 36
Message 5 of 7
Flag Post
HP Recommended

@FireBall90 wrote:

Here are steps I performed on my machine, Not sure if it resolves but sharing for others to try out.

 

Disconnected from Internet, created restore points between each step.
Ran SFC /Scannow (Admin Command prompt)
Uninstalled Samgsung NVM Express Controller Driver under Storage Controllers (Windows defaulted it back to windows driver) (Was an error in my event logs maybe unrelated as not original SSD from when purchased)
KB4556799 - found in control panel > add/remove > installed updates and removed this update. 
Ran windows update hide tool (wushowhide.diagcab)(http://download.microsoft.com/download/f/2/2/f22d5fdb-59cd-4275-8c95-1be17bf70b21/wushowhide.diagcab) and it found KB2267602 to hide.
Connected back to internet to test.


Do you have the rest of the latest updates?  Can you try manually turning off real-time protection in the Windows Security Settings?  For some of us, when we flip the switch, it BSODs right away.  If it doesn't, it might point to something in KB4556799 making Windows Defender and HP go crazy.  Although many of us had the BSOD boot loop prior to that update.

0 Kudos
Keiichi
Level 4
45 45 0 36
Message 6 of 7
Flag Post
HP Recommended

@TWYates wrote:

Is a temporary answer to use a third party software in lieu of Windows Defender?


If you can still log into your computer, I would follow the instructions to disable Windows Defender first and then install 3rd party software.  I tried installing Kaspersky before doing that and it BSOD, because it tried to turn off Windows Defender.

0 Kudos
FireBall90
New member
3 3 0 1
Message 7 of 7
Flag Post
HP Recommended

It turns off and on with no problem

Warning Be alert for scammers posting fake support phone numbers and/or email addresses on the community. If you think you have received a fake HP Support message, please report it to us by clicking on "Flag Post".
† The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation