KMODE EXCEPTION NOT HANDLED

[IDCurrent]

I solved my issue. I've been following these posts, so I'll post my success.

I could not log in at all and the only restore point failed to install, so I had to do a full system restore.

After that I opened system config and started in diagnosis mode. That prevented further crashes (so a full restore did not solve the problem). So I just completely uninstalled McAfee, which was automatically installed on reset. And then everything was fine. No problems with crashes since. So for me, McAfee was the only problem. I also installed all the latest windows updates after this. Hope I can help someone else with this info.

[Ferrumic]

IDCurrent,

There seems to be a mind-boggling range of possible causes and fixes.

It'll be good if you've managed to sort your system this way i.e. MacAfee is the culprit, and the system runs fine after uninstalling it.

Please post here if you do encounter any further problems; or, indeed, when you've had a good period of trouble-free running. That way, we'll all stay updated with what's going on.

[JimCobb3216]

Add me to the list of HP users experiencing this issue. Here's a brief rundown.

May 11 - BSOD out of nowhere, with this KMODE error. I was unable to boot into Safe Mode, computer would just BSOD again, but I was able to boot normally, though the computer wouldn't stay up for long before it would crash. I posted in the Microsoft community for help. Ended up, the rep there determined it was related to McAfee, so I uninstalled everything as quickly as I could before the computer crashed again. All seemed well.

May 14 - Computer wouldn't wake from sleep mode, so did a hard power down. Turned it on and computer went to BSOD with same KMODE error. This time, no matter what I did, it wouldn't reboot, ending up in the Windows Recovery area. Posted again in the Microsoft community and was told to talk to HP as the computer is still under warranty. Contacted support via Chat and they walked me through reinstalling Windows, losing a bunch of my data in the process. Once the machine was back up and running, it seemed fine.

May 19 -  Installed Malwarebytes to do a quick scan. The moment I tried to run the program, BSOD with KMODE. However, this time the computer rebooted itself (previously, it would just hang on the BSOD). As soon as it was back up, I uninstalled Malwarebytes (using Add/Remove Programs). Then, I downloaded their consumer tool to remove any lingering files. All seemed okay for about 30 minutes, then BSOD again. Went back to Microsoft community and posted there. I was told that the new dump files revealed: "Both the crashes blamed MsMpEng.exe which is a part of Windows Security." I tried using Drive Verifier, per their request, but system just crashed. Managed to restore to a point I'd saved on May 18 and, fingers crossed, computer hasn't crashed yet.

Very frustrating, to say the least. Figured I'd post in this thread to share what little info I had and hope that someone comes along with a permanent solution.

[RJWard]

THIS WORKED FOR ME

From reading other posts on this, it does appear to be related to Windows Defender.  There is another post that blames it on the wireless card, but that does not seem to have the traction that defender does.  Here are the steps that I took, and have been running fine for 24 hours now.

(My apologies for the sloppy nature of the post but I did want to try and help out as I know first hand how frustrating this is)

1) In my router, I blacklisted the MAC addresses for the wired and wireless network adapter.  This prevents the auto updates immediately after reset and will buy you some time to complete the following.  Optionally you can do a complete reset and wipe out your user files and everything, but this worked for me only reinstalling windows.

2) Perform the reset to have windows re-installed.

3) As soon as you are back in windows, you need to complete the steps below in order to completely deactivate Windows Defender. You may continue to encounter the blue screen while you proceed, but if you push through you can eventually get it completed.  There is another post on how to do this from the recovery command prompt, but I was unable to get to the C:|windows directory in order to get that to work. I suspect it is because of tamper protection

NOTE: If you try to turn off defender in the security center, it seems to only make matters worse and triggered the error every time in my case.

Here are the sub- steps for number 3::

DISABLE TAMPER PROTECTION via Windows Security \ Virus & Threat protection \ Manage settings.  This is important or defender will continue to reactivate.  DO NOT try to turn of defender while you are in here.

Edit the registry via REGEDIT.  There are FOUR entries to make.

1) Right click on the below folder in the registry and add a new DWORD (32) "DisableAntiSpyware" and set it to 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]

2) Right click again on the same folder in the registry and add a new KEY

"Real-Time Protection"

3) Right click on the new key from above (Real-Time Protection) and add the following new DWORD(32) values and set each to 1

"DisableBehaviorMonitoring"

"DisableOnAccessProtection"

"DisableScanOnRealtimeEnable"

The below link does a better job at detailing how to turn off tamper protection and perform the first registry edit

https://www.windowscentral.com/how-permanently-disable-windows-defender-windows-10#disable-windows-d...

You will want to install an antivirus package after reboot, as this completely turns off defender!

HOPE THIS HELPS!

[AReifschneider]

When my KMODE problems started, McAfee was long uninstalled, and the first thing I did on my first reinstall was get rid of it, and the issues still came back a day later.

The version of windows I got from the creation took did not have any bundled antivirus software, nor did it have many HP programs either. It was also version 1909, and it has worked for three days with fast start turned off. I'm still making regular reset points because I doubt it will last. 

[philip42h_2]

---

@philip42h_2 wrote:

---

@philip42h_2 wrote:

...  I installed the Intel Rapid Storage Driver - 17.5.2.1024 Rev.A, Feb 11, 2020 from HP Support and have been running for three or four hours without any problems. It's way too soon to count chickens but I'll post back when it all fails or I take the next step! 🙂

---

The Intel Rapid Storage Driver has now been running for 24 hours so I start adding back the Realtek drivers starting with the Bluetooth Audio driver.

[I'm torn between adding them all in one go - to show that they all now work (?) - or adding them back one at a time so as to have the best opportunity of identifying the 'culprit']

---

I reinstalled the Realtek LAN driver this morning as the final step in putting back all the HP supplied drivers recommended by HP Support Assistant and that appeared to go well ...

... and while I was right in the middle of a post to that effect you'll never guess what happened ... 😞

I was able to log back on and copy the mini dump files to USB - for analysis shortly.

I had been scrupulous in setting restore points in order to deal with exactly this eventuality and so, without further ado went straight back to the restore point from yesterday and, while this initially appeared to work I got a new error as the PC restarted - CRITICAL_PROCESS_DIED ...

OK, so just go back to an earlier restore point - I have plenty? ... NO ... the PC won't do that because it claims that 'system protection' is not enabled on the C: drive.

[I'm suspecting here that it is confusing the C and D drives but I'm none to sure how to prove that or otherwise.]

I'm off for a swear, cup of tea, analyse the mini dump and try to work out the least worst way to get my PC back up and running ... oh, and I'll re-open my case with HP Support ... 😉

[bibsout]

@Philip42h_2

Have you disabled Windows Defender as per previous posts? So far my system has been stable with it disabled.

[August_Fields]

The switched drive issue happened with me during one of my reinstalls. The troubleshooting recovery environment showed the d drive instead of the c drive. I wonder what's up with that to add to all this mess?

[rcw_97]

Hi. 

I've been having this same exact issue as well.

I did a factory reset on May 12th and was fine until midnight May 19th/20th. About 7-8 days which if I recall is about the exact period of Windows auto updater. Heh. 

It definitely seems to be an update related issue, possibly Windows Defender?

It doesn't look like there has been a definitive solution yet but could someone compile some steps that have worked for them so I can try it?

From what I gather deferring updates & disabling windows defender and possibly not installing HPs drivers seems to be the overall temporary solution until HP/Microsoft sort out their issues.

Any help would be appreciated! Need this computer to work!

Model: HP OMEN Obelisk 875-0084

I do still have warranty for another 6 months, at this point I'll probably try extending it, so hopefully if it's hardware I can send it back but doesn't seem to be hardware

[philip42h_2]

---

@bibsout wrote:

@Philip42h_2

Have you disabled Windows Defender as per previous posts? So far my system has been stable with it disabled.

---

No, I have had Defender running for over a week without trouble ... but 'yes' analysis of the mini dump showed that it was Defender that was running when the KMODE_EXCEPTION_NOT_HANDLED occurred. I want a proper fix more than I need a workaround right now so have left Defender on the field (so to speak).