KMODE EXCEPTION NOT HANDLED

[Keiichi]

---

@btschuster wrote:

FWIW, I decided to test the theory that the latest Defender Update fixed this. I have Security Intelligence version 1.315.1096.0 that installed this evening. In an attempt to test this and being either brave or stupid I went to Windows Security settings and attempted to turn off realtime protection. Instant system crash with KMODE error.

---

Thanks for trying, at least you know that trying to disable Windows Defender is still causing the issue after the latest Security Intelligence  Update.

[Bruceo1]

From Smurkong's post on page 21:

Go to troubleshoot - advanced options - command prompt.

Login with your password

In the command prompt enter regedit and press enter.

Double-click hkey local machine

Click file - load hive

Browse to C( was D in my recovery environment):\windows\system32\config

Open software

Enter a Key Name, I used temp

Open the temp key, then expand policies - Microsoft - windows defender

Create a 32bit dword DisableAntiSpyware. Set it to 1

Right click windows defender in the left and create a new key Real-Time Protection and create these 32 bit dwords set to 1

DisableBehaviorMonitoring

DisableOnAccessProtection

DisableScanOnRealtimeEnable

Scroll back up and highlight the temp key, and then click file unload hive.

Then highlight hkey local machine again, and choose load hive. This time load system from the same location, and set 

Temp\contolset001\services\windefend start to 4

You have to be semi-comfortable in the regeditor. The spot that confused me was the first hive creation step where he has you call it temp. It places the hive in the hkeylocalmachine directory and then you go down that tree to set the new keys. It will help to look up loading hives on youtube. 

[Keiichi]

---

@Bruceo1 wrote:

HP Omen Obelisk Bootlooping with Kmode. Could not access the system in safe mode and recovery restore options would not work. So I reinstalled with Win 10 USB recovery media. After all updates appeared to be installed and got all my programs reinstalled it worked for about half a day then got the Kmode again and bootloop. Same exact issue none of the recovery techniques worked.

Disabling Windows defender using recovery command prompt regedit with SmurfKongs instructions got me right back in. What a major CF this is....

---

Okay, so a quick summary so far:

For most of us, to reproduce the BSOD, we can manually try to turn off Windows Defender in the GUI and immediately get a BSOD with KMODE, but we are able to log back in.  However, when we get the BSOD unexpectedly, usually we go into a boot loop where we can't even get back into Windows, even with safe mode.  The only way to escape that and log back in WITHOUT doing a system restore OR re-installing windows, is to use the system recovery command prompt and disable Windows Defender.

If you are in a BSOD boot loop, follow these instructions from @SaltyLager to disable Windows Defender
https://h30434.www3.hp.com/t5/Desktop-Operating-Systems-and-Recovery/KMODE-EXCEPTION-NOT-HANDLED/m-p...

1.  In the recovery screen - go to troubleshoot - advanced options - command prompt.
2. Login with your password
3. In the command prompt enter regedit and press enter.
4. Double-click hkey local machine
5. Click file - load hive
6. Browse to C( was D in my recovery environment):\windows\system32\config
7. Open software
8. Enter a Key Name, I used temp
9. Open the temp key, then expand policies - Microsoft - windows defender
10. Create a 32bit dword DisableAntiSpyware. Set it to 1
11. Right click windows defender in the left and create a new key Real-Time Protection and create these 32 bit dwords set to 1
    1. DisableBehaviorMonitoring
    2. DisableOnAccessProtection
    3. DisableScanOnRealtimeEnable
12. Scroll back up and highlight the temp key, and then click file unload hive.
13. Then highlight hkey local machine again, and choose load hive. This time load system from the same location, and set Temp\contolset001\services\windefend start to 4

If you are still able to log into your computer and want to disable Windows Defender, follow these instructions from @RJWard
https://h30434.www3.hp.com/t5/Desktop-Operating-Systems-and-Recovery/KMODE-EXCEPTION-NOT-HANDLED/m-p...

1. DISABLE TAMPER PROTECTION via Windows Security \ Virus & Threat protection \ Manage settings.  This is important or defender will continue to reactivate.  DO NOT try to turn of defender while you are in here.
2. Edit the registry via REGEDIT.  There are FOUR entries to make.
   1. Right click on the folder [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender] in the registry and add a new DWORD (32) "DisableAntiSpyware" and set it to 1
   2.  Right click again on the same folder in the registry and add a new KEY (folder)  "Real-Time Protection"
      1. Right click on the new key from above (Real-Time Protection) and add the following new DWORD(32) values and set each to 1
         1. "DisableBehaviorMonitoring"
         2. "DisableOnAccessProtection"
         3. "DisableScanOnRealtimeEnable"

With Windows Defender disabled, you are unprotected and would recommend downloading a free 3rd party software.  Kaspersky, Avast, AVG, McAfee, etc.

[ALL-N-1]

Thanks for the quick reply. That’s the best approach I’ve seen so far and will give it a try. 

[Kmassig2691]

Out of curiosity what all did you redownload?  Did you go back through and download the hp support assistant and omen command center following the fresh install?  

[Keiichi]

---

@Kmassig2691 wrote:

Out of curiosity what all did you redownload?  Did you go back through and download the hp support assistant and omen command center following the fresh install?  

---

I don't have an OMEN, but a Pavilion Gaming Desktop, so I did re-download the HP Support Assistant and all available drivers.  I also re-downloaded all the latest Windows Updates.  Main difference is that I have disabled Windows Defender.  From my previous BSODs, I avoided stuff like Corsair iCUE and even Discord, but I've re-installed those items back as well because I had a BSOD loop yesterday without those items installed.  Crossing my fingers for now, but we will see.....as my last recovery lasted a week or two before the BSOD.

[81Bruno]

Hi I can confirm that the Problem also appears on my HP Pavilion using AMD Ryzzen 5

[philip42h_2]

---

@81Bruno wrote:

Hi I can confirm that the Problem also appears on my HP Pavilion using AMD Ryzzen 5

---

So we can probably stop worrying that this issue is associated with a particular generation of the Intel processor chipset ...

But we do know, or at least suspect, that there is something in common in the way HP build or configure these particular desktop models that makes them susceptible to the issue.

I have an SSD, described as 256 GB PCIe® NVMe™ M.2 SSD on the spec sheet, and WDC PC SN520 SDAPNUW-256G-1006 - 238.47 GB on the PC, which makes mine a Western Digital device. If anyone has no SSD or anything substantially different we can cross that off the list of candidate suspects ...

[MircoZ]

@Keiiki

---

@Keiichi wrote:

---

@Bruceo1 wrote:

HP Omen Obelisk Bootlooping with Kmode. Could not access the system in safe mode and recovery restore options would not work. So I reinstalled with Win 10 USB recovery media. After all updates appeared to be installed and got all my programs reinstalled it worked for about half a day then got the Kmode again and bootloop. Same exact issue none of the recovery techniques worked.

Disabling Windows defender using recovery command prompt regedit with SmurfKongs instructions got me right back in. What a major CF this is....

---

Okay, so a quick summary so far:

For most of us, to reproduce the BSOD, we can manually try to turn off Windows Defender in the GUI and immediately get a BSOD with KMODE, but we are able to log back in.  However, when we get the BSOD unexpectedly, usually we go into a boot loop where we can't even get back into Windows, even with safe mode.  The only way to escape that and log back in WITHOUT doing a system restore OR re-installing windows, is to use the system recovery command prompt and disable Windows Defender.

If you are in a BSOD boot loop, follow these instructions from @SaltyLager to disable Windows Defender
https://h30434.www3.hp.com/t5/Desktop-Operating-Systems-and-Recovery/KMODE-EXCEPTION-NOT-HANDLED/m-p...

1.  In the recovery screen - go to troubleshoot - advanced options - command prompt.
2. Login with your password
3. In the command prompt enter regedit and press enter.
4. Double-click hkey local machine
5. Click file - load hive
6. Browse to C( was D in my recovery environment):\windows\system32\config
7. Open software
8. Enter a Key Name, I used temp
9. Open the temp key, then expand policies - Microsoft - windows defender
10. Create a 32bit dword DisableAntiSpyware. Set it to 1
11. Right click windows defender in the left and create a new key Real-Time Protection and create these 32 bit dwords set to 1
    1. DisableBehaviorMonitoring
    2. DisableOnAccessProtection
    3. DisableScanOnRealtimeEnable
12. Scroll back up and highlight the temp key, and then click file unload hive.
13. Then highlight hkey local machine again, and choose load hive. This time load system from the same location, and set Temp\contolset001\services\windefend start to 4

If you are still able to log into your computer and want to disable Windows Defender, follow these instructions from @RJWard
https://h30434.www3.hp.com/t5/Desktop-Operating-Systems-and-Recovery/KMODE-EXCEPTION-NOT-HANDLED/m-p...

1. DISABLE TAMPER PROTECTION via Windows Security \ Virus & Threat protection \ Manage settings.  This is important or defender will continue to reactivate.  DO NOT try to turn of defender while you are in here.
2. Edit the registry via REGEDIT.  There are FOUR entries to make.
   1. Right click on the folder [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender] in the registry and add a new DWORD (32) "DisableAntiSpyware" and set it to 1
   2.  Right click again on the same folder in the registry and add a new KEY (folder)  "Real-Time Protection"
      1. Right click on the new key from above (Real-Time Protection) and add the following new DWORD(32) values and set each to 1
         1. "DisableBehaviorMonitoring"
         2. "DisableOnAccessProtection"
         3. "DisableScanOnRealtimeEnable"

With Windows Defender disabled, you are unprotected and would recommend downloading a free 3rd party software.  Kaspersky, Avast, AVG, McAfee, etc.

---

It seems this works for me, thanks a lot

[SlurmMcKenzie]

I have the same problem on a HP M01-F0003ng.

This is a  Ryzen3 3200G with 8GB RAM. I upgraded the SSD to a 1TB SSD Samsung M.2.

Windows 10 home x64

First error was on 11.05.2020.

It took me a while, but i recovered it. Unfortunatelly the system restore was disabled.

But the only way i could recover this was by taking the SSD out and putting it in my HP Laptop with Intel CPU.

It did boot up right away with no problem, which leads me to the conclusion that this is a driver related problem,

in combination with a certain windows update or the update of the defender.

did some tweaking on the system while it was running on the laptop. 

deleted the last windows updates, did a full drive scan ...

in the end i got it to boot up on the original hardware again.

this time i enabled system restore, but i did not know about this thread here and that this problem was not solved.

the PC did work for another week, but yesterday the error came back.

system restore allowed me to "fix" it right away, but now i am also looking for a more permament solution as well and the identification of the problem to avoid it happening again.

since this happens apperently only on some HP (?) and with INTEL and AMD i don't know where to start.

my laptop is HP as well, but i did not get the error on that machine (yet).

it has Win 10 Pro x64 edit, apperently it is home edition as well. but i will make full updates on it as well just to be sure.