KMODE EXCEPTION NOT HANDLED

[August_Fields]

Just out of curiosity, did anyone else notice this warning PRIOR to these problems in their system log from source BTHUSB (that's bluetooth) ?

The local adapter does not support an important Low Energy controller state to support peripheral mode. The minimum required supported state mask is 0x2491f7fffff, got 0xffffffff. Low Energy peripheral role functionality will not be available.

Also, I just noticed this and it seems a little strange? It came from application log source: HP Active Health - Event ID 80:

-- SECURITY WARNING -- Unable to deserialize super secret file hashes. Will assume evil is afoot - all Validate() calls will return DOESNT_MATCH at HP.ActiveHealth.Commons.Security.HashStore.LoadHashesFromFile() - **bleep**?

Also, the application log entries start at 3:00 pm and continue normally for 3 minutes and then jump back 3 hours in time to 12:03 pm?

[siradix]

I had the same issue, followed Warwagon1979 example and used windows 10 usb, brought up command line, ran regedit, selected Hkey_local_machine, loaded the software Hive from the config folder in system 32, created my key, navigated to software>microsoft>windows defender in my key, changed the disableantispyware to 1, changed the disableantivirus to 1, unloaded the key I created, exited regedit, and started windows 10.

Once in, I downloaded adwcleaner to remove the preinstalled HP touchpoint analytics client. Note this is automatically downloaded from windows update with the HP Application Driver. Once removed and rebooted, I rebooted back into my win 10 usb, changed the disableantispyware and disableantivirus back to 0, and restarted. I then ran windows update to install which installed KB2267602 Version 1.315.1141.0. Seems to be stable.

Before doing the final part I also tested just installing a third party antivirus software with disableantispyware and disableantivirus set 1 one. This works, but once the third part antivirus is removed, the problem is back.

I believe that the antispyware in windows defender is what causes the crash with the HP touchpoint analytics client on the computer. Not sure if it is the older database or just the HP touchpoint analytics client.

[ALL-N-1]

Disabling Windows Defender using regedit 

through the  command prompt got me out of the kmode exception bootloop/blue screen but now has me stuck in safe mode each time I restart. I have a feeling I did something wrong and really didn’t understand the last step to change the win defend value to 4. Does anyone have any suggestions to get it back to normal mode  now that I’m able to get into safe mode? Thanks. 

[Dberhow]

You might be on to something as I also have an Epson xp-600 series printer, and had the same issue.

Disabled Bit Defender, and am back up and running, but this started Tuesday morning.

[siradix]

All-N-1 The default value for start is 2.

[Brainz01]

My boys have identical Pavillion gaming rigs (new as of Christmas).  The BSOD issue has created issues for the past two weeks.  Prior bouts were cured with a simple system restore, but yesterday, one of the machines entered a BSOD boot-loop as there were no eligible restore points.  The machine would boot, splash the login screen, and then BSOD.  Very frustrating -- essentially a bricked PC.

Thank you to all the helpful posts on this forum I was able to un-brick the machine (without losing data or reinstalling Windows).  It takes about 10 minutes by following the instructions below (which I've slightly modified to aid the clarity for other newbs like me):

If you are in a BSOD boot loop, follow these [clarified] instructions from @SaltyLager to disable Windows Defender
https://h30434.www3.hp.com/t5/Desktop-Operating-Systems-and-Recovery/KMODE-EXCEPTION-NOT-HANDLED/m-p...

1.  In the recovery screen - go to troubleshoot - advanced options - command prompt.
2. Login with your password [NOTE: you may not have to do this]
3. In the command prompt enter regedit and press enter.
4. Double-click hkey local machine
5. Click file - load hive
6. Browse to C( was D in my recovery environment):\windows\system32\config
7. Open software
8. Enter a Key Name at the prompt, I used "temp"
9. Open the temp key on the upper left and then expand policies - Microsoft - windows defender
10. Create a 32bit dword DisableAntiSpyware. Set it to 1
11. Right click windows defender in the left and create a new key Real-Time Protection and create these 32 bit dwords and set each of them to 1
    1. DisableBehaviorMonitoring
    2. DisableOnAccessProtection
    3. DisableScanOnRealtimeEnable
12. Scroll back up on the left side and highlight the temp key, and then click file unload hive.
13. Then highlight hkey local machine again on the left
14. Click file - load hive
15. Browse to C:\windows\system32\config
16. Open system
17. Enter a Key Name at the prompt, I used "temp"
18. Open the temp key on the left, then expand  controlset001 - services - windefend
19. Double click the Start dword on the right and set it to 4
20. Scroll back up on the left and highlight the temp key, and then click file unload hive.
21. Click file exit, and you should be back to command prompt
22. Restart your PC with a long press of the power button.  Note, your PC may initially reboot into the recovery screen again -- if it does, click the option to restart the machine again.

Hopefully upon reboot, you'll make it all the way to the login screen without the BSOD.

Good luck!

[siradix]

I dont believe creating following key are nessary

1. DisableBehaviorMonitoring
2. DisableOnAccessProtection
3. DisableScanOnRealtimeEnable

but it doesn't hurt.

From what I seen Windows Defender likes to correct our corrections, that's why when installing a third party antivirus software it BSOD, and you just simply have to disable the antispyware and the antivirus registries.

EDIT: Forgot to mention, I never did the change the start registry to 4, and my computer hasn't blue screened yet

[Aramtech]

---

@Brainz01 wrote:

My boys have identical Pavillion gaming rigs (new as of Christmas).  The BSOD issue has created issues for the past two weeks.  Prior bouts were cured with a simple system restore, but yesterday, one of the machines entered a BSOD boot-loop as there were no eligible restore points.  The machine would boot, splash the login screen, and then BSOD.  Very frustrating -- essentially a bricked PC.

Thank you to all the helpful posts on this forum I was able to un-brick the machine (without losing data or reinstalling Windows).  It takes about 10 minutes by following the instructions below (which I've slightly modified to aid the clarity for other newbs like me):

If you are in a BSOD boot loop, follow these [clarified] instructions from @SaltyLager to disable Windows Defender
https://h30434.www3.hp.com/t5/Desktop-Operating-Systems-and-Recovery/KMODE-EXCEPTION-NOT-HANDLED/m-p...

1.  In the recovery screen - go to troubleshoot - advanced options - command prompt.
2. Login with your password [NOTE: you may not have to do this]
3. In the command prompt enter regedit and press enter.
4. Double-click hkey local machine
5. Click file - load hive
6. Browse to C( was D in my recovery environment):\windows\system32\config
7. Open software
8. Enter a Key Name at the prompt, I used "temp"
9. Open the temp key on the upper left and then expand policies - Microsoft - windows defender
10. Create a 32bit dword DisableAntiSpyware. Set it to 1
11. Right click windows defender in the left and create a new key Real-Time Protection and create these 32 bit dwords and set each of them to 1
    1. DisableBehaviorMonitoring
    2. DisableOnAccessProtection
    3. DisableScanOnRealtimeEnable
12. Scroll back up on the left side and highlight the temp key, and then click file unload hive.
13. Then highlight hkey local machine again on the left
14. Click file - load hive
15. Browse to C:\windows\system32\config
16. Open system
17. Enter a Key Name at the prompt, I used "temp"
18. Open the temp key on the left, then expand  controlset001 - services - windefend
19. Double click the Start dword on the right and set it to 4
20. Scroll back up on the left and highlight the temp key, and then click file unload hive.
21. Click file exit, and you should be back to command prompt
22. Restart your PC with a long press of the power button.  Note, your PC may initially reboot into the recovery screen again -- if it does, click the option to restart the machine again.

Hopefully upon reboot, you'll make it all the way to the login screen without the BSOD.

Good luck!

---

Registered for the site just so I could follow up with a little more info. I'm currently working on a client's HP Pavilion Gaming 790-00xx that came in today with this same KMODE BSOD. I used the above steps to disable Windows Defender which allowed me to boot back into Windows normally.

I read earlier in this thread that Windows Update KB4556799 was causing problems so I went to Control Panel > Programs and Features > View Installed Updates and uninstalled the update. I then used the "Show or Hide Updates" Troubleshooter to hide the update and prevent it from being automatically reinstalled. The troubleshooter is available here (https://support.microsoft.com/en-us/help/3073930/how-to-temporarily-prevent-a-driver-update-from-rei...), the download link is toward the bottom of the page under the "Choose your automatic updates" heading.

After rebooting and confirming that the update had been uninstalled and no longer showing in the available/pending updates list, I re-enabled Windows Defender by going back into the registry and changing all the parameters from 1 to 0. After rebooting, Windows Defender was working again. I rebooted several times to be sure it would continue booting properly.

This particular PC was running Windows 10 version 1903. After all of the above, I allowed it to install the 1909 update. It has continued working fine, booting with no problems, Windows Defender active and updated.

The strange thing is, even though KB4556799 was hidden and never showed that it was being installed after I set it to "hidden", now that the 1909 update has been installed, KB4556799 again shows up in the list of recently installed updates.

[DarkMajin]

Ah ha...so HP is saying that KB4556799 is an issue.

[Aramtech]

@DarkMajin wrote:

Ah ha...so HP is saying that KB4556799 is an issue.

---

No, not just HP. See here: https://www.forbes.com/sites/gordonkelly/2020/05/21/microsoft-windows-10-warning-crashes-bsod-chrome...