KMODE EXCEPTION NOT HANDLED

[Spaniard80]

---

@Keiichi wrote:

---

---

Good to hear!  As a test, can you manually try to turn off real-time protection in Windows Security settings?  Turn it back on if it doesn't BSOD right away.  

With everyone's help, it's good that we are now able to keep our systems up until an official fix is out.

---

Turning real-time protection on/off didn't cause a BSOD. Everything is still running well. For reference, the only Windows Update currently installed on the PC is a Security Intelligence Update for Windows Defender (KB2267602). It must have installed in the background, because I thought I turned off Windows Update... 

[ceilingbouncer]

I used my wife's HP laptop to prepare a Windows Media Creation Tool.  Plugged the USB into my Pavilion and by tapping F9, I could break out of the BSOD loop.  Failed with all the easy options including the restore point (as I had none).  Last resort was the advanced options.  So I'm sitting at the Windows Setup menu and it's asking me Where do you want to install Windows?  It gives me a choice among 5 partitions.  Not having done this before and not finding any guidance on choosing a partition on the internet including elsewhere on this website ... maybe my question is too basic to bother with ... I still need to pick a partition.  3 of the 5 look like possibilities ... Drive 1 Partition 1 SYSTEM,  Drive 1 Partition 3 Windows, and Drive 1 Partition 4 Windows RE tools.  I have a small amount of user data that's on C and I want to preserve it if possible so Drive 0 Partition 1 DATA doesn't look like a good choice.  The other 1 is Drive 1 Partition 2 (no additional name but type MSR).  Picking the correct partition and seeing what happens is my next step.  I would be grateful for help,  Of course, not knowing what lies ahead clicking on a partition may just lead to another list of choices for which I may have to beg another answer.

[Spanadero]

edit: misread your post

[philip42h_2]

---

@ceilingbouncer wrote:

I used my wife's HP laptop to prepare a Windows Media Creation Tool.  Plugged the USB into my Pavilion and by tapping F9, I could break out of the BSOD loop.  Failed with all the easy options including the restore point (as I had none).  Last resort was the advanced options.  So I'm sitting at the Windows Setup menu and it's asking me Where do you want to install Windows?  It gives me a choice among 5 partitions.  Not having done this before and not finding any guidance on choosing a partition on the internet including elsewhere on this website ... maybe my question is too basic to bother with ... I still need to pick a partition.  3 of the 5 look like possibilities ... Drive 1 Partition 1 SYSTEM,  Drive 1 Partition 3 Windows, and Drive 1 Partition 4 Windows RE tools.  I have a small amount of user data that's on C and I want to preserve it if possible so Drive 0 Partition 1 DATA doesn't look like a good choice.  The other 1 is Drive 1 Partition 2 (no additional name but type MSR).  Picking the correct partition and seeing what happens is my next step.  I would be grateful for help,  Of course, not knowing what lies ahead clicking on a partition may just lead to another list of choices for which I may have to beg another answer.

---

If your Pavilion is anything like my Envy (and I suspect that it is) drive 0 is your Data disk D and drive 1 is your system disk C - so best not to mess with drive 0 at all. If its not already too late post back with a full list of the partitions on drive 1 ...

You don't want to delete any partitions but install a new / second copy of Windows into the correct partition on drive 1.

[philip42h_2]

---

@Spanadero wrote:

edit: misread your post

---

🙂

The advice on a clean install was good - just needed to make sure that it was all partitions on the System drive that were deleted!

[Ferrumic]

Security Updates are all the same KB number, with different release numbers, and seem to get shoved down regardless of Update. I think they're lookup files containing threat data for WD to use, and are uninstallable.

I saw somewhere else in this thread that someone (apologies, but can't recall exactly who) had managed to get some contact with HP, who had told him that systems untouched by updates before 14th April are OK, and those after are not. I think most of us had worked out that there is a time frame for this problem, which I guess is in part dependent on when updates or drivers were downloaded per system (slightly controllable by the pause and day settings, especially in Pro).

However, knowing "times" is absolutely useless for getting to the heart of this. What is required is a precise identification of what software, drivers etc. are the cause, and a fix for the issue which DOES NOT involve yet more rebuilding of systems.

I have been a little puzzled as to how users are automatically receiving updates from HP. Digging deep in my memory, I checked the HP Support Assistant settings, and find that I turned OFF the automatic download feature in the Settings option. I have not optionally installed any HP software from HPSA since the A40 BIOS update months ago, and unless some has sneaked into my system contrary to my Settings, this would seem to suggest that the HP stuff was OK, but newer MS update(s) are the main culprit(s).

Having random drivers pushed onto the system is not, in my view, good practice. In Pro, I have disabled  "include driver updates with Windows Updates". I need to check, but for Home, I think it's possible to achieve the same effect via Control Panel>System>Advanced System Settings>Hardware>Device Installation Settings. Here the warning, ironically, is that "your system may not work properly" is you check the "Do not" option there. I am NOT recommending this, but I personally am using it so that further updates and downloads do not cause yet more confusion amid this chaos. There is,  IMHO, no value in trying to fix a problem when it turns into a moving one.

I see that there is another mega-Features update in the pipeline, and I won't be letting it anywhere near my system until this massive screw-up is fully identified, explained and completely fixed.

[philip42h_2]

---

@Ferrumic wrote:

...

I saw somewhere else in this thread that someone (apologies, but can't recall exactly who) had managed to get some contact with HP, who had told him that systems untouched by updates before 14th April are OK, and those after are not. I think most of us had worked out that there is a time frame for this problem, which I guess is in part dependent on when updates or drivers were downloaded per system (slightly controllable by the pause and day settings, especially in Pro).

However, knowing "times" is absolutely useless for getting to the heart of this. What is required is a precise identification of what software, drivers etc. are the cause, and a fix for the issue which DOES NOT involve yet more rebuilding of systems.

...

---

That 'someone' may have been me. The agent I spoke to last was blaming the KB<number> that related to the May cumulative update for windows and wanted me to uninstall that. The May cumulative update will have rolled-up updates issued since the April cumulative update, and I inferred from that that the cause of our troubles (in part) is an update released since 14th April.

I could easily be wrong but that seems to fit with the evidence that we have. I am not aware of having seen any reports of our specific issue prior to 1st May but equally we know full well that an affected machine may run apparently well for several days before the BSOD first strikes and the issue rapidly becomes a hard error after that.

We know from the analysis of several mini dumps that Windows Defender is implicated at least in part. And we know that some have had at least partial success in recovering from the boot loop by disabling Defender.

'Wild speculation' follows so treat with great caution ...

It appears that the Defender platform is updated on a monthly basis - the latest monthly update being:

April-2020 (Platform: 4.18.2004.6 | Engine: 1.1.17000.2)
 Security intelligence update version: TBD
 Released: April 30, 2020
 Platform: 4.18.2004.6
 Engine: 1.1.17000.2
 Support phase: Security and Critical Updates

So, in the spirit of the game Cluedo, I suspect this specific update of the Defender platform of being at least complicit in the issue.

Edit: And if I am correct, then I may already be doomed because the update to version 4.18.2004.6 is the one thing that Windows snuck in immediately as I did my second fresh install and before I could pause updates! Cue manic laughter ... 🙂

I could, of course, be very wrong and look forward to folk providing evidence one way or the other! 

And, even if I am wholly correct in my suspicion, we would still need to know which HP service is conflicting with Defender before we could be sure that this issue is resolved.

[philip42h_2]

---

@Ferrumic wrote:

...

Having random drivers pushed onto the system is not, in my view, good practice. In Pro, I have disabled  "include driver updates with Windows Updates". I need to check, but for Home, I think it's possible to achieve the same effect via Control Panel>System>Advanced System Settings>Hardware>Device Installation Settings. Here the warning, ironically, is that "your system may not work properly" is you check the "Do not" option there. I am NOT recommending this, but I personally am using it so that further updates and downloads do not cause yet more confusion amid this chaos. There is,  IMHO, no value in trying to fix a problem when it turns into a moving one.

---

That is correct for Windows Home. I have used Control Panel>System>Advanced System Settings>Hardware>Device Installation Settings in the hope that it will avoid  automatically downloading updated drivers while this is investigated. Whether it has any effect with Windows Updates paused is another matter but at times like these I'd go for belt and braces every time.

Edit: Looking at the description this may only be effective at the time a new device is installed ... ?

[Ferrumic]

Thanks for the confirmation.

I hope that HP and/or MS come up with an answer to this soon. I have a system image from 24th April, which I restored when this first started happening to me on 8th May. The system ran OK for a few days (about 3) and then the BSODs started again. This would chime with some software arriving from MS which then screwed me back to whence I'd come i.e. corrupted my working reinstalled image.

If I were sure of the cause, and the precise date, I could go back to my April image. That's a local operation, so I'd disconnect the ethernet connection pro tem., go through the rigmarole of disabling MS updates, HP stuff and Defender, update any applications to where they are now, and restore my user stuff from my SyncBackPro backups.  However, I'm not sure whether stopping Updates and Defender prevents or blocks the 30th April WD update, so I'll try to get some information on that.

Not directly relevant, but I use the Macrium Reflect paid package to image the system to a variety of external HDDs and SSDs (most repurposed from old machines), with daily images and a couple of monthly rollback ones in case. There is a free, but slightly limited version, which my wife has on her machine. To backup my Documents, Pictures and suchlike, I use SyncBackPro (there's also a free but limited version) which backs up or mirrors this stuff to the external drives, plus an array of flash drives. Critical stuff like documents and spreadsheets get backed up "on the fly" whenever I make changes to the folders or files, and the whole lot, including stuff like my Thunderbird and Firefox profiles, is saved (with versioning where necessary) at day-end.

In strict theory, I can restore a "clean" image, restore all my own 100% recent data, and that leaves me with checking non-MS applications for any updates that have arrived between today and the date of the restored image. Where updates are files downloaded to disk for installation, I scan them for malware and keep the latest copies, which get into the backups. I can then usually just run the reinstall files, without more downloading.

It works like a dream until Microsoft fling some untested update into the mix, and brick the machine again.

[Miller17]

---

@Keiichi wrote:

---

@Miller17 wrote:

Same issue here, computer stuck in BSOD loop until I booted with "Disable Early Launch anti-Malware protection", was able to get windows up and running in safe mode, do the registry edits as previously detailed out, and am not taking any windows updates.  I have been solid for ~12 hours.  I have AMD processor (Ryzen 7 3700x).  Question, when the time comes and there is a solution, how do I reverse the steps that I took to disable windows defender, I have never done that level of modification of the registry, is it as simple as removing the 4 keys I created?  Probably getting ahead of myself with "undoing the fix" but want to be prepared to test the solution when it comes.  

Thanks everyone in this forum for your detailed posts and your efforts to help us all, many of us (certainly me) would be still staring at a blue screen without it.  

---

You can either remove them or you can change the values for all the keys to 0.

---

Keiichi - how do I do it, I can't do it through Regedit when windows is running right, do I have to boot to it somehow?