KMODE EXCEPTION NOT HANDLED

[Ferrumic]

@saltyLager

Would there be a method of achieving this through the Group Policy Editor on machines running Pro?

[philip42h_2]

As I have reported previously, I rebuilt my Envy from Microsoft USB Media on 12th May and re-installed the HP Support Assistant together with the HP Support Framework on 16th May but have NOT allowed it to install any driver updates. I have Windows Updates running and the PC up-to-date, and I have the latest version of Windows Defender installed with latest signatures. All seems well ATM - no BSODs, no mini dumps.

But I really want to know what the fault was / is so that I can be confident that I can stop it from recurring.

I think that we can be reasonably sure of the following:

• There is no single cause of the fault - rather that it is a combination of two or more pieces of incompatible software causing the issue.
• The fault was likely introduced with the [cumulative] updates for Windows issued in April / May 2020.
• In my case, I believe that the drivers delivered via the HP Support Assistant are complicit in the issue.
• I suspect that Fast Startup may exacerbate the problem, if not have an actual role to play in the issue.

I note that there was a Windows Defender platform update (version 4.18.2004.6, KB4052623) issued on or before 12th May. I have this installed on my PC without apparent issue.

So, this morning I have disabled Fast Startup and installed the Intel Rapid Storage Driver - 17.5.2.1024 Rev.A, Feb 11, 2020  using HP Support Assistant . So far all seems perfectly OK but I'll need to re-enable Fast Startup and give the PC a while (e.g. 48 hours) to see whether the problem returns ... I'll post back either way.

And, while I appreciate that the HP Community Forums are just that - community self help forums - I suspect that this issue and thread has reached a point where it might be appropriate for an HP Employee to acknowledge the thread and express an interest ... 😉

[alexgogan]

I had the exact same issue on my 2 Omen machines, now the newer one caused the biggest issue. 

On the Uninstall the last update solved my problem on one machine, then I ever so slowly updated everything back not normal and so far there has been no issue a week after the event.

But with my office based machine (after trying everything else the same as my home one, I had the bootloop from hell. Unfortunately I did not run the uninstall last windows update, first, but the Feature Update. This caused an unmitigated disater for me. Recover disk etc would not work. Even when I created one from the other Omen machine.

I had to reach out to HP support and download a new HP image and wipe my machine! Atleast all my data is on the cloud so thats not an issue, just all the programs..

It was either a mess with WIndows Update clashing with one of the drivers that caused this hell, (had the exact same issue with a Dell machine last year only way was to wipe and start again!

[philip42h_2]

Update from me:

• I reinstalled Windows from a Microsoft Media USB on 12th May. Installed Office 365 and allowed and applied all Windows and Microsoft updates.
• On 16th May I reinstalled the HP Support Assistant together with the HP Support Framework but declined to update with any of the HP supplied drivers.

So I have been running with the latest software from Microsoft, including Windows Defender for nearly a week without incident.

This morning I installed the Intel Rapid Storage Driver - 17.5.2.1024 Rev.A, Feb 11, 2020 from HP Support and have been running for three or four hours without any problems. It's way too soon to count chickens but I'll post back when it all fails or I take the next step! 🙂

[August_Fields]

I have been dealing with this for about a week. OMEN by HP Obelisk Desktop 875-0060 with windows 10 home. The first time it happened I think the system recovered on it's own. But I ran the debug analyzer and it indicated msmpeng.exe was where the error was coming from. I had malwarebytes installed and I don't think windows defender was active. I uninstalled malwarebytes and windows defender became active and I didn't have anymore issues, but then a few days later it started bluescreen looping this time with the same error.  I ended up resetting the pc and then running the dism thing after it came back up which showed 9 errors and fixed. I didn't have any problems for about 3 days and then it happened again last night and I had to reset again by interrupting the startup and going into recovery mode.  I have steadily been updating with windows update AND HP support assistant each time and I'm not fluent enough to know which thing not to do. Also, there is a warning in my event viewer I've never seen before about bluetooth low energy mode, but it seems to be just a warning. And there are errors in the application log regarding perflib, perfproc, perfnet. Perhaps these are completely unrelated to this issue. I have no idea what all that means. Dear God, I wish I had some kind of resolution 'cause this getting everything back the way I want it and then having to do it over is KILLING me!

[Ferrumic]

This is a right, royal PITA, and it would be helpful if someone from HP might care to comment on this.

There has to be some "synchronicity" with something that's arrived on our machines recently. I can date my first BSOD and crash to 8th May exactly, and I'm scouring this machine to see if there are any logs or other information on what may have arrived in the week or so preceding that date.

The last two Cumulative Windows 1909 updates before my crash were on 13th and 16th April, which would seem to leave a fair slice of time to play up before 8th May. Of course, by that date the 10 days to uninstall Windows updates had long passed, so that screws things as well.

I've stopped every HP scheduled task and service from running at any time. The Support Assistant is useless anyway, as it will not update to the latest version from the HP website, never updates the details on anything installed via it, and is junk generally.

[raygorsuch]

@SaltyLager, this worked perfectly. I tried a fresh install on a different hard drive first and that worked with all updates, but then I looked in the history and the last windows defender update failed to load. It said that there were no more available updates to install, but I assume it would come back eventually. I tried restore points first, but the PC came to me reset and system protection was off. Is that common for these Envy desktops with smaller SSDs?

[A_User12345]

Here, do this:

Hard restart your computer.

On the splash screen, press and hold power.

Turn it back on.

Keep doing that until you get to a screen saying "Preparing automatic repair".

Click Advanced opptions. 

Click Troubleshoot.

click Command prompt.

Type sfc /scannow and wait until it finishes.

If that solves it, type exit.

If not type chkdsk and wait.

Type exit. Check if it works.

[SaltyLager]

@Ferrumic once stuck in the boot loop, there's no way to apply Group Policy from the recovery environment. The registry method I posted works on home and pro. If the machine is joined to a domain, and you enforce windows defender through group policy, you can run the registry keys to break the boot loop, and then boot with the network cable unplugged. Create an OU for the affected machines the disables Windows defender, and and then plug the network cable in and run a gpupdate /force before rebooting. 

Regardless of running home or pro, make sure to install a third party antivirus product since defender is providing no protection.

[Ferrumic]

@SaltyLager

Thanks for the reply. I've managed to break out of the boot loop because I have Macrium as a boot option plus a usb version, which has enabled me to restore one of the Macrium images. With luck, I get a working system for a day or two before it  crashes again.

I aim to disable Defender via gpedit when it's running, plus disable any scheduled stuff associated with it. 

I have a paid Avast sub plus Malwarebytes Premium, and if the system stabilises without Defender, I'll re-enable Avast.

I certainly haven't downloaded any drivers etc from HP in the timescale involved, so I think it may well be another Microsoft thing causing this.