KMODE EXCEPTION NOT HANDLED

[August_Fields]

The main reason I'm posting today is I've gotten my system to a point where

• I do NOT get a BSOD when I turn windows defender real time protection off through the security center GUI
• I don't have a third party AV installed.
• I have windows updates enabled with all recommended updates installed
• I have all the HP support assistant recommended updates installed

I'm not sure if this would indicate the problem is "solved" or not, but if the folks that were proposing a security definition might be a solution or an updated defender version itself might be a solution were right, then this would seem relevant. Current Defender versions are as follows:

AS OF 5/23/2020 2:29pm

The rest of this post is just for casual reading.

I was running fine with my factory reset windows for the past 4 days with mcaffee doing AV and defender auto disabled without having done any of the registry changes suggested in this forum (I was never able to get that to work through the recovery command prompt, I don't remember exactly why, but I don't think it would let me switch directories following the steps several different people have posted here). 

Anyways, I hadn't redownloaded and installed any of my programs and basically was just using my pc to watch netflix, waiting for a "statement" from HP or Microsoft that they have resolved the issue. But after thinking about it a while, I realized there is very little chance that either would fess up at this point. It seems much more likely after giving it some thought that they would just release an update under the guise of some normal operational procedure, even if they knew exactly where the conflict was occuring, and then as people are continually told to update their systems by both manufacturers (HP) and microsoft the problem would simply eventually disappear, thus eliminating some corporate embarrassment in the process.

I just don't want to wait that long before using my PC as it is intended! I want to run it with updates not paused and registries not changed and although I might like to install a third party AV, I definitely don't want mcaffee to be the one.

So I gnashed my teeth and uninstalled mcaffee. This did not automatically turn on windows defender as I would have thought, but I was thinking that's okay, because I wanted to make sure I had the latest versions before I started it.  Also, I think maybe after I rebooted my system at the end of uninstalling mcaffee it automatically turned on windows defender, I'm not sure, I just know I never actually had to turn on windows defender. So I went to windows updates and checked for updates which installed 2 definition updates for Defender as follows:

It also failed to install this one, which I think is not relevant, but I'm not sure:

I rebooted my system and when I went to security center it showed green checks on everything and windows defender active. This is where I held my breath and clicked turn real time protection off, and it just turned off after issuing the UAC warning.

The reason why I think this is relevant is because it's the first time I've been able to do that without a BSOD since this mess started. Admittedly I didn't even TRY after doing it so many times during this fiasco and falling into boot loops or having BSODs start.

Also, just FYI, checking HPSA for updates doesn't recommend any new updates since the ones it did after a factory reset I did on 5/19.

So I think that it just MAY be that these latest updates to windows defender or it's definitions may be that "permanent" solution we've all been waiting for, but I don't think we are ever going to get a statement from microsoft saying their antivirus program is what caused this, OR HP admitting their touchpoint analytics were conflicting with defender and that's what caused this, or anything of the sort. I guess that's the real point of this post. That's just not gonna happen.

In the meantime I'm going to start downloading my programs and games with my fingers crossed and try to go back to using my PC as it was intended.

I'll certainly post again if/when I start getting BSODs to let people know being able to turn off defender without a blue screen  with everything else enabled and functioning normally is not a reliable check to see if the problem still exists.

[DarkMajin]

heh you might be right nothing will get said.  But hopefully within a month something will be.

With my status quo I'm on 4th day of no crashes.  I won't be changing up for a month probably heh.

[CogX]

If this issue was caused by Windows Defender, it could be that they have already fixed the issue with the latest engine and/or defs.   This page should be part of everyone's Windows PC bookmark list:

https://www.microsoft.com/en-us/wdsi/defenderupdates

This is also important information:

https://support.microsoft.com/en-us/help/4052623/update-for-microsoft-defender-antimalware-platform

And this registry key:

reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Signature Updates"

[rcw_97]

Currently running 3 days without BSOD. They seem to have stopped after updating Windows Defender. I did do a clean install from Windows Media Creation Tool instead of a factory reset, and prior to updating windows defender was able to trigger BSOD by toggling Real-Time Protection.

Seeming highly likely Windows Defender was interfering with an HP driver. 

I would love an official statement even just from a forum moderator here but hopefully, it has been fixed.

[August_Fields]

---

@rcw_97 wrote:

Currently running 3 days without BSOD. They seem to have stopped after updating Windows Defender. I did do a clean install from Windows Media Creation Tool instead of a factory reset, and prior to updating windows defender was able to trigger BSOD by toggling Real-Time Protection.

Seeming highly likely Windows Defender was interfering with an HP driver. 

I would love an official statement even just from a forum moderator here but hopefully, it has been fixed.

---

OR, an HP driver was conflicting with Windows Defender? I know, it's just semantics really, but I haven't changed any HP drivers, but I've updated windows defender today, and it's definitely too early to tell, but if I'm still operating without blue screens in two weeks I'll post back here again for the benefit of all those people who have put delays on windows updates and disabled windows defender through the registry.

Plus, I'll just add for a footnote, I considered PAYING for Mcaffee just to prevent this from happening in the future. Whoever and however this was caused, it sure was a good way to get people to pay for third party AV software, don't you think?

[August_Fields]

Deleted this because I found out I was totally wrong with this

[cbrsmurf]

So who is still having BSOD issues? I haven’t used my pc in a few days in hopes a new update would fix this problem. 

[MircoZ]

@ August_Fields: ..Plus, I'll just add for a footnote, I considered PAYING for Mcaffee just to prevent this from happening in the future. Whoever and however this was caused, it sure was a good way to get people to pay for third party AV software, don't you think?... 

...did someone told you that third party antivirus update could not have any kind of mistake? In my 20 years experience I've already seen this before with other updates from other companies, nothing new under the sun....

On Monday I'll try to re-enable Defender on my customer's PCs, I'll let you know. 

Have a nice day 

[philip42h_2]

---

@CogX wrote:

If this issue was caused by Windows Defender, it could be that they have already fixed the issue with the latest engine and/or defs.   This page should be part of everyone's Windows PC bookmark list:

https://www.microsoft.com/en-us/wdsi/defenderupdates

This is also important information:

https://support.microsoft.com/en-us/help/4052623/update-for-microsoft-defender-antimalware-platform

And this registry key:

reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Signature Updates"

---

Some useful links 👍

We can also get the full set of Windows Defender version information without invoking the Registry Editor via the Windows Security App:  Windows Security > Settings > About

[philip42h_2]

---

@August_Fields wrote:

The main reason I'm posting today is I've gotten my system to a point where

• I do NOT get a BSOD when I turn windows defender real time protection off through the security center GUI
• I don't have a third party AV installed.
• I have windows updates enabled with all recommended updates installed
• I have all the HP support assistant recommended updates installed

I'm not sure if this would indicate the problem is "solved" or not, but if the folks that were proposing a security definition might be a solution or an updated defender version itself might be a solution were right, then this would seem relevant. Current Defender versions are as follows:

AS OF 5/23/2020 2:29pm

---

I'm now on day 4 of my second rebuild, still with Windows Updates paused, but with Defender running and as up-to-date as I can make it. And that's with Antimalware Client Version: 4.18.2004.6 - I can't seem to find let alone obtain 4.18.2005.4 and wonder why you have it and I don't ... not that I think it matters too much.

Similarly, I'm on engine version 1.1.17000.7 (so again behind) and signatures 1.315.1314.0 which are later by about the amount of time between our posts.

I got to where I now am by downloading and manually installing the Latest Security intelligence updates for Windows Defender

And for the record, Windows Update history tells be that the latest update it installed was 1.315.1269.0, yesterday 23/05/2020 - with Windows Updates Paused since 20/05/2020! Version 1269 was what was running first thing this morning before I updated manually.

I'm trying not to change too much right now; rather I really want to know whether or not I have a stable system. So I've been "poking it with a stick" from time to time but haven't provoked a BSOD yet:

• I can disable and re-enable Defender's Real-Time Protection
• I try tried to run HP Touchpoint Analytics weekly scheduled - rather than wait for a week until it runs - without much evidence that it has run or an error of any form.

I'm still looking for some periodic or scheduled activity that might have been the "other half" of the issue - assuming of course that Defender is in some way the first half ... but, there again, if Defender has been quietly fixed via a signature update I could be looking for a long time.

We need to know so that we can be confident that our system is stable - or at least as stable as we believed it to be in the first place.