{"id":4428,"date":"2017-12-06T18:43:39","date_gmt":"2017-12-06T17:43:39","guid":{"rendered":"http:\/\/borncity.com\/win\/?p=4428"},"modified":"2017-12-06T18:53:12","modified_gmt":"2017-12-06T17:53:12","slug":"windows-10-v1709-kis2018-causes-classpnp-sys-bluescreen","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2017\/12\/06\/windows-10-v1709-kis2018-causes-classpnp-sys-bluescreen\/","title":{"rendered":"Windows 10 V1709: KIS2018 causes classpnp.sys bluescreen"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" style=\"float: left; margin: 0px 10px 0px 0px; display: inline\" src=\"http:\/\/www.borncity.com\/blog\/wp-content\/uploads\/2013\/03\/winb.jpg\" width=\"58\" align=\"left\" height=\"58\">[<a href=\"http:\/\/www.borncity.com\/blog\/2017\/12\/06\/windows10-v1709-kis2018-verursacht-classpnp-sys-bluescreen\/\" target=\"_blank\">German<\/a>]Users of Windows 10 Fall Creators Update (V1709) (and also Windows 7 SP1) are facing a sporadic blue screen in module <em>classpnp.sys<\/em>. The root cause is Kaspersky KIS 2018. Here a few details for affected users. <\/p>\n<p><!--more--><\/p>\n<h2>Windows throws a blue screen <\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"https:\/\/ssl-vg03.met.vgwort.de\/na\/b1fdc5c41d684c89bb99e5766c2c0e77\" width=\"1\" height=\"1\">German blog reader Steffen H. contacted me via mail and told me about a strange blue screen issue he had.  <\/p>\n<blockquote>\n<p>Since a few days ago I have had a blues screen on my computer Windows 10 v1709 Build 16299.98, as well as on Windows 7 SP1 with is caused from classpnp.sys.<\/p>\n<\/blockquote>\n<p>The build 16299.98 indicates it's Windows 10 V1709 with the latest cumulative update <a href=\"https:\/\/support.microsoft.com\/de-de\/help\/4051963\/windows-10-update-kb4051963\" target=\"_blank\">KB4051963<\/a>, which I've addressed several times within my blog. This update shall fix the Epson dot matrix printer issue. But this is just an information.  <\/p>\n<h2>Kaspersky is the root cause<\/h2>\n<p>Steffen has already researched the internet and sent me the following information, which describes the circumstances for this blue screen.  <\/p>\n<blockquote>\n<p>After a short investigation I discovered that there is probably an error in Kaspersky, if you run Firefox 57.0.1 at the same time.<\/p>\n<p>The error itself cannot be produced directly by calling X-Tabs or certain Internet pages, but unfortunately occurs sporadically but nevertheless frequently.<\/p>\n<\/blockquote>\n<p>The issues will be discussed also at tenforums.com within <a href=\"https:\/\/www.tenforums.com\/bsod-crashes-debugging\/99421-bsod-kmode_exception_not_handled-classpnp-sys.html\" target=\"_blank\">this thread<\/a>, where a user wrote:  <\/p>\n<blockquote>\n<p>4 BSOD in the last 3 days (only 2 dump files though, don't know why). 2 while browsing in Firefox (v57), 1 while working in Photoshop CS5, the last one I can't remember which program I was using when it happened.<br \/>Each time it happened, the BSOD is there for a few seconds, then the PC reboots.<\/p>\n<\/blockquote>\n<p>Analyzing the dump file resulted, that a driver, maybe <em>klbackupdisk.sys <\/em>(Kaspersky Labs volume filter driver) is causing the BSOD. I've discussed the filter driver issue within my blog post <a href=\"https:\/\/borncity.com\/win\/2017\/02\/23\/windows-system-restore-fails-with-error-0xc000000d\/\">Windows System Restore fails with error 0xC000000D<\/a>.  <\/p>\n<p>German Blog reader Michael Borman analyzed also the kernel dump and posted his analysis within <a href=\"http:\/\/www.borncity.com\/blog\/2017\/12\/06\/windows10-v1709-kis2018-verursacht-classpnp-sys-bluescreen\/#comment-50982\" target=\"_blank\">this comment<\/a>.  <\/p>\n<p># Child-SP RetAddr Call Site<br \/>00 fffff880`0c7f9b68 fffff800`03ebf7fe nt!KeBugCheck<br \/>01 fffff880`0c7f9b70 fffff800`03ef3d8d nt!KiKernelCalloutExceptionHandler+0xe<br \/>02 fffff880`0c7f9ba0 fffff800`03ef2b65 nt!RtlpExecuteHandlerForException+0xd<br \/>03 fffff880`0c7f9bd0 fffff800`03f040bd nt!RtlDispatchException+0x415<br \/>04 fffff880`0c7fa2b0 fffff800`03ec748e nt!KiDispatchException+0x17d<br \/>05 fffff880`0c7fa940 fffff800`03ec5ffa nt!KiExceptionDispatch+0xce<br \/>06 fffff880`0c7fab20 fffff880`02365198 nt!KiPageFault+0x23a<br \/>07 fffff880`0c7facb0 fffff880`02365975 CLASSPNP!ServiceTransferRequest+0xa8<br \/>08 fffff880`0c7fad50 fffff880`017d20af CLASSPNP!ClassReadWrite+0xd5<br \/>09 fffff880`0c7fada0 fffff880`017e718c partmgr!PmGlobalDispatch+0x9f<br \/>0a fffff880`0c7fadd0 fffff880`023162bf volmgr!VmReadWrite+0x11c<br \/>0b fffff880`0c7fae10 fffff880`0231653c fvevol!FveReadWrite+0x47<br \/>0c fffff880`0c7fae50 fffff880`02263df4 fvevol!FveFilterRundownReadWrite+0x1dc<br \/>0d fffff880`0c7faeb0 fffff880`010ba1dd volsnap! ?? ::FNODOBFM::`string'+0x57b<br \/>0e fffff880`0c7faee0 00000000`00000000 klbackupdisk+0x61dd  <\/p>\n<p>The module <em>klbackupdisk<\/em> is causing trouble and hits <em>Ntfs!NtfsStorageDriverCallout<\/em>, which probably forces the BOSD at least.  <\/p>\n<h2>A patch is announced<\/h2>\n<p>Within the forum thread some other Kaspersky users are reporting the same issue. They are claiming Firefox 57.0.1 and Kaspersky Internet Security 18 (18.0.0.405(d)) <a href=\"https:\/\/www.tenforums.com\/bsod-crashes-debugging\/99421-bsod-kmode_exception_not_handled-classpnp-sys-2.html#post1227178\" target=\"_blank\">are colliding<\/a>. But it seems, that also Google Chrome users are affected. There are now the following forum entries:  <\/p>\n<ul>\n<li>An older <a href=\"https:\/\/answers.microsoft.com\/en-us\/windows\/forum\/windows_10-performance\/kmodeexceptionnothandled-classpnpsys-on-windows-10\/c61f695f-d144-4b3a-9a1b-6854b2877280?messageId=ad15ec58-1521-4d1e-9417-bd2e1ef0a2de&amp;auth=1\" target=\"_blank\">MS Answers forum thread<\/a>, dated from November 2017, dealing with <em>CLASSPNP.SYS \u2013 Kmode_exception_not_handled<\/em>, which could not be caused by Update <a href=\"https:\/\/support.microsoft.com\/de-de\/help\/4051963\/windows-10-update-kb4051963\">KB4051963<\/a> mentioned above.\n<li>A fresh thread in <a href=\"https:\/\/www.tenforums.com\/bsod-crashes-debugging\/99421-bsod-kmode_exception_not_handled-classpnp-sys-2.html#post1227178\" target=\"_blank\">Kaspersky forum<\/a>, where more users are claiming to be affected by this issue. <\/li>\n<\/ul>\n<p>There is an <a href=\"https:\/\/forum.kaspersky.com\/index.php?\/topic\/383637-blue-screens-avpexe\/&amp;do=findComment&amp;comment=2758438\">announcement<\/a> within Kaspersky forum, that Kaspersky is working on a patch for KIS 2018. This will update KIS 2018 to version 18.0.0.405(e).  <\/p>\n<h2>A beta patch is available<\/h2>\n<p>Another German user left <a href=\"http:\/\/www.borncity.com\/blog\/2017\/12\/06\/windows10-v1709-kis2018-verursacht-classpnp-sys-bluescreen\/#comment-50989\" target=\"_blank\">this comment<\/a>, informing me, that there is a beta patch available. Here are the steps to install this version:<\/p>\n<p>1. Update product from the standard update source and reboot.  <\/p>\n<p>2. Set the product to manual update mode  <\/p>\n<p>3. Add new test update source to update settings: <a href=\"http:\/\/dnl-test.kaspersky-labs.com\/test\/ap\" target=\"_blank\">http:\/\/dnl-test.kaspersky-labs.com\/test\/ap<\/a>  <\/p>\n<p>4. Disable standard update source  <\/p>\n<p>5. Launch the update task  <\/p>\n<p>6. Reboot and make sure that patch E was installed (on Support window or on the product icon in tray)  <\/p>\n<p>7. Check the initial issue reproduction.  <\/p>\n<p>If the issue persist with patch E, then please provide me a new full memory dumps in archive. If the patch is installed, delete the above URL in update settings. Hope that helps.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>[German]Users of Windows 10 Fall Creators Update (V1709) (and also Windows 7 SP1) are facing a sporadic blue screen in module classpnp.sys. The root cause is Kaspersky KIS 2018. Here a few details for affected users.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[463],"tags":[47,284,1178,194],"class_list":["post-4428","post","type-post","status-publish","format-standard","hentry","category-issue","tag-issue","tag-kaspersky","tag-kis-2018","tag-windows"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/4428","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=4428"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/4428\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=4428"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=4428"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=4428"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}