Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: BSOD while in sleep mode

17 Jul 2014   #11
Uplands666

Windows 7 Home Premium 64bit Service Pack 1
 
 

Judging from the two "failed" responses shown in the attached image, nothing has changed.
The sfc /scannow command stopped at the same point (23%).
Updated CBS log attached.


My System SpecsSystem Spec
.
17 Jul 2014   #12
NoelDP

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
 
 

No that's exactly the response I expected - but hoped not to get.
Let's see if there's anything we can do about it

Open an elevated Command Prompt and run the following commands

TAKEOWN /F C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedding_31bf3856ad364e35_6.1.7601.17514_none_13e628b635935244 /A /R
ICACLS C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedding_31bf3856ad364e35_6.1.7601.17514_none_13e628b635935244 /T
DIR C:\Windows /AL

post the results...
To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.
My System SpecsSystem Spec
17 Jul 2014   #13
Uplands666

Windows 7 Home Premium 64bit Service Pack 1
 
 

OK, here 'tis:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>TAKEOWN /F C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Em
bedding_31bf3856ad364e35_6.1.7601.17514_none_13e628b635935244 /A /R

SUCCESS: The file (or folder): "C:\Windows\winsxs\amd64_Microsoft-Windows-Font-E
mbedding_31bf3856ad364e35_6.1.7601.17514_none_13e628b635935244" now owned by the
administrators group.

SUCCESS: The file (or folder): "C:\Windows\winsxs\amd64_Microsoft-Windows-Font-E
mbedding_31bf3856ad364e35_6.1.7601.17514_none_13e628b635935244\t2embed.dll" now
owned by the administrators group.

C:\Windows\system32>ICACLS C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedd
ing_31bf3856ad364e35_6.1.7601.17514_none_13e628b635935244 /T
C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedding_31bf3856ad364e35_6.1.76
01.17514_none_13e628b635935244 NT SERVICE\TrustedInstallerI)(OI)(CI)(F)

BUILTIN\AdministratorsI)(OI)(CI)(RX)

NT AUTHORITY\SYSTEMI)(OI)(CI)(RX)

BUILTIN\UsersI)(OI)(CI)(RX)

C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedding_31bf3856ad364e35_6.1.76
01.17514_none_13e628b635935244\t2embed.dll EveryoneN)

NT SERVICE\TrustedInstallerF)

BUILTIN\AdministratorsRX)

NT AUTHORITY\SYSTEMRX)

BUILTIN\UsersRX)

Successfully processed 2 files; Failed processing 0 files

C:\Windows\system32>DIR C:\Windows /AL
Volume in drive C is OS
Volume Serial Number is B845-7168

Directory of C:\Windows

File Not Found

C:\Windows\system32>
My System SpecsSystem Spec
.

17 Jul 2014   #14
NoelDP

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
 
 

GOTCHA!
Code:
C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedding_31bf3856ad364e35_6.1.76
01.17514_none_13e628b635935244\t2embed.dll Everyone:(N)
All access to the file has been denied to all users!

Please open an Elevated Command Prompt, and run the following commands.

Code:
 
ICACLS C:\Windows\winsxs /remove:d Everyone /T
ICACLS C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedding_31bf3856ad364e35_6.1.7601.17514_none_13e628b635935244 /T 
 
.
post the results, then reboot and run SFC /SCANNOW again and post the new CBS.log file
My System SpecsSystem Spec
17 Jul 2014   #15
Uplands666

Windows 7 Home Premium 64bit Service Pack 1
 
 

Not quite there, yet, I think. First operation seems to have failed, and sfc /scannow still stops at 23% after reboot.

Here's the cmd.exe text:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>ICACLS C:\Windows\winsxs /remove:d Everyone /T
C:\Windows\winsxs: Access is denied.
Successfully processed 0 files; Failed processing 1 files

C:\Windows\system32>ICACLS C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedd
ing_31bf3856ad364e35_6.1.7601.17514_none_13e628b635935244 /T
C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedding_31bf3856ad364e35_6.1.76
01.17514_none_13e628b635935244 NT SERVICE\TrustedInstallerI)(OI)(CI)(F)

BUILTIN\AdministratorsI)(OI)(CI)(RX)

NT AUTHORITY\SYSTEMI)(OI)(CI)(RX)

BUILTIN\UsersI)(OI)(CI)(RX)

C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedding_31bf3856ad364e35_6.1.76
01.17514_none_13e628b635935244\t2embed.dll EveryoneN)

NT SERVICE\TrustedInstallerF)

BUILTIN\AdministratorsRX)

NT AUTHORITY\SYSTEMRX)

BUILTIN\UsersRX)

Successfully processed 2 files; Failed processing 0 files

C:\Windows\system32>
My System SpecsSystem Spec
18 Jul 2014   #16
NoelDP

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
 
 

OK - we'll try it a slightly different way. ( I was hoping to catch any other files with the same problem - but it seems we'll have to do them one by one).

Open an Elevated Command Prompt, and run the following commands

Code:
 
 ICACLS C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedding_31bf3856ad364e35_6.1.7601.17514_none_13e628b635935244 /remove:d Everyone /T
ICACLS C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedding_31bf3856ad364e35_6.1.7601.17514_none_13e628b635935244 /T 

 
.
post the results - if they indicate success, reboot and run another SFC scan and post the log file.
My System SpecsSystem Spec
18 Jul 2014   #17
Uplands666

Windows 7 Home Premium 64bit Service Pack 1
 
 

O sweetness and joy! Both operations succeeded and sfc got to 80% before stumbling. We're close.

Here are the results:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>ICACLS C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedd
ing_31bf3856ad364e35_6.1.7601.17514_none_13e628b635935244 /remove:d Everyone /T
processed file: C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedding_31bf385
6ad364e35_6.1.7601.17514_none_13e628b635935244
processed file: C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedding_31bf385
6ad364e35_6.1.7601.17514_none_13e628b635935244\t2embed.dll
Successfully processed 2 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedd
ing_31bf3856ad364e35_6.1.7601.17514_none_13e628b635935244 /T
C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedding_31bf3856ad364e35_6.1.76
01.17514_none_13e628b635935244 NT SERVICE\TrustedInstallerI)(OI)(CI)(F)

BUILTIN\AdministratorsI)(OI)(CI)(RX)

NT AUTHORITY\SYSTEMI)(OI)(CI)(RX)

BUILTIN\UsersI)(OI)(CI)(RX)

C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedding_31bf3856ad364e35_6.1.76
01.17514_none_13e628b635935244\t2embed.dll NT SERVICE\TrustedInstallerF)

BUILTIN\AdministratorsRX)

NT AUTHORITY\SYSTEMRX)

BUILTIN\UsersRX)

Successfully processed 2 files; Failed processing 0 files

C:\Windows\system32>
My System SpecsSystem Spec
18 Jul 2014   #18
NoelDP

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
 
 

Interesting - the new error is on the 'other' version of the same file!
Code:
2014-07-18 16:46:36, Info                  CSI    00000284 [SR] Beginning Verify and Repair transaction
2014-07-18 16:46:37, Info                  CSI    00000285 [SR] Cannot repair member file [l:22{11}]"t2embed.dll" of Microsoft-Windows-Font-Embedding, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file cannot be checked
2014-07-18 16:46:40, Error                 CSI    00000286 (F) STATUS_ACCESS_DENIED #5547437# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(flags = (AllowFileNotFound), handle = {provider=NULL, handle=0}, da = (FILE_GENERIC_READ), oa = @0xebc930->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[121]"\SystemRoot\WinSxS\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e\t2embed.dll"; a:(OBJ_CASE_INSENSITIVE)}, iosb = @0xebc9e0, as = (null), fa = 0, sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), cd = FILE_OPEN, co = (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT), eab = NULL, eal = 0, disp = Invalid)
[gle=0xd0000022]
2014-07-18 16:46:40, Error                 CSI    00000287@2014/7/18:06:46:40.839 (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(2057): Error STATUS_ACCESS_DENIED originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile expression: (null)
[gle=0x80004005]
2014-07-18 16:46:42, Error                 CSI    00000288 (F) STATUS_ACCESS_DENIED #5547436# from Windows::Rtl::SystemImplementation::CDirectory::OpenExistingFile(...)[gle=0xd0000022]
2014-07-18 16:46:42, Error                 CSI    00000289 (F) STATUS_ACCESS_DENIED #5547435# from Windows::Rtl::SystemImplementation::CDirectory_IRtlDirectoryTearoff::OpenExistingFile(flags = (MissingFileIsOk), da = (FILE_GENERIC_READ), oa = @0xebcf60->SIL_OBJECT_ATTRIBUTES {s:40; on:"t2embed.dll"; a:(OBJ_CASE_INSENSITIVE)}, sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), oo = (FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE), file = NULL, disp = Invalid)
[gle=0xd0000022]
2014-07-18 16:46:42, Error                 CSI    0000028a (F) STATUS_ACCESS_DENIED #5547415# from PrimitiveInstaller::CCoordinator::RepairComponent(Component = Microsoft-Windows-Font-Embedding, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral)[gle=0xd0000022]
I'm suspecting malware at work

Please open an Elevated Command Prompt, and run the following commands:

Code:
 
TAKEOWN /F C:\Windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e /A /R
ICACLS C:\Windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e /T
ICACLS C:\Windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e /remove:d Everyone /T
ICACLS C:\Windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e /T
  
.
post the results, then reboot and try SFC /SCANNOW again.

While you're waiting for me after that (work calls ) please run a full system MBAM scan...

Please download and install Malwarebytes Anti-malware (free version) from http://www.malwarebytes.org/products/malwarebytes_free/ - UNtick 'Enable free trial of MBAM PRO' at the end of the installation - and update it, then run a full scan in your main account, and Quick scans in any other user accounts.

Delete everything it finds
My System SpecsSystem Spec
18 Jul 2014   #19
Uplands666

Windows 7 Home Premium 64bit Service Pack 1
 
 

Looks like everything worked. Here are the results.
I'll reboot now, then rerun SFC, post the log file, and do the Malware full scan.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>TAKEOWN /F C:\Windows\winsxs\x86_microsoft-windows-font-embe
dding_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e /A /R

SUCCESS: The file (or folder): "C:\Windows\winsxs\x86_microsoft-windows-font-emb
edding_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e" now owned by the a
dministrators group.

SUCCESS: The file (or folder): "C:\Windows\winsxs\x86_microsoft-windows-font-emb
edding_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e\t2embed.dll" now ow
ned by the administrators group.

C:\Windows\system32>ICACLS C:\Windows\winsxs\x86_microsoft-windows-font-embeddin
g_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e /T
C:\Windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601
.17514_none_b7c78d327d35e10e NT SERVICE\TrustedInstallerI)(OI)(CI)(F)

BUILTIN\AdministratorsI)(OI)(CI)(RX)

NT AUTHORITY\SYSTEMI)(OI)(CI)(RX)

BUILTIN\UsersI)(OI)(CI)(RX)

C:\Windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601
.17514_none_b7c78d327d35e10e\t2embed.dll EveryoneN)

NT SERVICE\TrustedInstallerF)

BUILTIN\AdministratorsRX)

NT AUTHORITY\SYSTEMRX)

BUILTIN\UsersRX)

Successfully processed 2 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\winsxs\x86_microsoft-windows-font-embeddin
g_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e /remove:d Everyone /T
processed file: C:\Windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856a
d364e35_6.1.7601.17514_none_b7c78d327d35e10e
processed file: C:\Windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856a
d364e35_6.1.7601.17514_none_b7c78d327d35e10e\t2embed.dll
Successfully processed 2 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\Windows\winsxs\x86_microsoft-windows-font-embeddin
g_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e /T
C:\Windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601
.17514_none_b7c78d327d35e10e NT SERVICE\TrustedInstallerI)(OI)(CI)(F)

BUILTIN\AdministratorsI)(OI)(CI)(RX)

NT AUTHORITY\SYSTEMI)(OI)(CI)(RX)

BUILTIN\UsersI)(OI)(CI)(RX)

C:\Windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601
.17514_none_b7c78d327d35e10e\t2embed.dll NT SERVICE\TrustedInstallerF)

BUILTIN\AdministratorsRX)

NT AUTHORITY\SYSTEMRX)

BUILTIN\UsersRX)

Successfully processed 2 files; Failed processing 0 files

C:\Windows\system32>
My System SpecsSystem Spec
18 Jul 2014   #20
Uplands666

Windows 7 Home Premium 64bit Service Pack 1
 
 

Bewdy! SFC went to 100%, which I guess is near enough, hey?

Log file attached. Starting scan now.
My System SpecsSystem Spec
Reply

 BSOD while in sleep mode




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Laptop freezes between entering sleep mode to being in sleep mode
Hi, I've had this problem intermittently on my laptop for the past 2 years however it has been occuring more often recently. Basically sometimes when I click the sleep button on Windows 7, the screen fades to black as usual. However the fan keeps running (sounds like when it's on full load) and...
General Discussion
BSOD during sleep mode
In the last few days my computer has started consistently (~50%) blue screening after I've put it to sleep. Upon waking it up it informs me about how it wasn't able to shut down correctly, and once I get to the desktop, about the BSOD that occurred. I'd be grateful if you could assist me in finding...
BSOD Help and Support
BSOD during sleep mode
Hello I've having problems with BSOD after my computer goes to sleep mode. I haven't had a chance to check it out until now, so there are quite a bit of minidump files that have been accumulated. My computer is about 6 years old. All I've done so far is update drivers for my graphic and sound...
BSOD Help and Support
BSOD during sleep mode
Just got a new Dell XPS Studio 7100 about 3 weeks ago. I get random BSOD during sleep mode at random times. BSOD never occurs while I am actively using the computer. This is very annoying and I am afraid I will lose my work at some point! Enclosed zip file contains last 3 minidumps of the...
BSOD Help and Support
BSOD after sleep mode
Hello, This computer was purchased second hand. I purchased windows 7 about 3 months ago. The previous version was not genuine. - it is 32 bit - previous OS is unknown - OEM is purchased at full retail - age of system is unknown - OS was installed 3 months ago and the windows/old file...
BSOD Help and Support
BSOD in sleep mode
My Win 7 professional x64 on a lenovo T500 sometimes restarts during sleep mode and gives me this message: Problem signature: Problem Event Name: BlueScreen OS Version: 6.1.7600.2.0.0.256.48 Locale ID: 1033 Additional information about the problem: BCCode: 1000009f ...
BSOD Help and Support


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 02:15.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App