Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: BSOD while in sleep mode


14 Jul 2014   #1

Windows 7 Home Premium 64bit Service Pack 1
 
 
BSOD while in sleep mode

My computer is 3 years old and I've never had a BSOD. But I've had 3 or 4 in the past week, always while the computer is in sleep mode or otherwise unattended at time of crash.

DM Log Collector files are attached.
Additional information from the event logger is:

two instances with identical text:
BCCode: d1
BCP1: 000000000011C60E
BCP2: 0000000000000002
BCP3: 0000000000000008
BCP4: 000000000011C60E

single instance:
BCCode: 1000007e
BCP1: FFFFFFFFC0000005
BCP2: FFFFF88001EF2EA3
BCP3: FFFFF8800DE3B668
BCP4: FFFFF8800DE3AEC0



Attached Files
File Type: zip RICHARD-XPS-Tue_15_07_2014__84519_37.zip (1,015.8 KB, 1 views)
My System SpecsSystem Spec
.

14 Jul 2014   #2

Microsoft Community Contributor Award Recipient

Windows 7 Home Premium 64Bit
 
 

Welcome to the forum Uplands666,

It seems that the BSOD's were caused due to Kaspersky.

This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.

Code:
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: 0000000000000000, address which referenced memory

Debugging Details:
------------------
Kaspersky Lab Intermediate Network Driver
Code:
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 8, 0}

*** WARNING: Unable to verify timestamp for klim6.sys
*** ERROR: Module load completed but symbols could not be loaded for klim6.sys
Probably caused by : vwififlt.sys ( vwififlt!FilterCancelSendNetBufferLists+53 )

Followup: MachineOwner
---------
As a test, please uninstall it. Use Microsoft Security Essentials instead.

Microsoft Security Essentials is recommended from a strict BSOD perspective, compatibility & stability
compared to other antivirus or internet security software. It is free and lightweight:-
warning   Warning
Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.



Check for updates on these drivers:

 
chdrvr02.sys Sun Nov 23 11:35:52 2008 (4928EBB8)
CH Products joysticks (and other flight-sim related controllers)
http://www.carrona.org/drivers/driver.php?id=chdrvr02.sys

chdrvr03.sys Sun Nov 23 11:36:00 2008 (4928EBC0)
CH Products joysticks (and other flight-sim related controllers)
http://www.carrona.org/drivers/driver.php?id=chdrvr03.sys

chdrvr01.sys Tue Jan 13 10:14:46 2009 (496C1536)
CH Products joysticks (and other flight-sim related controllers)
http://www.carrona.org/drivers/driver.php?id=chdrvr01.sys

nusb3hub.sys Thu Feb 10 11:52:32 2011 (4D537D20)
NEC Electronics USB 3.0 Host Controller Driver (previous BSOD issues with 2010 and earlier versions)
http://www.carrona.org/drivers/driver.php?id=nusb3hub.sys

nusb3xhc.sys Thu Feb 10 11:52:33 2011 (4D537D21)
NEC Electronics USB 3.0 Host Controller Driver (previous BSOD issues with 2010 and earlier versions)
http://www.carrona.org/drivers/driver.php?id=nusb3xhc.sys

Sometimes drivers remain, not completely uninstalled. Follow this tutorial for complete removal of drivers of the particular program: How to Clean Left Over Driver Files with Driver SweeperUse Revo Uninstaller to uninstall stubborn software. Opt for Advance Mode while uninstalling which allows you to remove leftover registry:-Run the System File Checker that scans the of all protected Windows 7 system files and replaces incorrect corrupted, changed/modified, or damaged versions with the correct versions if possible:
  • Click on the
  • Type CMD on Search
  • Left click and Run as Administrator
  • Type SFC /scannow
Full tutorial here:Run Disk Check on your Hard Drive for file system errors and bad sectors on it:Upload a screenshot of your hard disk using Crystal Disk Info:Make a hard drive test from the hard drive manufacturers website:Test your Hard Drive with SeaTools:Keep us updated.
My System SpecsSystem Spec
15 Jul 2014   #3

Windows 7 Home Premium 64bit Service Pack 1
 
 
BSOD while in sleep mode

Great stuff, koolkat77. Thanks for all that. Sounds reasonable that it's related to Kaspersky. The event viewer shows BSOD events starting on 5 July, which was the day I replaced McAfee with Kaspersky. (See attached "event viewer BSOD.jpg", which shows critical system errors.)

I uninstalled Kaspersky using Control Panel, and again had a BSOD - the first time this occurred while the system was active rather than asleep. I completed the removal using Revo Uninstaller and installed Microsoft Security Essentials in its place. Malwarebytes Premium has already been installed since 16 June.

I wish it were as simple as just discontinuing Kaspersky, but there seem to be problems with the system files too. I have run SFC /scannow several times. Each time it reaches 23% and reports that it "could not perform the requested operation". (See attached "SFC error.jpg") Note: your instructions say left click to run as administrator but they should read right click and make it clear that you click on the "cmd.exe" program line in the Start menu. That slowed me down for a while!

I have also run SFC /verifyonly and it confirms that there are integrity violations with the system files. Details from the CBS.log are shown in attached "sfcdetails.txt". At this point I need further help to confirm that I'm on the right track.

To simplify your review, I have pasted into "sfcdetails2.txt" the points at which the problem arises each time. Evidently the problem lies with the "t2embed.dll" file. Am I reading this correctly, and if so, do I now extract it from the Windows installation disk following the links included in your instructions under "Extract Files from Windows 7 Installation DVD"?

Thanks heaps for your help. I wouldn't have had a hope in hell without it. Even now, it seems it might just be easier to move to Windows 8.1, but after all you've done for me I wouldn't dare!
My System SpecsSystem Spec
.


15 Jul 2014   #4

Microsoft Community Contributor Award Recipient

Windows 7 Home Premium 64Bit
 
 

I can't see the attachments.

Thanks for the post
My System SpecsSystem Spec
15 Jul 2014   #5

Windows 7 Home Premium 64bit Service Pack 1
 
 

Sorry. Files attached here.
BSOD while in sleep mode-event-viewer-bsod.jpg

BSOD while in sleep mode-sfc-error.jpg

sfcdetails.txt

sfcdetails 2.txt


My System SpecsSystem Spec
16 Jul 2014   #6

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)
 
 

The SFCDetails file isn't much use here - this will give us a lot more to work with...

Please follow the Windows Update Posting Instructions and post the requested data
If the file is too large (8MB compressed), remove the older CBSPersist cab files until the final file is below the limit - you can always post them separately after zipping them. (the forum doesn't allow the upload of bare CAB files, for a number of reasons)
My System SpecsSystem Spec
16 Jul 2014   #7

Windows 7 Home Premium 64bit Service Pack 1
 
 

OK, NoelDP, done that. And thanks for joining in.

The SURT tool was downloaded and, as anticipated, appeared to hang for a quite a while before completing the installation. I had expected from the instructions to have installed it first and then run the tool separately, but there appears to be no tool as such that is run other than the installation itself. For now I assume that's as it should be.

The CBS.log is attached, as well as the two most recent CBSPersist files (July 7 & 9) that were removed to bring this zip file under the size limit. Three other CBSPersist files remain from earlier in June and May that I will send if needed.

Incidentally, I've had no further BSODs since uninstalling Kaspersky. I hope to be able to reinstall it later, since everything I've read about Microsoft Security Essentials suggests that its value lies mainly in showing how much better the other tools are. But perhaps we can revisit that after fixing the apparent issues with the system files.

Windows Update tells me that everything is up to date. Windows Update History shows a number of updates that failed originally, but I gather they have been fixed on a cumulative basis since then or Windows Update would be warning of available updates.

Also, further to my earlier response to koolkat77, I run DiskChk regularly and it reports no bad file records and no bad sectors.

Thanks to both of you for your continued assistance.


Attached Files
File Type: zip CBS.zip (339.6 KB, 2 views)
File Type: zip CbsPersist_20140709212858.zip (6.48 MB, 0 views)
File Type: zip CbsPersist_20140707195512.zip (796.2 KB, 0 views)
My System SpecsSystem Spec
4 Weeks Ago   #8

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)
 
 

The SFC scan crashed with th e following message...
Code:
2014-07-17 09:45:43, Info                  CSI    000000d4 [SR] Cannot repair member file [l:22{11}]"t2embed.dll" of Microsoft-Windows-Font-Embedding, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file cannot be checked
2014-07-17 09:45:45, Error                 CSI    000000d5 (F) STATUS_ACCESS_DENIED #1870157# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(flags = (AllowFileNotFound), handle = {provider=NULL, handle=0}, da = (FILE_GENERIC_READ), oa = @0xc2cae0->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[123]"\SystemRoot\WinSxS\amd64_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601.17514_none_13e628b635935244\t2embed.dll"; a:(OBJ_CASE_INSENSITIVE)}, iosb = @0xc2cb90, as = (null), fa = 0, sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), cd = FILE_OPEN, co = (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT), eab = NULL, eal = 0, disp = Invalid)
[gle=0xd0000022]
2014-07-17 09:45:45, Error                 CSI    000000d6@2014/7/16:23:45:45.821 (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(2057): Error STATUS_ACCESS_DENIED originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile expression: (null)
[gle=0x80004005]
2014-07-17 09:45:47, Error                 CSI    000000d7 (F) STATUS_ACCESS_DENIED #1870156# from Windows::Rtl::SystemImplementation::CDirectory::OpenExistingFile(...)[gle=0xd0000022]
2014-07-17 09:45:47, Error                 CSI    000000d8 (F) STATUS_ACCESS_DENIED #1870155# from Windows::Rtl::SystemImplementation::CDirectory_IRtlDirectoryTearoff::OpenExistingFile(flags = (MissingFileIsOk), da = (FILE_GENERIC_READ), oa = @0xc2d110->SIL_OBJECT_ATTRIBUTES {s:40; on:"t2embed.dll"; a:(OBJ_CASE_INSENSITIVE)}, sa = (FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE), oo = (FILE_SYNCHRONOUS_IO_NONALERT|FILE_NON_DIRECTORY_FILE), file = NULL, disp = Invalid)
[gle=0xd0000022]
This could be either a permissions issue, or a hard drive problem.

Let's check the HD first...


Please run a full CHKDSK and SFC scan....
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.
At the Command prompt, type
CHKDSK C: /R
and hit the Enter key.
You will be told that the drive is locked, and the CHKDSK will run at the next boot - hit the Y key, and then reboot.
The CHKDSK will take a few hours depending on the size of the drive, so be patient!
After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) - then run the SFC again, and post the new CBS.log file (only)

My System SpecsSystem Spec
4 Weeks Ago   #9

Windows 7 Home Premium 64bit Service Pack 1
 
 

OK, did that. Results attached.


Attached Files
File Type: zip CBS.zip (379.8 KB, 1 views)
My System SpecsSystem Spec
4 Weeks Ago   #10

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)
 
 

Crashed at the same point, with the same error

Please open an Elevated Command Prompt, and run the following commands.


DIR C:\Windows\t2embed.dll /S
ICACLS C:\Windows\System32\t2embed.dll
ICACLS C:\Windows\winsxs\amd64_Microsoft-Windows-Font-Embedding_31bf3856ad364e35_6.1.7601.17514_none_13e628b635935244 /T


post the results
My System SpecsSystem Spec
Reply

 BSOD while in sleep mode




Thread Tools



Similar help and support threads for2: BSOD while in sleep mode
Thread Forum
Laptop freezes between entering sleep mode to being in sleep mode General Discussion
BSOD while in sleep mode BSOD Help and Support
BSOD during sleep mode BSOD Help and Support
BSOD during sleep mode BSOD Help and Support
BSOD when PC goes into sleep mode BSOD Help and Support

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 09:52 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33