Vista Home Premium Shutdown Error

[jpersone]

Hi all, I am new to the community and have been fighting a weird error on shutdown on my friend's Gateway laptop with Vista preloaded. With all programs shut down, running in normal or safemode, When I choose any shutdown or restart, the error occurs. I first see the logging off screen and immeadiately get an error box.
Windows - Bad Image
Exception Processing Message 0xc000007b with the parameters-
0x760A023C repeated 4 times. I can click OK and a virtual repeat of the message pops up with the only difference being the parameters
On the second Message the parameter 0x755A023C is given 4 times. After clicking Ok, the computer shuts down or restarts depending on the option I choose. The only things I have been able to find so far all seem to point to Media Player and plugins, and I have followed all those suggestions to no avail. Has anyone got an idea how I can pinpoint the cause of the error so I can try and fix it? TIA

Jay

[Steve]

Hi jpersone,

can you run a virus scan from a few of these places 10 best Free Online Virus and Malware Scanners | TechnoBuzz.net so we can rule out viruses as the errors are very unusual.

What errors are in the Event Viewer around the time of the shutdown?

regards

Steve

[jpersone]

I removed an expired Trial copy of Norton Internet Security, ran a Trend Micro Online Scan and then installed TeendMicro Internet Sercurity 2008. All the scans showed were a number of tracking cookies. There are a couple of errors in the event log as follows:
Application Log:
Warning 1/28/2008 9:35:05 AM User Profile Service 1530 None
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-639550617-750377382-2138493970-1000_Classes:
Process 892 (\Device\HarddiskVolume2\Windows\System32\svchost. exe) has opened key \REGISTRY\USER\S-1-5-21-639550617-750377382-2138493970-1000_CLASSES
***AND ANOTHER***
Warning 1/28/2008 9:35:04 AM User Profile Service 1530 None
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-639550617-750377382-2138493970-1000:
Process 892 (\Device\HarddiskVolume2\Windows\System32\svchost. exe) has opened key \REGISTRY\USER\S-1-5-21-639550617-750377382-2138493970-1000


And in the Security LOG:
Audit Failure 1/28/2008 9:36:12 AM Security-Auditing 5038 System Integrity
Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume2\Windows\System32\drivers\M ASPINT.SYS

I cannot find much info on MASPINT.SYS, but I am thinking perhaps I need to get a copy of that file to replace...

Jay

[jpersone]

Replacing MASPINT.SYS with a good copy has fixed the problem!!! For some reason the first time I ran SFC it evidently did not catch the corrupt file that I discovered in the Event log. Thanks to Steve for asking about the event log as I had evidently missed that before. Clearing all the logs and looking thru a much shorter list lead me to the problem.

[Steve]

Great News jpersone

well done on your investigations. It will surely help other people in the future,

regards

Steve