locked
Unauthorized Change- Please help! RRS feed

  • Question

  • I have gotten the "Unauthorized Change" error. I ran the validation page suggested by Microsoft, and it tells me that some form of software was loaded that may not be compatible with Vista.

    I happened to be on my computer when a Windows Update was installing and (I believe) the problem began. What can I do to diagnose and fix the problem?


    Thanks!!

    Denise
    Thursday, March 20, 2008 6:07 PM

Answers

  •  

     

    At this point, I am unable to troubleshoot the issue if Windows isn't running.  I would suggest either contacting the Computer's Manufacturer (as they are the primary warranty support provider) or go to http://support.microsoft.com for for additional support options with Microsoft.

     

     

    Thank you,

    Darin

     

    Friday, March 21, 2008 10:16 PM

All replies

  •  

    Hello neesie,

     

      Your Vista is most likely in, what we call, a Mod-Auth Tamper.

     

    There are 2 types of Mod-Auth tampers:

     

    1) A critical system file was modified On Disk - What this means is that the file, located on the hard drive, was modified in some way. This can be caused by random file corruption, a malicious program (spyware, malware, virus) or by manual file modification (by a user of the system). There is also a very small chance that an Update may fail in mid-update and cause this type of issue. As a safety mechanism, Updates are made so that if they fail, they roll back any updating that was done before the failure, but there is an off-chance that the roll back did not occure.

     

    2) A critical system file was modified In Memory - What this means is the file itself (on the hard drive) is un-modified, but the code, from that file, running in system memory, was modified in some way.  This type of Mod-Auth is caused by a program that is incompatible (and Running) in Vista.

     

      The resolution is different for each type of Mod-Auth, so what I need is for you to download and run the Genuine Diagnostics tool at http://go.microsoft.com/fwlink/?linkid=52012. Click "Continue" click the Windows tab, click the "Copy" button, then paste the report into a response message in this thread.


    If you do not have access to the Start Button:

    1) Login to Vista and Click the option that brings up Internet Explorer.

    2) Type: http://go.microsoft.com/fwlink/?linkid=52012 into the browser address bar.

    3) A window will come up asking if you want to Run or Save, Select Run

    4) When the program runs, Click the Continue button, then click the Copy button.

    5) Return to this thread by Typing: http://forums.microsoft.com/Genuine/ShowPost.aspx?PostID=3038649&SiteID=25 into the browser address bar.

    6) In a reply post, Paste the Diagnostic Report.

     

     

    Thank you,

    Darin Smith

    WGA Forum Manager

    Thursday, March 20, 2008 6:45 PM
  • Diagnostic Report (1.7.0069.0):
    -----------------------------------------
    WGA Data-->
    Validation Status: Invalid License
    Validation Code: 50
    Online Validation Code: 0x80070426
    Cached Validation Code: N/A, hr = 0x80070426
    Windows Product Key: *****-*****-4GV68-6D8JB-G6MF9
    Windows Product Key Hash: Ua+OBZ1y48sKA/bWkfKXiuCrOjY=
    Windows Product ID: 89578-OEM-7332157-00203
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.0.6000.2.00010300.0.0.003
    CSVLK Server: N/A
    CSVLK PID: N/A
    ID: {7AF44C41-4952-416B-B0F4-914E9623501D}(1)
    Is Admin: Yes
    TestCab: 0x0
    WGA Version: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows Vista (TM) Home Premium
    Architecture: 0x00000000
    Build lab: 6000.vista_gdr.071023-1545
    TTS Error: M:20080320030956513-
    Validation Diagnostic:
    Resolution Status: N/A

    WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Notifications Data-->
    Cached Result: N/A
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 102
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: FCEE394C-2920-80070002_B4D0AA8B-531-645_025D1FF3-282-80041010_025D1FF3-170-80041010_025D1FF3-171-1_025D1FF3-434-80040154_025D1FF3-178-80040154_025D1FF3-179-2_025D1FF3-185-80070002_025D1FF3-199-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
    Default Browser: C:\PROGRA~1\MOZILL~1\FIREFOX.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->
    File Mismatch: C:\Windows\system32\user32.dll[6.0.6000.16438]

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{7AF44C41-4952-416B-B0F4-914E9623501D}</UGUID><Version>1.7.0069.0</Version><OS>6.0.6000.2.00010300.0.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-G6MF9</PKey><PID>89578-OEM-7332157-00203</PID><PIDType>2</PIDType><SID>S-1-5-21-1237317698-2691663862-1780251185</SID><SYSTEM><Manufacturer>Sony Corporation</Manufacturer><Model>VGN-N365E</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies LTD</Manufacturer><Version>R0100J4</Version><SMBIOSVersion major="2" minor="4"/><Date>20070208000000.000000+000</Date></BIOS><HWID>58303507018400EE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>Sony</OEMID><OEMTableID>VAIO</OEMTableID></OEM><BRT/></MachineData><Software><Office><Result>102</Result><Products><Product GUID="{91120000-0014-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Professional 2007</Name><Ver>12</Ver><Val>B0F37057009C27E</Val><Hash>HtiY+B9oMj8zZcF7mo5N2ABonQQ=</Hash><Pid>81605-319-0359837-65593</Pid><PidType>10</PidType></Product></Products></Office></Software></GenuineResults> 

    Spsys.log Content: U1BMRwEAAAAAAQAABAAAAFEKAAAAAAAAYWECADAgAAD10lGMcorIAdArSr9MLECc5R83cvYPeMxB7eagXO5xAAFCIhd/Xjy9BI2wTmpEfW9sHP9KZL4uWisMPgesORnDUv5v8xZITziaPQ+7EpX6cOpfIKjd+jC4GD817S8Cu1HUlGNHVFBLTl0BpRsD6Dwtx6AnxzEU2IlIVcU1NmgXOc/3y+M9lv7f0nMat38/Ij8WvwlN0LR7075lEnTDuN88OYnM4xG1aQcN9TFRMCUKDVZZnS95CyflM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAw=

    Thursday, March 20, 2008 7:01 PM
  • Hi again neesie,

     

      I see form the Diagnostic Report that your Mod-Auth tamper is the "On Disk" type. Which means a critical system file (in your case user32.dll) has been modified or has become corrupt.

     

      To resolve the issue, we need to replace the bad file with a unmodified/uncorrupted copy. Normally, the way we do this is have you re-install a past Update that contained that file. But since SP1 has been released, it would be best to just install SP1 (found at http://www.microsoft.com/downloads/details.aspx?FamilyID=b0c7136d-5ebb-413b-89c9-cb3d06d12674&DisplayLang=en).

     

      Please try this and tell me if it resolved your issue, or not.

     

    Thank you,

    Darin Smith

    WGA Forum Manager

    Thursday, March 20, 2008 7:13 PM
  • Hello Darin-

    I installed SP1, and the problem was not resolved. Any other suggestions??
     

    Thanks again!

    Denise
    Friday, March 21, 2008 6:18 AM
  • **UPDATE**

     

    I rebooted my computer again, and now it will not boot- gets stuck at the Vaio screen.

     

    Friday, March 21, 2008 7:06 AM
  •  

     

    At this point, I am unable to troubleshoot the issue if Windows isn't running.  I would suggest either contacting the Computer's Manufacturer (as they are the primary warranty support provider) or go to http://support.microsoft.com for for additional support options with Microsoft.

     

     

    Thank you,

    Darin

     

    Friday, March 21, 2008 10:16 PM