locked
An Unauthorized Change has been made to Windows / Tampered RRS feed

  • Question

  • I have been reading posts on this subject since my PC is similarly allficted with the classic symptoms: Control Panel disappears before getting populated, the infamous "An Unauthorized Change has been made to Windows" pop-up appearing at random intrvals, and los of access to the printer.

    I have run MGADT with the following results:

    Diagnostic Report (1.7.0110.1):
    -----------------------------------------
    WGA Data-->
    Validation Status: Invalid License
    Validation Code: 50
    Online Validation Code: 0x80072ee2
    Cached Validation Code: N/A, hr = 0xc004d401
    Windows Product Key: *****-*****-XY9X3-JDXYP-6CJ97
    Windows Product Key Hash: xFQJU8srKsovk6p1Lk1yW93in4E=
    Windows Product ID: 89578-OEM-7332157-00211
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.0.6001.2.00010300.1.0.003
    ID: {51F17141-8C55-4416-8E23-79A6E6663E20}(3)
    Is Admin: Yes
    TestCab: 0x0
    WGA Version: Registered, 1.7.69.2
    Signed By: Microsoft
    Product Name: Windows Vista (TM) Home Premium
    Architecture: 0x00000000
    Build lab: 6001.vistasp1_gdr.080917-1612
    TTS Error: K:20081217065005642-M:20081217092011054-
    Validation Diagnostic:
    Resolution Status: N/A

    WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: 6.0.6002.16398

    WGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    WGATray.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Basic Edition 2003 - 119 Cryptographics Error
    OGA Version: Registered, 1.6.28.0
    Signed By: Microsoft
    Office Diagnostics: 025D1FF3-282-80041010_025D1FF3-170-80041010_025D1FF3-171-1_025D1FF3-434-80040154_025D1FF3-178-80040154_025D1FF3-179-2_025D1FF3-185-80070002_025D1FF3-199-3_3E121E02-115-80004005_E2AD56EA-761-d003_E2AD56EA-762-0_E2AD56EA-134-80004005_E2AD56EA-761-8009_E2AD56EA-762-2ee2_E2AD56EA-148-80004005_16E0B333-89-80004005_B4D0AA8B-1174-80004005_FA827CE6-153-8007007e_FA827CE6-180-8007007e

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{51F17141-8C55-4416-8E23-79A6E6663E20}</UGUID><Version>1.7.0110.1</Version><OS>6.0.6001.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-6CJ97</PKey><PID>89578-OEM-7332157-00211</PID><PIDType>2</PIDType><SID>S-1-5-21-3080103242-2889979141-2017997904</SID><SYSTEM><Manufacturer>Acer            </Manufacturer><Model>Aspire 5610Z    </Model></SYSTEM><BIOS><Manufacturer>Acer</Manufacturer><Version>V3.24</Version><SMBIOSVersion major="2" minor="33"/><Date>20061215000000.000000+000</Date></BIOS><HWID>7A303507018400EE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><BRT/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91130409-6000-11D3-8CFE-0150048383C9}"><LegitResult>119</LegitResult><Name>Microsoft Office Basic Edition 2003</Name><Ver>11</Ver><Val>43E70459335BF16</Val><Hash>pL0RZJLbsxzdHFVUuzo//ISapVU=</Hash><Pid>73102-OEM-5690726-57631</Pid><PidType>6</PidType></Product></Products><Applications><App Id="16" Version="11" Result="100"/><App Id="1A" Version="11" Result="100"/><App Id="1B" Version="11" Result="100"/></Applications></Office></Software></GenuineResults> 

    Spsys.log Content: U1BMRwEAAAAAAQAABAAAABvh6QAAAAAAYWECAARwHZFQASyaZErJAW4aG1/FHasdtBRBPRnxqCJLXc22hhfj9r9g8zjffTvch604k5ZcKW3iUkFAGJ3cV8vsW+1ccMYCd8u/VgNev372WsBZYbIZJJLJezdT4XiJM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAxuGhtfxR2rHbQUQT0Z8agiK7HLovvRMC6ITSXwx0lZbSaSfj8NSPbkGHStQjHDtwUtkdIOc+50gaUuBX/NgOAs9lrAWWGyGSSSyXs3U+F4iTOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMbhobX8Udqx20FEE9GfGoIvMpCILx2w/g9Ofq2o5gPVI6SnQJZ5zjshSiP6QhPM2uIeGsiD3d27k0U1e5VHByB/ZawFlhshkkksl7N1PheIkzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDG4aG1/FHasdtBRBPRnxqCKIZQNE4Is7cl3X/VARZhdqKsYXCyCvK8aIKDIyqW5i2ikASeqqTE4qAFvPPXlaPdX2WsBZYbIZJJLJezdT4XiJM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAxuGhtfxR2rHbQUQT0Z8agiz4eNaCUsRa6vSvn9QxBJtel7VJp6XE1/Sf7PP4bhHYjTwIfF8nQcHWutYzLpKWow9lrAWWGyGSSSyXs3U+F4iTOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMbhobX8Udqx20FEE9GfGoIpVzFe2NulGPxIGf4fLF4NcHhCJxcml7tp4+U9AqNX3b12icQ4fyZ0ZpeCBejq6q/vZawFlhshkkksl7N1PheIkzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDG4aG1/FHasdtBRBPRnxqCIfnCaIgrAXv7VPWHLmp6VYCkomkzSELyeUoI65YuY5FYBMrD7dmXrFnPezmXZ2jYj2WsBZYbIZJJLJezdT4XiJM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAxuGhtfxR2rHbQUQT0Z8agiH5wmiIKwF7+1T1hy5qelWKOZ5uxPPWH6bzYkxnJr25CATKw+3Zl6xZz3s5l2do2I9lrAWWGyGSSSyXs3U+F4iTOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMbhobX8Udqx20FEE9GfGoIksPxLBP7NpWIgD5MyDU4hUl3V8wY05a+oEHMsgOJH3TCm47WvxrhJDE++iUr+4G0vZawFlhshkkksl7N1PheIkzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDG4aG1/FHasdtBRBPRnxqCJLD8SwT+zaViIA+TMg1OIVvXE37y2ZRpDcJWhR83mfLQpuO1r8a4SQxPvolK/uBtL2WsBZYbIZJJLJezdT4XiJM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAxuGhtfxR2rHbQUQT0Z8agi5kS95H+DdH4Y04YCyhmrBd2SJx7jpyRmwKohYK/TwzVLyV1i1nb7Mu16/eoJNHHE9lrAWWGyGSSSyXs3U+F4iTOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMbhobX8Udqx20FEE9GfGoIlJs29uC8ZOJ5Y35YsJbI/c5cgI/W3yXGBa6nBNRMSffSXGXQLN2RThpdGLb250n+vZawFlhshkkksl7N1PheIkzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDG4aG1/FHasdtBRBPRnxqCJSbNvbgvGTieWN+WLCWyP3cungMaLxDENPCtB7BM1sb0lxl0CzdkU4aXRi29udJ/r2WsBZYbIZJJLJezdT4XiJM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAxuGhtfxR2rHbQUQT0Z8agi1TVRiqfWgvWvkp2bf0ygCvkWYzdw/VMwmwvFmZTpvcDjzNPayQ77rHo/yY0a9/t09lrAWWGyGSSSyXs3U+F4iTOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMbhobX8Udqx20FEE9GfGoIkzoSD4blEoav2fseQq6Y9LmvA/EBtWFYuAX4NJMrFAUAD4rNRDePhfMHGxp9u0GEfZawFlhshkkksl7N1PheIkzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDG4aG1/FHasdtBRBPRnxqCJWrvwDvHKdb5c3hht2rqqxbiMrzmfGRDnZQDRUJYbk4FziMK2sB7W8Ba1mdaCTYAb2WsBZYbIZJJLJezdT4XiJM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAxuGhtfxR2rHbQUQT0Z8agii+SfZcpePBGbXYFI0YqPfj8tZg+4HNPJ2hVEMnC2PgQrdR3C5CA5tvEQRXoWA2O59lrAWWGyGSSSyXs3U+F4iTOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM

    Licensing Data-->
    C:\Windows\system32\slmgr.vbs(1634, 5) (null): 0xC004D401

    HWID Data-->
    HWID Hash Current: OgAAAAEAAgABAAIABAABAAAAAwABAAEAnJ+QX84haG3qTvqQ2rEaYT5NPshOlfL0NoOmBIAjrFb0SA==

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20000
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name OEMID Value OEMTableID Value
      APIC   Acer    Grape  
      FACP   Acer    Grape  
      DBGP   Acer    Grape  
      HPET   Acer    Grape  
      BOOT   PTLTD   $SBFTBL$
      MCFG   Acer    Grape  
      SLIC   ACRSYS  ACRPRDCT
      APIC   Acer    Grape  
      SSDT   SataRe  SataPri
      SSDT   SataRe  SataPri
      SSDT   SataRe  SataPri
      SSDT   SataRe  SataPri
      SSDT   SataRe  SataPri


     --------------------------------------------------------------------------



    It says I have an invalid license.  That's bull.  So now I guess I have to prove it to something.  Can you tell me how?


    But more important: what happened?  why did it happen?  was this a user error? was it an attack of some kind? is it a flaw of some kind in the operating system?

    And most improtant: what will prevent this from reoccurring?

     

    Wednesday, December 17, 2008 4:56 PM

Answers

  • Morning Alden,


    Please review the following Knowledge Base (KB) article and refer to the resolution portion of the webpage:

     KB931573 – You may be prompted to activate Windows Vista on a computer on which Windows Vista was already activated by a Volume License or OEM installation

     http://support.microsoft.com/default.aspx?scid=kb;EN-US;931573 

     If the above does not resolve your issue, please follow the steps below. If the first set of steps does not resolve, move on to the next set of steps.

     ----------------------------------------------------------------------------------------

    Step set #1

     

    1) Open Internet Explorer

    2) A Browser will open, type: %windir%\system32 into the address field

    3) Find the file cmd.exe

    4) Right Click on the cmd.exe and select Run as Administrator

    5) Type: cscript slmgr.vbs -rilc (It may take a long time for this to complete, please be patient)

    6) Hit the Enter key

    7) Reboot 2 times

     

    -------------------------------------------------------------------------------------

    Step set #2

     

    1) Open Internet Browser

    2) Type %windir%\system32 into the browser address bar.

    3) Find the file CMD.exe

    4) Right-Click on CMD.exe and select Run as Administrator

    5) Type: net stop slsvc  (it may ask you if you are sure, select yes)

    6) Type: cd %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareLicensing

    7) Type: rename tokens.dat tokens.bar

    8) Type: cd %windir%\system32

    9) Type net start slsvc

    10) Reboot Twice

    11) Windows Vista may require you to enter a Product Key [use the Certificate of Authenticity (COA)] SLP Product Key found on the sticker on the side or bottom of your computer and activate. Use the Activate by Phone method outlined below.

    From the Desktop:

    a) If you have access to the Start button: Click the Start button, and type in "slui.exe 4" in the search field and then press the "Enter" key. This will bring up the Activate by Phone dialog window. Follow the steps provided by the window. The phone activation process should only take about 6 minutes.


    b) If you do not have access to the Start button: Reboot and login to Vista, a dialog window will come up. In that window, click the option "Access computer with reduced functionality". Once you do that, Internet Explorer or Firefox browser will open. In the address bar type "c:\windows\system32\cmd.exe" press enter, a new window will come up, type: slui 4 and hit enter and follow steps to Activate over the Phone.

    Also you may reference the following site for various Telephone Activation Centers:

    http://support.microsoft.com/kb/326851

    Thank you for visiting the Genuine Advantage forum.


    Stephen Holm, MS
    WGA Forum Manager


    Stephen Holm
    • Marked as answer by Stephen Holm Wednesday, December 17, 2008 6:15 PM
    Wednesday, December 17, 2008 6:14 PM