"An Unauthorized change was made to Windows" Error

All replies

• 

  

  0

  Sign in to vote

  "R_Antle" wrote in message news:22681a8a-a5e5-4abe-9c58-ca51f74d64a8...

  I just started receiving this error today. Don't know what would of caused it but I ran the diagnostics report and it says my license is invalid.

   

  Diagnostic Report (1.9.0027.0):
  -----------------------------------------
  Windows Validation Data-->
  Validation Status: Invalid License
  Validation Code: 50
  Cached Online Validation Code: N/A, hr = 0x80070426
  Windows Product Key: *****-*****-F4GJK-KG77H-B9HD2
  Windows Product Key Hash: iJAth4TbScMi8HdcPurlASXdEkw=
  Windows Product ID: 89578-OEM-7332157-00204
  Windows Product ID Type: 2
  Windows License Type: OEM SLP
  Windows OS version: 6.0.6000.2.00010300.0.0.003
  ID: {B310E61E-7CD7-4774-A7DF-B865EDDC9C95}(1)
  Is Admin: Yes
  TestCab: 0x0
  LegitcheckControl ActiveX: N/A, hr = 0x80070002
  Signed By: N/A, hr = 0x80070002
  Product Name: Windows Vista (TM) Home Premium
  Architecture: 0x00000000
  Build lab: 6000.vista_gdr.100218-0019
  TTS Error: M:20110606165952570-
  
  
  File Scan Data-->
  File Mismatch: C:\Windows\system32\user32.dll[6.0.6000.16438], Hr = 0x800b0100
  
  Other data-->
  SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron 1420                   </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A00</Version><SMBIOSVersion major="2" minor="4"/><Date>20070523000000.000000+000</Date

  
   

  Licensing Data-->
  Software Licensing service is not running.
  
  
  

  
  

  You have a number of issues here which may or may not be related.

  1) The Software Licensing service is not running.

  2) You have a large spsys.log

  3) You have a file mismatch in user32.dll

  4) You have a Mod Auth Tamper present.

   

  I suspect that the quickest route to a solution may be to use System Restore to get back to a time when the system worked properly. I would advise trying to get back to the last restore point prior to the 3rd June.

   

  Once completed, please run another MGADiag report and post the result - we can then see if it's had the desired effects.

   

  What Anti-virus are you using? Are you using any Registry Cleaner/Optimiser at all?

  
  --
  
  

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  • Proposed as answer by Darin Smith MS Wednesday, June 8, 2011 9:43 PM
  • Marked as answer by Darin Smith MS Friday, June 10, 2011 8:18 PM
  • Unmarked as answer by R_Antle Sunday, June 26, 2011 6:28 PM
  • Unproposed as answer by Darin Smith MS Wednesday, June 29, 2011 10:15 PM

  Tuesday, June 7, 2011 9:45 AM

  Moderator
• 

  

  0

  Sign in to vote

  No reply from the Original Poster.

  Issue is assumed o be resolved.

  ---

  Darin MS

  Friday, June 10, 2011 8:18 PM
• 

  

  0

  Sign in to vote

  Sorry about the delay. I never got an email notification that there had been another post. I ran system restore but that did not fix the problem. I am using Norton Internet Security 2010. I do not think I am using a registry cleaner. Here is the new MGA Diagnostic report

   

  Diagnostic Report (1.9.0027.0):
  -----------------------------------------
  Windows Validation Data-->
  Validation Status: Invalid License
  Validation Code: 50
  Cached Online Validation Code: N/A, hr = 0x80070426
  Windows Product Key: *****-*****-F4GJK-KG77H-B9HD2
  Windows Product Key Hash: iJAth4TbScMi8HdcPurlASXdEkw=
  Windows Product ID: 89578-OEM-7332157-00204
  Windows Product ID Type: 2
  Windows License Type: OEM SLP
  Windows OS version: 6.0.6000.2.00010300.0.0.003
  ID: {B310E61E-7CD7-4774-A7DF-B865EDDC9C95}(1)
  Is Admin: Yes
  TestCab: 0x0
  LegitcheckControl ActiveX: N/A, hr = 0x80070002
  Signed By: N/A, hr = 0x80070002
  Product Name: Windows Vista (TM) Home Premium
  Architecture: 0x00000000
  Build lab: 6000.vista_gdr.100218-0019
  TTS Error: M:20110626131645990-
  Validation Diagnostic:
  Resolution Status: N/A
  
  Vista WgaER Data-->
  ThreatID(s): N/A, hr = 0x80070002
  Version: 6.0.6002.16398
  
  Windows XP Notifications Data-->
  Cached Result: N/A, hr = 0x80070002
  File Exists: No
  Version: N/A, hr = 0x80070002
  WgaTray.exe Signed By: N/A, hr = 0x80070002
  WgaLogon.dll Signed By: N/A, hr = 0x80070002
  
  OGA Notifications Data-->
  Cached Result: N/A, hr = 0x80070002
  Version: 2.0.48.0
  OGAExec.exe Signed By: Microsoft
  OGAAddin.dll Signed By: Microsoft
  
  OGA Data-->
  Office Status: 100 Genuine
  Microsoft Office Standard Edition 2003 - 100 Genuine
  OGA Version: Registered, 2.0.48.0
  Signed By: Microsoft
  Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
  
  Browser Data-->
  Proxy settings: N/A
  User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
  Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
  Download signed ActiveX controls: Prompt
  Download unsigned ActiveX controls: Disabled
  Run ActiveX controls and plug-ins: Allowed
  Initialize and script ActiveX controls not marked as safe: Disabled
  Allow scripting of Internet Explorer Webbrowser control: Disabled
  Active scripting: Allowed
  Script ActiveX controls marked as safe for scripting: Allowed
  
  File Scan Data-->
  File Mismatch: C:\Windows\system32\user32.dll[6.0.6000.16438], Hr = 0x800b0100
  
  Other data-->
  Office Details: <GenuineResults><MachineData><UGUID>{B310E61E-7CD7-4774-A7DF-B865EDDC9C95}</UGUID><Version>1.9.0027.0</Version><OS>6.0.6000.2.00010300.0.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-B9HD2</PKey><PID>89578-OEM-7332157-00204</PID><PIDType>2</PIDType><SID>S-1-5-21-2714028758-3404271363-1134876611</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron 1420                   </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A00</Version><SMBIOSVersion major="2" minor="4"/><Date>20070523000000.000000+000</Date></BIOS><HWID>5A333507018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>M08    </OEMTableID></OEM><GANotification><File Name="OGAAddin.dll" Version="2.0.48.0"/></GANotification></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120409-6000-11D3-8CFE-0150048383C9}"><LegitResult>100</LegitResult><Name>Microsoft Office Standard Edition 2003</Name><Ver>11</Ver><Val>B91F0C9DD36B862</Val><Hash>GqPd1P+rVnHElH9h0YlFNFaEQOk=</Hash><Pid>70141-049-4837024-56434</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="11" Result="100"/><App Id="18" Version="11" Result="100"/><App Id="1A" Version="11" Result="100"/><App Id="1B" Version="11" Result="100"/></Applications></Office></Software></GenuineResults>  
  
  Spsys.log Content: U1BMRwEAAAAAAQAABAAAAAcRAAAAAAAAYWECANOQm7L2Te0nXCTMAdArSr9MLECc5R83cvYPeMwCI+RAzqWltvLHdHth55J8WsFetOasmIZwh4GCNFn6uSsMPgesORnDUv5v8xZITzitV25e3Hjm29GyNlkIv1cjGD817S8Cu1HUlGNHVFBLTl0BpRsD6Dwtx6AnxzEU2ImHkFGGR5j2BWyOcad6J+yR0nMat38/Ij8WvwlN0LR7075lEnTDuN88OYnM4xG1aQcN9TFRMCUKDVZZnS95CyflM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAzQK0q/TCxAnOUfN3L2D3jMF/oBD6ZfWgt8C3Gh4TEviJ/Yo/giV+aYokLtQNF8v/crDD4HrDkZw1L+b/MWSE84OwLwo6VsCU9KIRplX7YKEhg/Ne0vArtR1JRjR1RQS05dAaUbA+g8LcegJ8cxFNiJh5BRhkeY9gVsjnGneifskdJzGrd/PyI/Fr8JTdC0e9O+ZRJ0w7jfPDmJzOMRtWkHDfUxUTAlCg1WWZ0veQsn5TOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM0CtKv0wsQJzlHzdy9g94zLzMT0sYEJkhdlglIJ4bpZ+PpmC+CkRqW5ozCFPt+CyxKww+B6w5GcNS/m/zFkhPOD+HsMAmHzKP3pGfUkG0jDsYPzXtLwK7UdSUY0dUUEtOXQGlGwPoPC3HoCfHMRTYiYeQUYZHmPYFbI5xp3on7JHScxq3fz8iPxa/CU3QtHvTvmUSdMO43zw5iczjEbVpBw31MVEwJQoNVlmdL3kLJ+UzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDNArSr9MLECc5R83cvYPeMxIJiLous9Om5eg+c7I/JH18ri1o/OWY9vYKgHSM+6cbCsMPgesORnDUv5v8xZITzgKGF8ZvCfcIHxMvbU7q3pqGD817S8Cu1HUlGNHVFBLTl0BpRsD6Dwtx6AnxzEU2ImHkFGGR5j2BWyOcad6J+yR0nMat38/Ij8WvwlN0LR7075lEnTDuN88OYnM4xG1aQcN9TFRMCUKDVZZnS95CyflM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAzQK0q/TCxAnOUfN3L2D3jMq5pKA9LjfdKeH4yCHVmhIum4ZZy0jAyoZ9aFRy76FxcrDD4HrDkZw1L+b/MWSE840UC6x8rJJEPdIbXapYoB1xg/Ne0vArtR1JRjR1RQS05dAaUbA+g8LcegJ8cxFNiJh5BRhkeY9gVsjnGneifskdJzGrd/PyI/Fr8JTdC0e9O+ZRJ0w7jfPDmJzOMRtWkHDfUxUTAlCg1WWZ0veQsn5TOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM0CtKv0wsQJzlHzdy9g94zFJkJ2+OoQ2C/xAT+TCElAgJJ+8pP6PNnqG6Sy0/X/nBKww+B6w5GcNS/m/zFkhPOOu4RxePNw3G6r4ieoVvINQYPzXtLwK7UdSUY0dUUEtOXQGlGwPoPC3HoCfHMRTYiYeQUYZHmPYFbI5xp3on7JHScxq3fz8iPxa/CU3QtHvTvmUSdMO43zw5iczjEbVpBw31MVEwJQoNVlmdL3kLJ+UzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDNArSr9MLECc5R83cvYPeMz0R8s0NnTDvrkXjlliZF/CEWf169Y19KhBEFmEtr5JvysMPgesORnDUv5v8xZITzhNo7PNQLYX88t0nJ8ogbPQGD817S8Cu1HUlGNHVFBLTl0BpRsD6Dwtx6AnxzEU2ImHkFGGR5j2BWyOcad6J+yR0nMat38/Ij8WvwlN0LR7075lEnTDuN88OYnM4xG1aQcN9TFRMCUKDVZZnS95CyflM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAzQK0q/TCxAnOUfN3L2D3jMOGqYlAFq81clI7ipHkRxNMydHYhpH8lPaG6uaRqFU2UrDD4HrDkZw1L+b/MWSE84zbXfAWDCKXuK3fh9B3fRpRg/Ne0vArtR1JRjR1RQS05dAaUbA+g8LcegJ8cxFNiJh5BRhkeY9gVsjnGneifskdJzGrd/PyI/Fr8JTdC0e9O+ZRJ0w7jfPDmJzOMRtWkHDfUxUTAlCg1WWZ0veQsn5TOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM0CtKv0wsQJzlHzdy9g94zA9dfuRJLA16T6OR/68WtUVjJPhB3gu/pgpdM5PVBA4oKww+B6w5GcNS/m/zFkhPOL20p7o/ABfNSWcmTCobWkAYPzXtLwK7UdSUY0dUUEtOXQGlGwPoPC3HoCfHMRTYiYeQUYZHmPYFbI5xp3on7JHScxq3fz8iPxa/CU3QtHvTvmUSdMO43zw5iczjEbVpBw31MVEwJQoNVlmdL3kLJ+UzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDNArSr9MLECc5R83cvYPeMwH1QgiZr6kJvoDXlOYpwRabYdIY8kbdMmRfTWf49IQhCsMPgesORnDUv5v8xZITzj+nN4oT6M1zN6TObIFf46eGD817S8Cu1HUlGNHVFBLTl0BpRsD6Dwtx6AnxzEU2ImHkFGGR5j2BWyOcad6J+yR0nMat38/Ij8WvwlN0LR7075lEnTDuN88OYnM4xG1aQcN9TFRMCUKDVZZnS95CyflM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAw=
  
  Licensing Data-->
  Software Licensing service is not running.
  
  Windows Activation Technologies-->
  N/A
  
  HWID Data-->
  HWID Hash Current: QAAAAAEABgABAAIAAQACAAAABAABAAEAJJT20trxGtPqTSSWUmauf0aDwoNSvOCj8vQt4ub3l1cmy05SrFYqhQ==
  
  OEM Activation 1.0 Data-->
  N/A
  
  OEM Activation 2.0 Data-->
  BIOS valid for OA 2.0: yes
  Windows marker version: 0x20000
  OEMID and OEMTableID Consistent: yes
  BIOS Information:
    ACPI Table Name    OEMID Value    OEMTableID Value
    APIC            DELL          M08    
    FACP            DELL          M08    
    HPET            DELL          M08    
    BOOT            DELL          M08    
    MCFG            DELL          M08    
    SLIC            DELL          M08    
    SSDT            PmRef        CpuPm
  
  
  

  Sunday, June 26, 2011 6:32 PM
• 

  

  0

  Sign in to vote

  "R_Antle" wrote in message news:99285c6d-5374-4f04-99d9-d0135ff042da...

  Sorry about the delay. I never got an email notification that there had been another post. I ran system restore but that did not fix the problem. I am using Norton Internet Security 2010. I do not think I am using a registry cleaner. Here is the new MGA Diagnostic report

   

  Diagnostic Report (1.9.0027.0):
  -----------------------------------------
  Windows Validation Data-->
  Validation Status: Invalid License
  Validation Code: 50
  Cached Online Validation Code: N/A, hr = 0x80070426
  Windows Product Key: *****-*****-F4GJK-KG77H-B9HD2
  Windows Product Key Hash: iJAth4TbScMi8HdcPurlASXdEkw=
  Windows Product ID: 89578-OEM-7332157-00204
  Windows Product ID Type: 2
  Windows License Type: OEM SLP
  Windows OS version: 6.0.6000.2.00010300.0.0.003
  ID: {B310E61E-7CD7-4774-A7DF-B865EDDC9C95}(1)
  Is Admin: Yes
  TestCab: 0x0
  LegitcheckControl ActiveX: N/A, hr = 0x80070002
  Signed By: N/A, hr = 0x80070002
  Product Name: Windows Vista (TM) Home Premium
  Architecture: 0x00000000
  Build lab: 6000.vista_gdr.100218-0019
  TTS Error: M:20110626131645990-
  

  
  
  File Scan Data-->
  File Mismatch: C:\Windows\system32\user32.dll[6.0.6000.16438], Hr = 0x800b0100
  
  
  Licensing Data-->
  Software Licensing service is not running.
  
  

  
  
   

  Have you ever had any other Anti-Virus solution present on that PC?

   

  I suspect that the problem is the residues from a malware infection - you should download, install and update MalwareBytes Anti-Malware (www.malwarebytes.org ) and run a full system scan. - delete everything it finds.

   

  Please check that the Software Licensing service is set to startup type Automatic.
   
  Click on Start
  in the Search box, type
  SERVICES.MSC
  and hit the Enter key
  Accept the UAC prompt that comes up
  In the listing of Services, find the Software Licensing Service (SLSVC)
  right-click on it, and select Properties.
  make sure that the service Startup type is set to Automatic - click Apply if you've had to change anything.
   
  Then try starting the service.
  What is the result?
   
  If you get an error message, please report back with the EXACT details.
   
  If it succeeds, reboot - run an new MGADiag report, and post it back here
   
  

  
   

   

  
  --
  
  

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  Sunday, June 26, 2011 7:14 PM

  Moderator
• 

  

  0

  Sign in to vote

  I ran the Malware Scan and deleted the file it found. But I don't have a start button showing up on my computer so I can't get to the Services to check the Software Licensing. Is there another way to get to it other than the Start Menu?

  Sunday, June 26, 2011 11:09 PM
• 

  

  0

  Sign in to vote

  Unfortunately, removing malware files does nothing to correct the original Windows operating system system files that the malware altered or deleted.  It would be best to backup your current personal files and perform a "clean install" of your Windows operation system.  Please review: Cleaning a Compromised System

  ---

  Carey Frisch
  

  • Proposed as answer by Darin Smith MS Wednesday, June 29, 2011 10:15 PM
  • Marked as answer by Darin Smith MS Friday, July 1, 2011 7:04 PM

  Sunday, June 26, 2011 11:23 PM

  Moderator
• 

  

  0

  Sign in to vote

  "R_Antle" wrote in message news:dedf184b-ec09-4760-b23d-7defbb1b2292...

  I ran the Malware Scan and deleted the file it found. But I don't have a start button showing up on my computer so I can't get to the Services to check the Software Licensing. Is there another way to get to it other than the Start Menu?

  
  

  You should be able to run it by entering the following line in the address bar in IE....

  C:\Windows\System32\services.msc

  
  --
  
  

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  • Proposed as answer by Darin Smith MS Wednesday, June 29, 2011 10:15 PM
  • Marked as answer by Darin Smith MS Friday, July 1, 2011 7:04 PM

  Monday, June 27, 2011 6:52 AM

  Moderator