locked
An Unauthorized Change Has Been Made To Windows RRS feed

  • Question

  • Greetings!

    Two weeks ago, I installed a PNY NVIDIA GeForce 9800GT video card, and in the process of uninstalling the previous nvidia drivers and installing the new ones, Vista has freaked out on me.  It seems that in addition to trying to uninstall the old and install the new drivers, there are a couple of Windows updates that continually try to install themselves in my system.

    Now, whenever I try to start up in regular mode, I get to the log-in screen, select my username and enter my password, and then I get the small box that says, "An unauthorized change has been made to windows", and I get the options to "Learn more online" and check what to do next (takes me to the Validation site) or to "Close".  If I go online, I try the validation and it tells me that "This copy of Windows did not pass genuine validation", but that's it.

    If I close, it takes me back to the log-in screen, from where I cannot do anything else but shut down. 

    I am able to start-up in safe mode, but unfortunately, even if I start in "Safe mode with networking", I cannot access the network or internet at all. 

    I was able to restore to an earlier set-point, which was working for a while, but I would always have the generic video driver and eventually, the machine would shut down and try to install an update and then poof - gone again.  Now, the set point I was using is not even on the list any more, so I can't even get back to this any more.

    I was able to copy over the MGADIAG tool via SD card, and ran it with the below results.

    Any help you gan provide would be greatly appreciated!!!  Thanks!


    Diagnostic Report (1.9.0006.1):

    -----------------------------------------

    WGA Data-->

    Validation Status: Genuine

    Validation Code: 0

    Online Validation Code: 0x80070426

    Cached Validation Code: N/A, hr = 0x80070426

    Windows Product Key: *****-*****-F4GJK-KG77H-B9HD2

    Windows Product Key Hash: iJAth4TbScMi8HdcPurlASXdEkw=

    Windows Product ID: 89578-OEM-7332157-00204

    Windows Product ID Type: 2

    Windows License Type: OEM SLP

    Windows OS version: 6.0.6000.2.00010300.0.0.003

    ID: {D6B80104-9D6F-4BAF-8851-129C3E578114}(1)

    Is Admin: Yes

    TestCab: 0x0

    WGA Version: N/A, hr = 0x80070002

    Signed By: N/A, hr = 0x80070002

    Product Name: Windows Vista (TM) Home Premium

    Architecture: 0x00000000

    Build lab: 6000.vista_gdr.080917-1612

    TTS Error: M:20090317221506953-

    Validation Diagnostic:

    Resolution Status: N/A

     

    WgaER Data-->

    ThreatID(s): N/A, hr = 0x80070002

    Version: 6.0.6002.16398

     

    WGA Notifications Data-->

    Cached Result: N/A, hr = 0x80070002

    File Exists: No

    Version: N/A, hr = 0x80070002

    WgaTray.exe Signed By: N/A, hr = 0x80070002

    WgaLogon.dll Signed By: N/A, hr = 0x80070002

     

    OGA Notifications Data-->

    Cached Result: N/A, hr = 0x80070002

    Version: N/A, hr = 0x80070002

    WGATray.exe Signed By: N/A, hr = 0x80070002

    OGAAddin.dll Signed By: N/A, hr = 0x80070002

     

    OGA Data-->

    Office Status: 114 Blocked VLK 2

    Microsoft Office Professional Edition 2003 - 114 Blocked VLK 2

    OGA Version: N/A, 0x80070002

    Signed By: N/A, hr = 0x80070002

    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

     

    Browser Data-->

    Proxy settings: N/A

    User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)

    Default Browser: C:\Program Files\Internet Explorer\iexplore.exe

    Download signed ActiveX controls: Prompt

    Download unsigned ActiveX controls: Disabled

    Run ActiveX controls and plug-ins: Allowed

    Initialize and script ActiveX controls not marked as safe: Disabled

    Allow scripting of Internet Explorer Webbrowser control: Disabled

    Active scripting: Allowed

    Script ActiveX controls marked as safe for scripting: Allowed

     

    File Scan Data-->

    File Mismatch: C:\Windows\system32\Slsvc.exe[6.0.6000.16509]

     

    Other data-->

    Office Details: <GenuineResults><MachineData><UGUID>{D6B80104-9D6F-4BAF-8851-129C3E578114}</UGUID><Version>1.9.0006.1</Version><OS>6.0.6000.2.00010300.0.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-B9HD2</PKey><PID>89578-OEM-7332157-00204</PID><PIDType>2</PIDType><SID>S-1-5-21-1780380632-2305204845-2277628533</SID><SYSTEM><Manufacturer>Dell Inc</Manufacturer><Model>Dimension E521</Model></SYSTEM><BIOS><Manufacturer>Dell Inc</Manufacturer><Version>1.1.4 </Version><SMBIOSVersion major="2" minor="4"/><Date>20061209000000.000000+000</Date></BIOS><HWID>27313507018400F6</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>bMk    </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>114</Result><Products><Product GUID="{90110409-6000-11D3-8CFE-0150048383C9}"><LegitResult>114</LegitResult><Name>Microsoft Office Professional Edition 2003</Name><Ver>11</Ver><Val>59D1605114E3500</Val><Hash>vfZmaSmFPIYrLWTcZSZErUQg+Fo=</Hash><Pid>73931-640-0000106-57504</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="11" Result="114"/><App Id="16" Version="11" Result="114"/><App Id="18" Version="11" Result="114"/><App Id="19" Version="11" Result="114"/><App Id="1A" Version="11" Result="114"/><App Id="1B" Version="11" Result="114"/><App Id="44" Version="11" Result="114"/></Applications></Office></Software></GenuineResults> 

     

    Wednesday, March 18, 2009 3:23 AM

Answers

  • Hello ejmetz,

      

    The core of your issue centers on the line in your Diagnostic Report that reads:

    File Scan Data-->
    File Mismatch: C:\Windows\system32\Slsvc.exe[6.0.6000.16509]

    This means the file has been Tampered, Modified or has become Corrupt. Vista see this as an attack to bypass it's Licensing security.

    To resolve the issue, you need to either repair or replace the file with a known-good one (of the proper file version)

     

    If you can, try installing Service Pack 1 from http://www.microsoft.com/downloads/details.aspx?FamilyID=b0c7136d-5ebb-413b-89c9-cb3d06d12674&DisplayLang=en. If not, try the below steps, and once your issue is resolved, I encourage you to install SP1


    Try repairing Windows using System Restore:

    1)    Reboot Vista into Safe Mode
    2)    Go to Control Panel
    3)    On the left hand side of the Control Panel window, Click on "Classic View"

    4)    Double-click "Backup and Restore Center"
    5)    On the left hand side of the window, click "Repair Windows using system restore"
    6)    Select "Choose Different Restore Point", Put a check in the box that says "Show restore points older than 5 days", select the restore point that corresponds to the date Before you first noticed the issue.
    7)    Click the "Next" button.
    8)    Reboot back into Normal mode
    9)    Vista should no longer be in Reduced Functionality mode
     


     

    If that doesn't work, we'll try doing a System Scan. The scan will look for bad Vista files and will attempt to repair them, if possible.

    1)    Login to Vista in Normal Mode (not safe mode)

    2)    Launch an Internet Browser

    3)    Type: %windir%\system32\ in the browser's address field

    4)    Scroll down till you find the file cmd.exe

    5)    Right-click the file and select 'Run as Administrator'

    6)    In the CMD window, type: sfc /scannow

    7)    Reboot twice and see if that resolves the issue.

    If neither of these steps resolves the issue, my only other suggestions would be either to contact Vista support at http://support.microsoft.com or reinstall Vista.


    Thank you,
    Darin MS

    P.S. Lord Lanford, if your Diagnostic Report also shows a  "File Mismatch" (under the 'File Scan Data" line) then you should also follow the above steps. If not, then your issue is not the same and you should create your own forum thread and post your Diagnostic Report and a description of the issue.




    .



    Attention All Forum Users: Please Do Not post your issue in someone else's Thread...Create your own. If any post fixes your issue, please click the "Post was Helpful" button for that post. This will help us showcase the threads that best help our customers.
    • Marked as answer by Darin Smith MS Wednesday, March 18, 2009 10:17 PM
    Wednesday, March 18, 2009 10:07 PM

All replies

  • I am also having a problem like this and i too just updated my pc, i have even reinstalled my system to test this and after updates it locks me out again, i am able to access the internet via the "check online" option but thats it.
    Wednesday, March 18, 2009 11:07 AM
  • Hello ejmetz,

      

    The core of your issue centers on the line in your Diagnostic Report that reads:

    File Scan Data-->
    File Mismatch: C:\Windows\system32\Slsvc.exe[6.0.6000.16509]

    This means the file has been Tampered, Modified or has become Corrupt. Vista see this as an attack to bypass it's Licensing security.

    To resolve the issue, you need to either repair or replace the file with a known-good one (of the proper file version)

     

    If you can, try installing Service Pack 1 from http://www.microsoft.com/downloads/details.aspx?FamilyID=b0c7136d-5ebb-413b-89c9-cb3d06d12674&DisplayLang=en. If not, try the below steps, and once your issue is resolved, I encourage you to install SP1


    Try repairing Windows using System Restore:

    1)    Reboot Vista into Safe Mode
    2)    Go to Control Panel
    3)    On the left hand side of the Control Panel window, Click on "Classic View"

    4)    Double-click "Backup and Restore Center"
    5)    On the left hand side of the window, click "Repair Windows using system restore"
    6)    Select "Choose Different Restore Point", Put a check in the box that says "Show restore points older than 5 days", select the restore point that corresponds to the date Before you first noticed the issue.
    7)    Click the "Next" button.
    8)    Reboot back into Normal mode
    9)    Vista should no longer be in Reduced Functionality mode
     


     

    If that doesn't work, we'll try doing a System Scan. The scan will look for bad Vista files and will attempt to repair them, if possible.

    1)    Login to Vista in Normal Mode (not safe mode)

    2)    Launch an Internet Browser

    3)    Type: %windir%\system32\ in the browser's address field

    4)    Scroll down till you find the file cmd.exe

    5)    Right-click the file and select 'Run as Administrator'

    6)    In the CMD window, type: sfc /scannow

    7)    Reboot twice and see if that resolves the issue.

    If neither of these steps resolves the issue, my only other suggestions would be either to contact Vista support at http://support.microsoft.com or reinstall Vista.


    Thank you,
    Darin MS

    P.S. Lord Lanford, if your Diagnostic Report also shows a  "File Mismatch" (under the 'File Scan Data" line) then you should also follow the above steps. If not, then your issue is not the same and you should create your own forum thread and post your Diagnostic Report and a description of the issue.




    .



    Attention All Forum Users: Please Do Not post your issue in someone else's Thread...Create your own. If any post fixes your issue, please click the "Post was Helpful" button for that post. This will help us showcase the threads that best help our customers.
    • Marked as answer by Darin Smith MS Wednesday, March 18, 2009 10:17 PM
    Wednesday, March 18, 2009 10:07 PM