none
An unauthorized change was made to Windows. RRS feed

  • Question

  • I got this message after I restarted my computer and undates were auto installed.

    What do I do? I think this my help.

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    Validation Status: Invalid License
    Validation Code: 50
    Cached Online Validation Code: N/A, hr = 0x80070426
    Windows Product Key: *****-*****-3RBY2-BGQ2R-DR9M6
    Windows Product Key Hash: EYIpz/47G03lWRAOmk3kg+lR7Rc=
    Windows Product ID: 89578-OEM-7332157-00141
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.0.6000.2.00010300.0.0.003
    ID: {DA7F59E3-9544-423D-98CB-A106270B089E}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: Registered, 1.9.42.0
    Signed By: Microsoft
    Product Name: Windows Vista (TM) Home Premium
    Architecture: 0x00000000
    Build lab: 6000.vista_gdr.100218-0019
    TTS Error: M:20101022162300046-
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: 6.0.6002.16398

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: 2.0.48.0
    OGAExec.exe Signed By: Microsoft
    OGAAddin.dll Signed By: Microsoft

    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Expression Web 2 - 121
    Microsoft Office Home and Student 2007 - 100 Genuine
    OGA Version: Registered, 2.0.48.0
    Signed By: Microsoft
    Office Diagnostics: 7E90FEE8-198-80004005_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_70AFE6BE-656-80070057_E2AD56EA-815-80070057

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->
    File Mismatch: C:\Windows\system32\dnsapi.dll[6.0.6000.16615], Hr = 0x800b0100

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{DA7F59E3-9544-423D-98CB-A106270B089E}</UGUID><Version>1.9.0027.0</Version><OS>6.0.6000.2.00010300.0.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-DR9M6</PKey><PID>89578-OEM-7332157-00141</PID><PIDType>2</PIDType><SID>S-1-5-21-3777651122-2117734261-3338017706</SID><SYSTEM><Manufacturer>Gateway</Manufacturer><Model>MT3707     </Model></SYSTEM><BIOS><Manufacturer>Phoenix</Manufacturer><Version>83.08</Version><SMBIOSVersion major="2" minor="4"/><Date>20070306000000.000000+000</Date></BIOS><HWID>63313507018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>GATEWA</OEMID><OEMTableID>SYSTEM  </OEMTableID></OEM><GANotification><File Name="OGAAddin.dll" Version="2.0.48.0"/></GANotification></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90120000-0045-0000-0000-0000000FF1CE}"><LegitResult>121</LegitResult><Name>Microsoft Expression Web 2</Name><Ver>12</Ver><Val>AE7F96C5122F576</Val><Hash>5F0S7z0NgqQqVmVncvFvYrIl9Co=</Hash><Pid>78727-699-1535876-59103</Pid><PidType>0</PidType></Product><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>ACE09E3F3463818</Val><Hash>eyI3hvdfyyq8mFuoo3EdKr1+Dwk=</Hash><Pid>81602-OEM-6801274-69330</Pid><PidType>11</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 

    Spsys.log Content: U1BMRwEAAAAAAQAABAAAACUiAAAAAAAAWmICANOQZZpMjYNNL3LLAdArSr9MLECc5R83cvYPeMxsJW2FfJqNvUMI/UOdZcddvzut2q1D0aYpqJ3h5zG0G/mA2FF124VnPMn56Nv0G9Ex3s8lze7kd/CwaLyXdZOEGD817S8Cu1HUlGNHVFBLTl0BpRsD6Dwtx6AnxzEU2IlIVcU1NmgXOc/3y+M9lv7f0nMat38/Ij8WvwlN0LR706J/AdUP4L3wi2m/Gi/9qyM7UcmmKQdXOYNsqcu4BNLbM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAw=

    Licensing Data-->
    Software Licensing service is not running.

    Windows Activation Technologies-->
    N/A

    HWID Data-->
    HWID Hash Current: MgAAAAEAAgABAAEAAQABAAAAAwABAAEA+l68LBrywo9ePwhUwDfy9DKu+OO2F6xW9Eg=

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20000
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name OEMID Value OEMTableID Value
      APIC   PTLTD     APIC 
      FACP   ATI     Bonefish
      MCFG   PTLTD     MCFG 
      SLIC   GATEWA  SYSTEM 
      SSDT   PmRef  CpuPm

     

    Friday, October 22, 2010 9:48 PM

Answers

  • "lumpearl" wrote in message news:71dfa4f8-afeb-4b92-b9b9-1e66202440a4...

    I got this message after I restarted my computer and undates were auto installed.

    What do I do? I think this my help.

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    Validation Status: Invalid License
    Validation Code: 50
    Cached Online Validation Code: N/A, hr = 0x80070426
    Windows Product Key: *****-*****-3RBY2-BGQ2R-DR9M6
    Windows Product Key Hash: EYIpz/47G03lWRAOmk3kg+lR7Rc=
    Windows Product ID: 89578-OEM-7332157-00141
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.0.6000.2.00010300.0.0.003
    ID: {DA7F59E3-9544-423D-98CB-A106270B089E}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: Registered, 1.9.42.0
    Signed By: Microsoft
    Product Name: Windows Vista (TM) Home Premium
    Architecture: 0x00000000
    Build lab: 6000.vista_gdr.100218-0019
    TTS Error: M:20101022162300046-

    File Scan Data-->
    File Mismatch: C:\Windows\system32\dnsapi.dll[6.0.6000.16615], Hr = 0x800b0100

    Licensing Data-->
    Software Licensing service is not running.

    You have a file mismatch which has resulted in a Mod-Auth Tamper.
    At this point I would usually recommend either a System Restore, or the use of the System File Checker tool - but the file that has been tampered is one that suggests that your problem originates from a malware attack, and I suspect that doing either of these is possibly going to fail until the malware is removed.
    Unfortunately, you appear to still be using TRM Vista - which means that  you may not have full access to the system in Normal Mode.
    If you have access in normal mode to a browser, or can gain access using Safe Mode with Networking, please download and install Malwarebytes Anti-Malware - update it, and run a Quick scan  (www.malwarebytes.org)
    Delete everything it finds.
    If you're lucky, this may be sufficient to fox the problem - if not then please run another MGADiag report and post back.

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, October 23, 2010 8:32 AM
    Moderator