Unauthorized change made to Windows RRS feed

  • Question

  • Hi, I've recently encountered this problem that I see has affected many others.

    The problem seemed to have occurred after I downloaded the Microsoft .NET Framework 3.5 Service Pack 1 from here. After I downloaded and installed it, I restarted my computer and the normal "Windows is configuring updates" screen appeared.

    Nothing seemed wrong until I tried to log on, then the dreaded "An unauthorized change was made to Windows" box appeared amidst a black screen. I was unable to do anything at all, and had to restart my laptop several times before finally successfully logging on to Windows.

    I've had my laptop for almost a year and a half, and have never encountered this problem before. Please help thanks.

    Error code: [0xC004D401]

    Diagnostic Report (1.9.0006.0):
    WGA Data-->
    Validation Status: Invalid License
    Validation Code: 50
    Online Validation Code: 0xc004d401
    Cached Validation Code: N/A, hr = 0xc004d401
    Windows Product Key: *****-*****-FRJ4T-BKD6B-C47PP
    Windows Product Key Hash: h84FlI5BStAbDjCJPyURCinXnx8=
    Windows Product ID: 89576-OEM-7332141-00143
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.0.6001.2.00010100.1.0.006
    ID: {F9CD5331-975D-457A-90DF-29373F9FA901}(3)
    Is Admin: Yes
    TestCab: 0x0
    WGA Version: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows Vista (TM) Business
    Architecture: 0x00000000
    Build lab: 6001.vistasp1_gdr.080917-1612
    TTS Error: K:20090129003132680-M:20090128220129702-
    Validation Diagnostic:
    Resolution Status: N/A

    WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    WGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    WGATray.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Standard 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-365-80041010_025D1FF3-230-80041010_025D1FF3-231-1_025D1FF3-518-80040154_025D1FF3-238-80040154_025D1FF3-239-2_025D1FF3-245-80070002_025D1FF3-259-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
    Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{F9CD5331-975D-457A-90DF-29373F9FA901}</UGUID><Version>1.9.0006.0</Version><OS>6.0.6001.2.00010100.1.0.006</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-C47PP</PKey><PID>89576-OEM-7332141-00143</PID><PIDType>2</PIDType><SID>S-1-5-21-4265383509-2510533817-3137972487</SID><SYSTEM><Manufacturer>LENOVO</Manufacturer><Model>8896A22</Model></SYSTEM><BIOS><Manufacturer>LENOVO</Manufacturer><Version>7LET39WW (1.09 )</Version><SMBIOSVersion major="2" minor="4"/><Date>20070514000000.000000+000</Date></BIOS><HWID>82300500018400FA</HWID><UserLCID>4809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Malay Peninsula Standard Time(GMT+08:00)</TimeZone><iJoin>1</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>LENOVO</OEMID><OEMTableID>TP-7L   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0012-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Standard 2007</Name><Ver>12</Ver><Val>CFAB6F2A928F77</Val><Hash>9nag41eIS058xXkUsATklj9+dPA=</Hash><Pid>81607-955-0076125-64585</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 

    Spsys.log Content: U1BMRwEAAAAAAQAABAAAADwWAAAAAAAAYWECAAQAwJJ9dMZZTIHJARhy9171jCizkdIEkQaJZ67lpBIAHmntWf8rM8aMWR45tOiF4E75lIZt/syBsaVdrDxmIhnxJS6W2ohsCzadr0LYbbUlSLdZK8mGBO/uaNkEBtU6zyz3v9Z2MrIHa9x3W3cNP6YJJRzZ3sGPZMdauCpWgA9xqCKT2pyzU4ikmVXcUHxhcf38akJWjrTFmdio3G4MbsZdJFBl6ID8Z6PgzOE3ppKHhVqCwkvaDzBS7RRf801+h+MsTFkRlJ2ZAjRAiDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwYcvde9Ywos5HSBJEGiWeuMxYb8/oQ5M13DNM0u6qs1/nB5Ag9058HEmIA5A0+d59RdB/TofoSRMO1ykgEoUW3vo9dnT4EcwkRY7Y/2tjd9dZo5I814XKveJuPHHiahjj7tVLwe28YiH1BLYCERqYZDkmvhBlGHDl+f1L5AB51cWXICRO7wMvZJLvE5ReOSVqbGyYrHLwGFoM8hWdM+/ctDipudwcPOu4RzRON1r2alCNEX9TKgNw+bFnxMO1njX8zkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM

    Licensing Data-->
    C:\Windows\system32\slmgr.vbs(1634, 5) (null): 0xC004D401

    HWID Data-->

    OEM Activation 1.0 Data-->

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20000
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name OEMID Value OEMTableID Value
      APIC   LENOVO  TP-7L  
      FACP   LENOVO  TP-7L  
      HPET   LENOVO  TP-7L  
      BOOT   LENOVO  TP-7L  
      MCFG   LENOVO  TP-7L  
      SSDT   LENOVO  TP-7L  
      ECDT   LENOVO  TP-7L  
      TCPA   LENOVO  TP-7L  
      SLIC   LENOVO  TP-7L  
      ASF!   LENOVO  TP-7L  
      SSDT   LENOVO  TP-7L  
      SSDT   LENOVO  TP-7L  
      SSDT   LENOVO  TP-7L  
      SSDT   LENOVO  TP-7L  


    Thursday, January 29, 2009 4:49 AM


  • Hello atayxm,

      This is very strange. The error 0xc004d401 indicates a In Memory Mod-Auth tamper, which are caused by a program that are not compatible with Vista. Since we know that Microsoft .NET Framework 3.5 Service Pack 1 has to be compatible, something else (that I've never seen) must be happening.

     So, since you are getting this issue after installing a Microsoft provided update, I'm going to refer you to our Vista technical support group at (800) 936-5800. I just called that number and confirmed that issues involving error deriving from installing a Microsoft Update, are supported at No Cost.


    Sorry I couldn't be more help, but I believe you would be better supported thru Vista support,

    Darin MS

    Attention Forum All Users: Please Do Not post your issue in someone else's Thread...Create your own.
    • Marked as answer by Darin Smith MS Friday, January 30, 2009 12:44 AM
    Friday, January 30, 2009 12:44 AM