locked
Unauthorized change made to Windows RRS feed

  • Question

  • I have been going round and round with the error "An unauthorized change was made to

    Windows" since an automatic update was sent down around Aug. 30.  It sends you online to validate windows and my software does not pass validation and gives the code 0x80070426.  I have called Compaq as this is a new computer and they don't know how to fix it.  I have restored to a previous date but it only lasts a day or two.  I can only run in safe mode and it won't let me run "net start slsvc" in that mode.  I don't have any of the software listed on the problem software list.  This is what I get from running the diagnostic tool.  Can someone please help because I don't know what else to do?  I just want to use my new laptop.

     

    Diagnostic Report (1.7.0039.0):
    -----------------------------------------
    WGA Data-->
    Validation Status: Invalid License
    Detailed Status: 0xc004f027
    Cached / Grace status: (N/A, hr = 0x80070426) / (N/A, hr = 0x80070426)
    Windows Product Key: *****-*****-27HYQ-XTKW2-WQD8Q
    Windows Product Key Hash: U8YEZzymoD4DMyaMb32rPrNIS90=
    Windows Product ID: 89578-OEM-7332157-00061
    Windows Product ID Type: 2
    CSVLK Server: N/A
    CSVLK PID: N/A
    Windows License Type: OEM SLP
    Windows OS version: 6.0.6000.2.00010300.0.0.000
    ID: {B2980122-85DD-4385-B43C-EA5F8A2BCB9B}(1)
    Is Admin: Yes
    Commit / Reboot / BRT: (N/A, hr = 0x80070426) / 0x0 / (N/A, hr = 0x80070426)
    WGA Version: Registered, 1.7.59.0
    Signed By: Microsoft
    Product Name: Windows Vista (TM) Home Premium
    Architecture: 0x00000000
    Build lab: 6000.vista_gdr.070627-1500
    TTS Error: M:20070927210455330-
    Validation Diagnostic:
    Resolution Status: N/A

    Notifications Data-->
    Cached Result: N/A
    File Exists: No
    Version: N/A
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 104 Unknown PID
    OGA Version: Failed to retrieve file version. - 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: FCEE394C-2993-80070002_77F760FE-152-80070002_7E90FEE8-175-80070002_025D1FF3-282-80041010_025D1FF3-170-80041010_025D1FF3-171-1_025D1FF3-434-80040154_025D1FF3-178-80040154_025D1FF3-179-2_025D1FF3-185-80070002_025D1FF3-199-3_B4D0AA8B-818-80070057

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->
    File Mismatch: C:\Windows\system32\Slc.dll

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{B2980122-85DD-4385-B43C-EA5F8A2BCB9B}</UGUID><Version>1.7.0039.0</Version><OS>6.0.6000.2.00010300.0.0.000</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-WQD8Q</PKey><PID>89578-OEM-7332157-00061</PID><PIDType>2</PIDType><SID>S-1-5-21-3483843383-169388341-336727835</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>Presario F500 (GF606UA#ABA)       </Model></SYSTEM><BIOS><Manufacturer>Hewlett-Packard</Manufacturer><Version>F.18    </Version><SMBIOSVersion major="2" minor="4"/><Date>20070531000000.000000+000</Date></BIOS><HWID>77303507018400EE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-MPC</OEMTableID></OEM></MachineData><Software><Office><Result>104</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>104</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><PidType>0</PidType></Product></Products></Office></Software></GenuineResults> 

     

    Friday, September 28, 2007 1:57 AM

Answers

  • Hello sweetheart55,

     

    What's happening is called a Tamper State. There is a program that is incompatible with Vista and when that program does something that Vista doesn't allow, Vista goes into a Non-Genuine state.

     

    First, read this support document on what programs are known to be incompatible. http://support.microsoft.com/kb/931699/en-us. If you have any of the programs (listed under the 'Cause' section of the document) then uninstall them and reboot.

     

    There are two types of programs that cause a Tamper State

      a) A program that can be launched at any time, by the user (such as a game)

      b) A program that launches at Start up and that contently runs (such as an anti virus program)

     

    For a) type programs, once you reboot, Vista goes back to a genuine state (because the program is no longer running)

    For b) type programs, if you reboot, Vista is still in the tamper state because the program automatically re-launched after re-boot.

     

     The key is in identifying the offending program and then either deleting it or upgrading is to a Vista compatible version.

     

    In your Diagnostic report above, you can see the line that starts with 'TTS Error:' followed by a bunch of letters and numbers: M:20070927210455330-

     

    If you break down the numbers, you will get a time stamp:

     

        (year)  (month) (day) (time in 24format) (millisecond)

    M:2007       09       27         2104                  55330

     

    Now that we know the time of the tamper, you can now try to connect that time with a program.

     

    we do that by:

    1) Click the 'Start' button

    2) Right Click 'Computer'

    3) Select 'Manage'

    3a) If you do not have access to the start button, type %windir%\system32\perfmon.exe into the address bar of an internet browser.

    4) Continue thru the "Windows needs your permission to continue" window (if any)

    5) Click the arrow next to 'Reliability and Performance'

    6) Click the arrow next to 'Monitoring Tools'

    7) Click on 'Reliability Monitor'

    8) Click on the graph above the date 9/27/2007

    9) Below the graph, look at the report titled "Software (Un)Installs for 9/27/2007"

    10) Look for any program that shows "Application Install" in the 'Activity' column.

    11) Because the process that detects tampers runs randomly (and may take up to 3 days to detect a tamper) you should repeat the steps 8) - 10) for the dates 26th, 25th and 24th.

    12) Any programs found to have been installed during those dates should be uninstalled untll you no longer receive this Tamper state.

     

    Unfortunately, if you installed the program (say) on 09/01/2007, but you didn't run it (and, hence, prompted the tamper state)  till 09/27/2007, this process may not be helpful. 

     

    Please tell me if this helps you resolve the issue. If not, I will have additional steps for you to try.

     

    Thank you,
    Darin Smith
    WGA Forum Manager
    Wednesday, October 3, 2007 6:26 PM

All replies

  • What you need to do is to reset/reactivate your Windows Vista installation using the telephone activation method:

     

    You can get started with phone activation by typing "slui.exe 4"
    (w/o the quotes) in the Start Search box in the Start Menu and pressing
    Enter.
    The phone activation process takes about 6 minutes.

    Friday, September 28, 2007 2:04 AM
    Moderator
  • Ok, slui.exe 4 would not work in safe mode.  So I restored system to an earlier date and ran the program.  I got a person on the phone who said it was already activated and couldn't be done again.  They gave me a phone number for Microsoft tech support.  In the mean time I went online and tried to validate Vista as genuine and it did work this time.  But now two days later as the updates have been installed again I am back at square one with the same issue.  Any advice before I call and sit on the phone with tech support for another 2 hours?

     

    Sunday, September 30, 2007 6:59 PM
  • Hello sweetheart55,

     

    What's happening is called a Tamper State. There is a program that is incompatible with Vista and when that program does something that Vista doesn't allow, Vista goes into a Non-Genuine state.

     

    First, read this support document on what programs are known to be incompatible. http://support.microsoft.com/kb/931699/en-us. If you have any of the programs (listed under the 'Cause' section of the document) then uninstall them and reboot.

     

    There are two types of programs that cause a Tamper State

      a) A program that can be launched at any time, by the user (such as a game)

      b) A program that launches at Start up and that contently runs (such as an anti virus program)

     

    For a) type programs, once you reboot, Vista goes back to a genuine state (because the program is no longer running)

    For b) type programs, if you reboot, Vista is still in the tamper state because the program automatically re-launched after re-boot.

     

     The key is in identifying the offending program and then either deleting it or upgrading is to a Vista compatible version.

     

    In your Diagnostic report above, you can see the line that starts with 'TTS Error:' followed by a bunch of letters and numbers: M:20070927210455330-

     

    If you break down the numbers, you will get a time stamp:

     

        (year)  (month) (day) (time in 24format) (millisecond)

    M:2007       09       27         2104                  55330

     

    Now that we know the time of the tamper, you can now try to connect that time with a program.

     

    we do that by:

    1) Click the 'Start' button

    2) Right Click 'Computer'

    3) Select 'Manage'

    3a) If you do not have access to the start button, type %windir%\system32\perfmon.exe into the address bar of an internet browser.

    4) Continue thru the "Windows needs your permission to continue" window (if any)

    5) Click the arrow next to 'Reliability and Performance'

    6) Click the arrow next to 'Monitoring Tools'

    7) Click on 'Reliability Monitor'

    8) Click on the graph above the date 9/27/2007

    9) Below the graph, look at the report titled "Software (Un)Installs for 9/27/2007"

    10) Look for any program that shows "Application Install" in the 'Activity' column.

    11) Because the process that detects tampers runs randomly (and may take up to 3 days to detect a tamper) you should repeat the steps 8) - 10) for the dates 26th, 25th and 24th.

    12) Any programs found to have been installed during those dates should be uninstalled untll you no longer receive this Tamper state.

     

    Unfortunately, if you installed the program (say) on 09/01/2007, but you didn't run it (and, hence, prompted the tamper state)  till 09/27/2007, this process may not be helpful. 

     

    Please tell me if this helps you resolve the issue. If not, I will have additional steps for you to try.

     

    Thank you,
    Darin Smith
    WGA Forum Manager
    Wednesday, October 3, 2007 6:26 PM
  • That is a fantastic solution to the problem and I greatly appreciate the help but how does that really fix the problem?

     

    Are you saying that just beacuse Vista doesn't particularly like a program it will cause it to crash EVEN THOUGH the program runs fine in Vista?

     

     

    Talk about a stupid glitch. Why not have an Admin "approval to run selection" on the program that will override the Tamper State issue?

     

    I would rather see the blue screen of death than to potentially go through this everytime I try and install new software..... Especially if the software works fine....
    Tuesday, December 4, 2007 4:01 PM
  •  Zeroman0 wrote:

    That is a fantastic solution to the problem and I greatly appreciate the help but how does that really fix the problem?

     

    Are you saying that just beacuse Vista doesn't particularly like a program it will cause it to crash EVEN THOUGH the program runs fine in Vista?

     

     

    Talk about a stupid glitch. Why not have an Admin "approval to run selection" on the program that will override the Tamper State issue?

     

    I would rather see the blue screen of death than to potentially go through this everytime I try and install new software..... Especially if the software works fine....

     

    Also,

    It would be great if I could do all the steps you listed but since I cannot print because my CPU will not boot up (I can only go to the web for help) I have to try and remember all this in my head........

     

     

     

    Tuesday, December 4, 2007 4:07 PM
  • What if the start button isn't even there for me to click on?? I got this computer in August and it's been working fine, but when I restarted my computer yesterday, it wouldn't accept my password and it just gave me the option of closing (and going back to entering in my password) and going online to find out about the problem. I cannot access anything on my computer except the internet. What should I do?

     

    Saturday, January 12, 2008 4:14 PM
  • I have exactly the same problem as sltraut.  I get error code 0x80070426 when I try to log in and when I click close on this error code it just takes me back to the login screen.

     

    Has anyone found a resolution to this as yet?

     

    Thanks.

    Friday, March 28, 2008 3:16 PM