locked
WGA data following "An unauthorized change was made to windows..." error message RRS feed

  • Question

  • I'm not sure what happened. I did not change anything in windows, this problem started after trying to open Thunderbird email client and getting nothing. The system hung up (unusual), I rebooted, and haven't ben able to start windows since. The error message advice was to net start slsvc services through the command prompt, but I can't get past safe mode and validation services are not available in safe mode. I'll be watching this site, thanks in advance for your help.

    Lloyd

    Diagnostic Report (1.9.0006.0):
    -----------------------------------------
    WGA Data-->
    Validation Status: Invalid License
    Validation Code: 50
    Online Validation Code: 0x80070426
    Cached Validation Code: N/A, hr = 0x80070426
    Windows Product Key: *****-*****-WWR7C-QF2M7-2TB37
    Windows Product Key Hash: YqRmTj4qWYwTYqB/WJzBj8/adyc=
    Windows Product ID: 89578-OEM-7332157-00056
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.0.6001.2.00010300.1.0.003
    ID: {E6BC5A52-D3F2-4646-B684-FFC7614E11AC}(3)
    Is Admin: Yes
    TestCab: 0x0
    WGA Version: Registered, 1.9.9.0
    Signed By: Microsoft
    Product Name: Windows Vista (TM) Home Premium
    Architecture: 0x00000000
    Build lab: 6001.vistasp1_gdr.080917-1612
    TTS Error: M:20090129170619971-
    Validation Diagnostic:
    Resolution Status: N/A

    WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: 6.0.6002.16398

    WGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    WGATray.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Outlook 2007 - 100 Genuine
    Microsoft Office Home and Student 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-365-80041010_025D1FF3-230-80041010_025D1FF3-231-1_025D1FF3-518-80040154_025D1FF3-238-80040154_025D1FF3-239-2_025D1FF3-245-80070002_025D1FF3-259-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->
    File Mismatch: C:\Windows\system32\gdi32.dll[6.0.6001.18159]
    File Mismatch: C:\Windows\system32\shell32.dll[6.0.6001.18167]
    File Mismatch: C:\Windows\system32\wininet.dll[7.0.6001.18157]
    File Mismatch: C:\Windows\system32\iertutil.dll[7.0.6001.18157]
    File Mismatch: C:\Windows\system32\urlmon.dll[7.0.6001.18157]
    File Mismatch: C:\Windows\system32\ieframe.dll[7.0.6001.18157]
    File Mismatch: C:\Windows\system32\mshtml.dll[7.0.6001.18183]

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{E6BC5A52-D3F2-4646-B684-FFC7614E11AC}</UGUID><Version>1.9.0006.0</Version><OS>6.0.6001.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-2TB37</PKey><PID>89578-OEM-7332157-00056</PID><PIDType>2</PIDType><SID>S-1-5-21-3007968943-2430064685-229295625</SID><SYSTEM><Manufacturer>LENOVO</Manufacturer><Model>INVALID   </Model></SYSTEM><BIOS><Manufacturer>LENOVO</Manufacturer><Version>06CN27WW</Version><SMBIOSVersion major="2" minor="4"/><Date>20080303000000.000000+000</Date></BIOS><HWID>B5313507018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>LENOVO</OEMID><OEMTableID>CB-01   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-001A-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Outlook 2007</Name><Ver>12</Ver><Val>120B6E0BD38C266</Val><Hash>DHCqqTbTTl0nCHqNnwVcS+hH7ig=</Hash><Pid>81610-307-8419607-62967</Pid><PidType>10</PidType></Product><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>AC23E6157D8970E</Val><Hash>vLwgbF/LDUNOxZ6Ycjm6yv1XhFU=</Hash><Pid>81602-903-2529197-68204</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 

    Spsys.log Content: U1BMRwEAAAAAAQAABAAAAM0VAAAAAAAAYWECAOjgqKpkBJ34G4LJAdArSr9MLECc5R83cvYPeMyKQrXcnUYV5AkuzayVMhgA3AEYKgPQt7oWnYhOvXrpP6CoTUWXhhgs1m231mF4QnBu2JMk3imD39cz9EmJbY9i27OKLWTN3/xFyngmD3afWQd5BWut+vD3FqOkH5qwY3ocJhXL4B/SulRPmkRSV6oPP9KSju/t9vu9LXUgneZO8FY4AE64zboqR4C2wZdpMQu8VjbvFjoDZ5k4mh5m+ukRM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAzQK0q/TCxAnOUfN3L2D3jM/xkKaS4bKU5GwrZVWvJhzer6eH4lH7Kkjw1DjLWIe5egqE1Fl4YYLNZtt9ZheEJwA2DQWRpwzLvus6WKUDIebtuzii1kzd/8Rcp4Jg92n1kHeQVrrfrw9xajpB+asGN6HCYVy+Af0rpUT5pEUleqDz/Sko7v7fb7vS11IJ3mTvBWOABOuM26KkeAtsGXaTELvFY27xY6A2eZOJoeZvrpETOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM0CtKv0wsQJzlHzdy9g94zK9Lt18FY1St6kGwzo9nmbjINA2YfbNQBcy2+aoJA9NKoKhNRZeGGCzWbbfWYXhCcD8G8KqeFKS/KFABy9KjdpTbs4otZM3f/EXKeCYPdp9ZB3kFa6368PcWo6QfmrBjehwmFcvgH9K6VE+aRFJXqg8/0pKO7+32+70tdSCd5k7wVjgATrjNuipHgLbBl2kxC7xWNu8WOgNnmTiaHmb66REzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDNArSr9MLECc5R83cvYPeMwiJ7yJOJDQwm8FJkH4+bFGMeGuBaiGuGtuT6VtvoJUH6CoTUWXhhgs1m231mF4QnAovP3JKFPAlESlvQe8qvaQ27OKLWTN3/xFyngmD3afWQd5BWut+vD3FqOkH5qwY3ocJhXL4B/SulRPmkRSV6oPP9KSju/t9vu9LXUgneZO8FY4AE64zboqR4C2wZdpMQu8VjbvFjoDZ5k4mh5m+ukRM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAzQK0q/TCxAnOUfN3L2D3jMjEsGtNWl5LgBtb+NmJ6xkmTVjy11Dbnjeo2UGCDl5/igqE1Fl4YYLNZtt9ZheEJw+By+ycmW87mz75lAS4fGjduzii1kzd/8Rcp4Jg92n1kHeQVrrfrw9xajpB+asGN6HCYVy+Af0rpUT5pEUleqDz/Sko7v7fb7vS11IJ3mTvBWOABOuM26KkeAtsGXaTELvFY27xY6A2eZOJoeZvrpETOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM

    Licensing Data-->
    Software Licensing service is not running.

    HWID Data-->
    HWID Hash Current: OgAAAAEABgABAAIAAQAAAAAAAwABAAEAeqhWXK5mDgYEFEpRDI3KsUaDJAis81Iz8vTGxixNrFYqhQ==

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20000
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name OEMID Value OEMTableID Value
      APIC   LENOVO  OEMAPIC
      FACP   LENOVO  CB-01  
      HPET   LENOVO  OEMHPET
      BOOT   LENOVO  OEMBOOT
      MCFG   LENOVO  OEMMCFG
      SLIC   LENOVO  CB-01  
      ECDT   LENOVO  OEMECDT
      OEMB   LENOVO  AMI_OEM
      GSCI   LENOVO  GMCHSCI
      ATKG   A_M_I_  OEMATKG
      SSDT   PmRef  CpuPm


     

    Thursday, January 29, 2009 10:43 PM

Answers

  • Hello Lloyd S.,

     

      I'm seeing a couple of issues in your Diagnostic Report.

     

      The error code 0x80070426 means the Software Licensing service has stopped, but that would not be enough to keep Vista from loading into Normal Mode.

      In the lower part of your Diagnostic Report shows a list of Vista system files that are "Mismatched".  This means that something has modified these files or they have become corrupt somehow.  It is very possible that these files may be corrupt enought to keep Vista from loading into Normal mode, but still allow you to load into Safe Mode.

      NOTE: as for the Non-Genuine error, your Vista is (most likely...I can't tell at this point) Genuine. Vista has gone non-genuine only as a side-affect to the fact that protected system files have been modified or become corrupt. If those file hadn't changed, there (most likely) woundn't be a non-genuine issue. The core of the issue is that Vista system file have been modified (or become corrupt) and that is outside my area of knowledge and support.

     

     Below are the only things I could suggest, but as I said, this issue is outside my area of knowledge and support.

    a) Boot Vista into a "Last Known Good" restore point.

    b) Reinstall Vista.

     

      Since the issue is not directly a I Genuine/Non-Genuine issue, I highly recommend contacting your primary Vista support provider. Either Microsoft Vista support (at http://support.microsoft.com) or the support provided by the computer's manufacturer.

     

    Thank you,

    Darin


    Attention Forum All Users: Please Do Not post your issue in someone else's Thread...Create your own.
    Friday, January 30, 2009 1:38 AM
  •  

    I'm very sorry Lloyd, this is outside my area of knowledge and anything I would tell you would be a guess. 

     

    Ifyou think this is a Virus, you may want to contact PC Safety.  They are a Microsoft group that provides no cost help with Malware infections.

    PC Safety: Call 1-866-PCSafety or 1-866-727-2338

    http://www.microsoft.com/protect/support/default.mspx

    http://onecare.live.com/site/en-us/center/whatsnew.htm

     

    Darin MS


    Attention Forum All Users: Please Do Not post your issue in someone else's Thread...Create your own.
    • Marked as answer by Darin Smith MS Friday, January 30, 2009 11:14 PM
    Friday, January 30, 2009 11:14 PM

All replies

  • Hello Lloyd S.,

     

      I'm seeing a couple of issues in your Diagnostic Report.

     

      The error code 0x80070426 means the Software Licensing service has stopped, but that would not be enough to keep Vista from loading into Normal Mode.

      In the lower part of your Diagnostic Report shows a list of Vista system files that are "Mismatched".  This means that something has modified these files or they have become corrupt somehow.  It is very possible that these files may be corrupt enought to keep Vista from loading into Normal mode, but still allow you to load into Safe Mode.

      NOTE: as for the Non-Genuine error, your Vista is (most likely...I can't tell at this point) Genuine. Vista has gone non-genuine only as a side-affect to the fact that protected system files have been modified or become corrupt. If those file hadn't changed, there (most likely) woundn't be a non-genuine issue. The core of the issue is that Vista system file have been modified (or become corrupt) and that is outside my area of knowledge and support.

     

     Below are the only things I could suggest, but as I said, this issue is outside my area of knowledge and support.

    a) Boot Vista into a "Last Known Good" restore point.

    b) Reinstall Vista.

     

      Since the issue is not directly a I Genuine/Non-Genuine issue, I highly recommend contacting your primary Vista support provider. Either Microsoft Vista support (at http://support.microsoft.com) or the support provided by the computer's manufacturer.

     

    Thank you,

    Darin


    Attention Forum All Users: Please Do Not post your issue in someone else's Thread...Create your own.
    Friday, January 30, 2009 1:38 AM
  • Thanks. I tried booting to the last good configuration and got the same error. Could this be a virus? I started up in safe mode and tried to copy files I created yesterday onto a usb drive. The folders are there but all of the spreadsheets that were in them are gone. Also, several other folders I did not touch yesteday are showing a modified date of yesterday. These folders have files in them, and I opened the pdfs (none of the windows apps are running in safe mode) and they look OK. It appears that the only data I lost was all of the spreadsheets and one pdf from yesterday. Any ideas or suggestions?
    Friday, January 30, 2009 2:54 AM
  •  

    I'm very sorry Lloyd, this is outside my area of knowledge and anything I would tell you would be a guess. 

     

    Ifyou think this is a Virus, you may want to contact PC Safety.  They are a Microsoft group that provides no cost help with Malware infections.

    PC Safety: Call 1-866-PCSafety or 1-866-727-2338

    http://www.microsoft.com/protect/support/default.mspx

    http://onecare.live.com/site/en-us/center/whatsnew.htm

     

    Darin MS


    Attention Forum All Users: Please Do Not post your issue in someone else's Thread...Create your own.
    • Marked as answer by Darin Smith MS Friday, January 30, 2009 11:14 PM
    Friday, January 30, 2009 11:14 PM