locked
unauthorised windows change RRS feed

  • Question

  • my vista home premium is valid and has been working, however recently it says "an unauthorized change has been made to windows" here is my error report...

    Diagnostic Report (1.7.0095.0):
    -----------------------------------------
    WGA Data-->
    Validation Status: Invalid License
    Validation Code: 50
    Online Validation Code: 0x80070426
    Cached Validation Code: N/A, hr = 0x80070426
    Windows Product Key: *****-*****-BGC2B-77PQQ-YMYPM
    Windows Product Key Hash: Oa20/FMOVC44ACkqykR78aB24eg=
    Windows Product ID: 89578-OEM-7304115-92614
    Windows Product ID Type: 3
    Windows License Type: OEM System Builder
    Windows OS version: 6.0.6000.2.00010300.0.0.003
    CSVLK Server: N/A
    CSVLK PID: N/A
    ID: {A3261154-8A67-4FC1-AC2B-DEBB067C6246}(1)
    Is Admin: Yes
    TestCab: 0x0
    WGA Version: Registered, 1.7.69.2
    Signed By: Microsoft
    Product Name: Windows Vista (TM) Home Premium
    Architecture: 0x00000000
    Build lab: 6000.vista_gdr.071023-1545
    TTS Error: M:20081024143836618-
    Validation Diagnostic:
    Resolution Status: N/A

    WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    WGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    WGATray.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Professional Edition 2003 - 100 Genuine
    OGA Version: Registered, 1.6.28.0
    Signed By: Microsoft
    Office Diagnostics: 025D1FF3-282-80041010_025D1FF3-170-80041010_025D1FF3-171-1_025D1FF3-434-80040154_025D1FF3-178-80040154_025D1FF3-179-2_025D1FF3-185-80070002_025D1FF3-199-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->
    File Mismatch: C:\Windows\system32\user32.dll[6.0.6000.16438]
    File Mismatch: C:\Windows\system32\imagehlp.dll[6.0.6000.16470]

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{A3261154-8A67-4FC1-AC2B-DEBB067C6246}</UGUID><Version>1.7.0095.0</Version><OS>6.0.6000.2.00010300.0.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-YMYPM</PKey><PID>89578-OEM-7304115-92614</PID><PIDType>3</PIDType><SID>S-1-5-21-1420133023-3269569031-82135833</SID><SYSTEM><Manufacturer>GBT___</Manufacturer><Model>NVDAACPI</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F5</Version><SMBIOSVersion major="2" minor="4"/><Date>20071005000000.000000+000</Date></BIOS><HWID>C1303507018400F8</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><BRT/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90110409-6000-11D3-8CFE-0150048383C9}"><LegitResult>100</LegitResult><Name>Microsoft Office Professional Edition 2003</Name><Ver>11</Ver><Val>3AF007E3C3DA500</Val><Hash>9sXEycAmWzjUDlSJjw7zYy7T2nA=</Hash><Pid>73931-640-2109862-57222</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="11" Result="100"/><App Id="16" Version="11" Result="100"/><App Id="18" Version="11" Result="100"/><App Id="19" Version="11" Result="100"/><App Id="1A" Version="11" Result="100"/><App Id="1B" Version="11" Result="100"/><App Id="44" Version="11" Result="100"/></Applications></Office></Software></GenuineResults> 

    Spsys.log Content: U1BMRwEAAAAAAQAABAAAAHwIAAAAAAAAYWECANOQt5gTkOraYCLJAdArSr9MLECc5R83cvYPeMzWrC0zFdkEtN67d40f2z3HPEsmUhZIN8iDNkBFh1zb2ysMPgesORnDUv5v8xZITzjRQLrHyskkQ90htdqligHXGD817S8Cu1HUlGNHVFBLTl0BpRsD6Dwtx6AnxzEU2IlE7oPk/SPeaYoTWCOSbwhb0nMat38/Ij8WvwlN0LR7075lEnTDuN88OYnM4xG1aQcN9TFRMCUKDVZZnS95CyflM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAzQK0q/TCxAnOUfN3L2D3jM8TQY23/68EwPQAF4jsPi0oqCzQMoFs3A2+cjWLAmlOcrDD4HrDkZw1L+b/MWSE84/pzeKE+jNczekzmyBX+Onhg/Ne0vArtR1JRjR1RQS05dAaUbA+g8LcegJ8cxFNiJRO6D5P0j3mmKE1gjkm8IW9JzGrd/PyI/Fr8JTdC0e9O+ZRJ0w7jfPDmJzOMRtWkHDfUxUTAlCg1WWZ0veQsn5TOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM0CtKv0wsQJzlHzdy9g94zB92OjceIwFQnlCUKMEbFZhwfw5B3v2gARx5s2EQ9G1BKww+B6w5GcNS/m/zFkhPOEbQ4jblMUpJU2WoiVMjVgUYPzXtLwK7UdSUY0dUUEtOXQGlGwPoPC3HoCfHMRTYiUTug+T9I95pihNYI5JvCFvScxq3fz8iPxa/CU3QtHvTvmUSdMO43zw5iczjEbVpBw31MVEwJQoNVlmdL3kLJ+UzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDNArSr9MLECc5R83cvYPeMyOca63xZMZWko4vwRy1QZJH6n57umz3182rYWozRYBKSsMPgesORnDUv5v8xZITzghYbJKR8x04epjofFz7N5CGD817S8Cu1HUlGNHVFBLTl0BpRsD6Dwtx6AnxzEU2IlE7oPk/SPeaYoTWCOSbwhb0nMat38/Ij8WvwlN0LR7075lEnTDuN88OYnM4xG1aQcN9TFRMCUKDVZZnS95CyflM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAzQK0q/TCxAnOUfN3L2D3jMnCySE6vrAW7lz1lVQEFnFf/L9wTg7gzvHfHvDQW1S14rDD4HrDkZw1L+b/MWSE84rvX2gwT1014q+8PPT6BfiRg/Ne0vArtR1JRjR1RQS05dAaUbA+g8LcegJ8cxFNiJRO6D5P0j3mmKE1gjkm8IW9JzGrd/PyI/Fr8JTdC0e9O+ZRJ0w7jfPDmJzOMRtWkHDfUxUTAlCg1WWZ0veQsn5TOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM0CtKv0wsQJzlHzdy9g94zAN9TQf73C2cOK2TOG3DKrVl88rrpn0p1hnRAXNi1nCQKww+B6w5GcNS/m/zFkhPONFAusfKySRD3SG12qWKAdcYPzXtLwK7UdSUY0dUUEtOXQGlGwPoPC3HoCfHMRTYiUTug+T9I95pihNYI5JvCFvScxq3fz8iPxa/CU3QtHvTvmUSdMO43zw5iczjEbVpBw31MVEwJQoNVlmdL3kLJ+UzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDNArSr9MLECc5R83cvYPeMzc/V9N9p+MEREANtAb/E5pKaOSwwpOvBrHMf4OqbQ4HSsMPgesORnDUv5v8xZITzhvT1MPDxG/jtSHd3e8ATKSGD817S8Cu1HUlGNHVFBLTl0BpRsD6Dwtx6AnxzEU2IlE7oPk/SPeaYoTWCOSbwhb0nMat38/Ij8WvwlN0LR7075lEnTDuN88OYnM4xG1aQcN9TFRMCUKDVZZnS95CyflM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAzQK0q/TCxAnOUfN3L2D3jMTSeYY+TtqbBrD/++Arr0Rpk06dL4AqlDxBbqvca3sg8rDD4HrDkZw1L+b/MWSE84YdaWiA92g7/rd8jDbd2dahg/Ne0vArtR1JRjR1RQS05dAaUbA+g8LcegJ8cxFNiJRO6D5P0j3mmKE1gjkm8IW9JzGrd/PyI/Fr8JTdC0e9O+ZRJ0w7jfPDmJzOMRtWkHDfUxUTAlCg1WWZ0veQsn5TOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM0CtKv0wsQJzlHzdy9g94zDKuA1xkkNVzQ1XRbAKmI8hAj6Z8cpTcNnWVgFL82yqTKww+B6w5GcNS/m/zFkhPOMOaSSqHexOy0elU7xx9ZwcYPzXtLwK7UdSUY0dUUEtOXQGlGwPoPC3HoCfHMRTYiUTug+T9I95pihNYI5JvCFvScxq3fz8iPxa/CU3QtHvTvmUSdMO43zw5iczjEbVpBw31MVEwJQoNVlmdL3kLJ+UzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDNArSr9MLECc5R83cvYPeMxGE+XIsPvZtw6EidgDWU0vYuF9gwMRW2ZdWy0PonMuZisMPgesORnDUv5v8xZITzhRdT5yHtNGTiUx2TqXwm+lGD817S8Cu1HUlGNHVFBLTl0BpRsD6Dwtx6AnxzEU2IlE7oPk/SPeaYoTWCOSbwhb0nMat38/Ij8WvwlN0LR7075lEnTDuN88OYnM4xG1aQcN9TFRMCUKDVZZnS95CyflM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAzQK0q/TCxAnOUfN3L2D3jMzfiIWN7kWmy7yxxwqRMgINYRXosVd8VJ4/mTJACqQWorDD4HrDkZw1L+b/MWSE84ecv9T7a9CeZCCrUszJPERBg/Ne0vArtR1JRjR1RQS05dAaUbA+g8LcegJ8cxFNiJRO6D5P0j3mmKE1gjkm8IW9JzGrd/PyI/Fr8JTdC0e9O+ZRJ0w7jfPDmJzOMRtWkHDfUxUTAlCg1WWZ0veQsn5TOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM0CtKv0wsQJzlHzdy9g94zDTSR/4tzBeOOZh1wgeHwZkBtPb0PRkAiIWfq9//bOdsKww+B6w5GcNS/m/zFkhPOCgWRWOaQANTDSFwXyR2Ub8YPzXtLwK7UdSUY0dUUEtOXQGlGwPoPC3HoCfHMRTYiUTug+T9I95pihNYI5JvCFvScxq3fz8iPxa/CU3QtHvTvmUSdMO43zw5iczjEbVpBw31MVEwJQoNVlmdL3kLJ+UzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDNArSr9MLECc5R83cvYPeMz9PTHaPOtk1g63N25CUp7A+kPvf1VnbwZTaD1vPIusICsMPgesORnDUv5v8xZITzhMex6KUU3cq6HdcG5vGsIvGD817S8Cu1HUlGNHVFBLTl0BpRsD6Dwtx6AnxzEU2IlE7oPk/SPeaYoTWCOSbwhb0nMat38/Ij8WvwlN0LR7075lEnTDuN88OYnM4xG1aQcN9TFRMCUKDVZZnS95CyflM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAzQK0q/TCxAnOUfN3L2D3jMglz5b0KHADahKrylTU8LItUblLUOgDhFfY5aoG4VCY4rDD4HrDkZw1L+b/MWSE842PauEvLLFUxy3Z+2ABRMuRg/Ne0vArtR1JRjR1RQS05dAaUbA+g8LcegJ8cxFNiJRO6D5P0j3mmKE1gjkm8IW9JzGrd/PyI/Fr8JTdC0e9O+ZRJ0w7jfPDmJzOMRtWkHDfUxUTAlCg1WWZ0veQsn5TOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM0CtKv0wsQJzlHzdy9g94zHvrkdnWay2P5utXVACKnmopEWLZNldB78fVXswwxX+gKww+B6w5GcNS/m/zFkhPOI7rd8hu+AH7JJRe7RkGLBkYPzXtLwK7UdSUY0dUUEtOXQGlGwPoPC3HoCfHMRTYiUTug+T9I95pihNYI5JvCFvScxq3fz8iPxa/CU3QtHvTvmUSdMO43zw5iczjEbVpBw31MVEwJQoNVlmdL3kLJ+UzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDNArSr9MLECc5R83cvYPeMxQgpUbXx4bU0nVnnaFaTQyKMq9QFrfjl9Z+9QuZV+UKSsMPgesORnDUv5v8xZITzifo8RO5hQ7AyqMfCvBmmyQGD817S8Cu1HUlGNHVFBLTl0BpRsD6Dwtx6AnxzEU2IlE7oPk/SPeaYoTWCOSbwhb0nMat38/Ij8WvwlN0LR7075lEnTDuN88OYnM4xG1aQcN9TFRMCUKDVZZnS95CyflM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAzQK0q/TCxAnOUfN3L2D3jMI9o1Scavh50K52HD3SLzKP1U0QLQx2aOh3Fy/JlHWnArDD4HrDkZw1L+b/MWSE84efSuj5pBERSAPjpcUcduVxg/Ne0vArtR1JRjR1RQS05dAaUbA+g8LcegJ8cxFNiJRO6D5P0j3mmKE1gjkm8IW9JzGrd/PyI/Fr8JTdC0e9O+ZRJ0w7jfPDmJzOMRtWkHDfUxUTAlCg1WWZ0veQsn5TOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM0CtKv0wsQJzlHzdy9g94zMvXLV/N3MJlCiG0g0gROP0nJc7XRrYaM/QZ6wmQblCdKww+B6w5GcNS/m/zFkhPOCaGFIxgh4XobSS9J6O4i9UYPzXtLwK7UdSUY0dUUEtOXQGlGwPoPC3HoCfHMRTYiUTug+T9I95pihNYI5JvCFvScxq3fz8iPxa/CU3QtHvTvmUSdMO43zw5iczjEbVpBw31MVEwJQoNVlmdL3kLJ+UzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDNArSr9MLECc5R83cvYPeMwk4QhiLSCqqm2b3C/9n3WGIUUnr8uBKcqHYj0JYZn5YSsMPgesORnDUv5v8xZITzgoFkVjmkADUw0hcF8kdlG/GD817S8Cu1HUlGNHVFBLTl0BpRsD6Dwtx6AnxzEU2IlE7oPk/SPeaYoTWCOSbwhb0nMat38/Ij8WvwlN0LR7075lEnTDuN88OYnM4xG1aQcN9TFRMCUKDVZZnS95CyflM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAzQK0q/TCxAnOUfN3L2D3jM/G7e+tjdnl4ztgzzSnkuRuv9TOXQyYaymP3xbEFtVbYrDD4HrDkZw1L+b/MWSE84/Xz5XxOuo0LN2iBbHbtXLRg/Ne0vArtR1JRjR1RQS05dAaUbA+g8LcegJ8cxFNiJRO6D5P0j3mmKE1gjkm8IW9JzGrd/PyI/Fr8JTdC0e9O+ZRJ0w7jfPDmJzOMRtWkHDfUxUTAlCg1WWZ0veQsn5TOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM0CtKv0wsQJzlHzdy9g94zOueToW1qSTdDiPs1zkVvW3ZqZ1XX0dVeCsYWenEWQC1Kww+B6w5GcNS/m/zFkhPOA2uWXmLHZ01A8vznxZKhsAYPzXtLwK7UdSUY0dUUEtOXQGlGwPoPC3HoCfHMRTYiUTug+T9I95pihNYI5JvCFvScxq3fz8iPxa/CU3QtHvTvmUSdMO43zw5iczjEbVpBw31MVEwJQoNVlmdL3kLJ+UzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDNArSr9MLECc5R83cvYPeMzMt26oOnrCzUqqSUu+CWiQULsuzrhpO33iRSl6zgjBSisMPgesORnDUv5v8xZITzhyGC4l5Q2Y+eZmjO6O+7W1GD817S8Cu1HUlGNHVFBLTl0BpRsD6Dwtx6AnxzEU2IlE7oPk/SPeaYoTWCOSbwhb0nMat38/Ij8WvwlN0LR7075lEnTDuN88OYnM4xG1aQcN9TFRMCUKDVZZnS95CyflM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAzQK0q/TCxAnOUfN3L2D3jMJuf4S8t8ezx5A0+CKTIMp7tltpnA6/bJk5s8vw0HR3ErDD4HrDkZw1L+b/MWSE84uZib4FoaQg57hHZNrS0aARg/Ne0vArtR1JRjR1RQS05dAaUbA+g8LcegJ8cxFNiJRO6D5P0j3mmKE1gjkm8IW9JzGrd/PyI/Fr8JTdC0e9O+ZRJ0w7jfPDmJzOMRtWkHDfUxUTAlCg1WWZ0veQsn5TOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM0CtKv0wsQJzlHzdy9g94zDpfP35de8IcsP7OJwZ0Z6JKT+nnK+z092lLrC5MCmTCKww+B6w5GcNS/m/zFkhPOCgc9OYxWlvpTElyq6MgzEEYPzXtLwK7UdSUY0dUUEtOXQGlGwPoPC3HoCfHMRTYiUTug+T9I95pihNYI5JvCFvScxq3fz8iPxa/CU3QtHv





    can anybody help?!
    Friday, October 24, 2008 2:10 PM

Answers

  • Nshack,

    Windows Vista is in what is called a 'Mod-Auth' Tamper state.  There are 2 types of Mod-Auth tampers.

     1) A critical system file was modified On Disk - What this means is that the file, located on the hard drive, and was modified in some way. This can be caused by random file corruption, a malicious program (malware) or by manual file modification (by a user of the system). There is also a very small chance that an Update may fail in mid-update and cause this type of issue. As a safety mechanism, Updates are made so that if they fail, they roll-back any updating that was done before the failure, but there is an off-chance that the roll-back may not occur.

     2) A critical system file was modified In Memory - What this means is the file itself (on the hard drive) is un-modified, but the code, from that file, running in the system, was modified in some way and is usually caused by a running program that is incompatible with Windows Vista.

     Because of the Mismatched files listed under the "File Scan Data-->" line of your Microsoft Genuine Advantage Diagnostic (MGADT) report, (i.e. user32.dll [6.0.6000.16438]) your issue is a On Disk Mod-Auth.

     To resolve the issue, we need to replace the bad file with an unmodified/uncorrupted copy. You can do this by one of following ways:

     A) Install Service Pack 1 for Windows Vista (http://www.microsoft.com/downloads/details.aspx?FamilyID=b0c7136d-5ebb-413b-89c9-cb3d06d12674&DisplayLang=en). I believe SP1 contains an updated version of file user32.dll, that once installed, should resolve the issue.

     Or

     B) You can re-install a past Update that contained that file (in your case update KB925902) by following the below steps:

     First, uninstall the updates:

     1) Log into Windows Vista in Safe Mode

    2) Click Start button, then Click Control Panel

    3) Click Classic View in the upper right of the Control Panel

    4) Double-Click Programs and Features

    5) Click View installed updates in the upper right of the Program and Features

    6) It may take some time for the list of Updates to appear, please wait..

    7) Right-Click on the update 'KB925902' and select Uninstall

    8) Reboot into Normal Mode

     Now, reinstall the updates:

    At this point, Windows Vista may or may not be in Reduced Functionality Mode (RFM). The below steps assume that Windows Vista is in RFM.

     

    9) Log in to Windows Vista and select the options that bring up the Internet Browser.

    10) Go to:

           http://www.microsoft.com/downloads

    11) Search for KB925902

    12) In the search results, click the update KB925902

    13) Click Download button.

    14) You will be given the choice to Save or Run, select Run

    15) Reboot 2 times. 

     

    Or

     

    C) Repair Windows Vista using System Restore:

     

    1) Reboot Windows Vista into Safe Mode

    2) Go to Control Panel

    3) On the left hand side of the Control Panel window, click Classic View

    4) Double-click Backup and Restore Center

    5) On the left hand side of the window, click Repair Windows using system restore

    6) Select Choose Different Restore Point, put a check in the box that says Show restore points older than 5 days, then select the restore point that corresponds to the date before you first noticed the issue

    7) Click Next button

    8) Reboot back into Normal mode

    9) Windows Vista should no longer be in RFM

     

    If none of these suggestions resolves your issue, open a (no cost) support request below:

    http://go.microsoft.com/fwlink/?linkid=52029

    Thank you for visiting the Genuine Advantage forum.



    Stephen Holm, MS
    WGA Forum Manager


    Stephen Holm
    • Marked as answer by Stephen Holm Saturday, October 25, 2008 12:42 AM
    Saturday, October 25, 2008 12:41 AM

All replies

  • Nshack,

    Windows Vista is in what is called a 'Mod-Auth' Tamper state.  There are 2 types of Mod-Auth tampers.

     1) A critical system file was modified On Disk - What this means is that the file, located on the hard drive, and was modified in some way. This can be caused by random file corruption, a malicious program (malware) or by manual file modification (by a user of the system). There is also a very small chance that an Update may fail in mid-update and cause this type of issue. As a safety mechanism, Updates are made so that if they fail, they roll-back any updating that was done before the failure, but there is an off-chance that the roll-back may not occur.

     2) A critical system file was modified In Memory - What this means is the file itself (on the hard drive) is un-modified, but the code, from that file, running in the system, was modified in some way and is usually caused by a running program that is incompatible with Windows Vista.

     Because of the Mismatched files listed under the "File Scan Data-->" line of your Microsoft Genuine Advantage Diagnostic (MGADT) report, (i.e. user32.dll [6.0.6000.16438]) your issue is a On Disk Mod-Auth.

     To resolve the issue, we need to replace the bad file with an unmodified/uncorrupted copy. You can do this by one of following ways:

     A) Install Service Pack 1 for Windows Vista (http://www.microsoft.com/downloads/details.aspx?FamilyID=b0c7136d-5ebb-413b-89c9-cb3d06d12674&DisplayLang=en). I believe SP1 contains an updated version of file user32.dll, that once installed, should resolve the issue.

     Or

     B) You can re-install a past Update that contained that file (in your case update KB925902) by following the below steps:

     First, uninstall the updates:

     1) Log into Windows Vista in Safe Mode

    2) Click Start button, then Click Control Panel

    3) Click Classic View in the upper right of the Control Panel

    4) Double-Click Programs and Features

    5) Click View installed updates in the upper right of the Program and Features

    6) It may take some time for the list of Updates to appear, please wait..

    7) Right-Click on the update 'KB925902' and select Uninstall

    8) Reboot into Normal Mode

     Now, reinstall the updates:

    At this point, Windows Vista may or may not be in Reduced Functionality Mode (RFM). The below steps assume that Windows Vista is in RFM.

     

    9) Log in to Windows Vista and select the options that bring up the Internet Browser.

    10) Go to:

           http://www.microsoft.com/downloads

    11) Search for KB925902

    12) In the search results, click the update KB925902

    13) Click Download button.

    14) You will be given the choice to Save or Run, select Run

    15) Reboot 2 times. 

     

    Or

     

    C) Repair Windows Vista using System Restore:

     

    1) Reboot Windows Vista into Safe Mode

    2) Go to Control Panel

    3) On the left hand side of the Control Panel window, click Classic View

    4) Double-click Backup and Restore Center

    5) On the left hand side of the window, click Repair Windows using system restore

    6) Select Choose Different Restore Point, put a check in the box that says Show restore points older than 5 days, then select the restore point that corresponds to the date before you first noticed the issue

    7) Click Next button

    8) Reboot back into Normal mode

    9) Windows Vista should no longer be in RFM

     

    If none of these suggestions resolves your issue, open a (no cost) support request below:

    http://go.microsoft.com/fwlink/?linkid=52029

    Thank you for visiting the Genuine Advantage forum.



    Stephen Holm, MS
    WGA Forum Manager


    Stephen Holm
    • Marked as answer by Stephen Holm Saturday, October 25, 2008 12:42 AM
    Saturday, October 25, 2008 12:41 AM
  • sp1 solved the problem. thank you very much for your help
    Saturday, October 25, 2008 11:10 AM