locked
OEM installation "0xC004D401 Error" with detail diagnostics RRS feed

  • Question

  • I have an Acer Aspire 5920G with pre-installed Windows Vista Home Premium
    and was using the system without any issue for the past few months until the
    following annoying issues occured since 11-Oct-2007.

    I DO NOT have any of the known conflicting software installed as mentioned
    in the forum.

    The System page shows clearly Windows is activated and I've confirmed with
    Microsoft Malaysia both my Product ID and Product Key are genuine.

    I do not have the same issues as KB931573 as I do not received message to
    activate Windows Vista, however I do have update 931573 applied as early
    as 10-May-2007.


    THE ISSUE:
    ------------------
    I randomly got the "0xC004D401 pop up" under 2 circumstances:
    (a) upon log in after typing in the password
    (b) during operation after a normal bootup
    Both are non-reproduceable but occured at random occasion.


    Windows software protection

    An unauthorized change was made to Windows

    You will no longer receive notifications, including those
    about your license or activation. Use the link below to find
    out how to fix your system.
    Error: 0xC004D401
    Description:
    The security processor reported a system file mismatch
    error.

    After that I am not able to access to control panel (it opens up
    and immediately shutdown by itself). Many other systems functions
    are disabled as well.

     

    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    Running the Microsoft Genuine Advantage Diagnostic Tool (1.7.0062.0)
    before any "0xC004D401 pop up" during succesful normal restart will have
    the following results:
    Diagnostic Report (1.7.0062.0):
    -----------------------------------------
    WGA Data-->
    Validation Status: Genuine
    Validation Code: 0
    Online Validation Code: 0x0
    Cached Validation Code: 0x0
    Windows Product Key: *****-*****-XY9X3-JDXYP-6CJ97
    Windows Product Key Hash: xFQJU8srKsovk6p1Lk1yW93in4E=
    Windows Product ID: 89578-OEM-7332157-00211
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.0.6000.2.00010300.0.0.003
    CSVLK Server: N/A
    CSVLK PID: N/A
    ID: {01567746-5390-4691-ABA1-FE5A520F4977}(3)
    Is Admin: Yes
    TestCab: 0x0
    WGA Version: Registered, 1.7.59.0
    Signed By: Microsoft
    Product Name: Windows Vista (TM) Home Premium
    Architecture: 0x00000000
    Build lab: 6000.vista_gdr.070627-1500
    TTS Error: M:20071014153759951-
    Validation Diagnostic:
    Resolution Status: N/A

    WgaER Data-->
    Grace Flag: 0x0
    Commit: N/A, hr = 0xc004f012
    Reboot Flag: 0x0
    ThreatID(s): N/A, hr = 0xc004f012
    Wgaer.exe Version: N/A, hr = 0x80070002
    Wgaer.exe Signed By: N/A, hr = 0x80070002

    Notifications Data-->
    Cached Result: N/A
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 104 Unknown PID
    OGA Version: Registered, 1.6.21.0
    Signed By: Microsoft
    Office Diagnostics: B4D0AA8B-531-645_77F760FE-152-80070002_7E90FEE8-175-80070002_025D1FF3-282-80041010_025D1FF3-170-80041010_025D1FF3-171-1_025D1FF3-434-80040154_025D1FF3-178-80040154_025D1FF3-179-2_025D1FF3-185-80070002_025D1FF3-199-3_B4D0AA8B-818-80070057

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{01567746-5390-4691-ABA1-FE5A520F4977}</UGUID><Version>1.7.0062.0</Version><OS>6.0.6000.2.00010300.0.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-6CJ97</PKey><PID>89578-OEM-7332157-00211</PID><PIDType>2</PIDType><SID>S-1-5-21-745790364-2859089862-191273994</SID><SYSTEM><Manufacturer>Acer, inc.</Manufacturer><Model>Aspire 5920G    </Model></SYSTEM><BIOS><Manufacturer>Acer   </Manufacturer><Version>v0.3508</Version><SMBIOSVersion major="2" minor="4"/><Date>20070522000000.000000+000</Date></BIOS><HWID>E8313507018400FA</HWID><UserLCID>4409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Malay Peninsula Standard Time(GMT+08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><BRT/></MachineData><Software><Office><Result>104</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>104</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><PidType>0</PidType></Product></Products></Office></Software></GenuineResults> 

    Spsys.log Content: U1BMRwEAAAAAAQAABAAAAAcFAAAAAAAAYWECADAgAACsQoj4ugvIARhDs/4hWdo7Xkl9D+HKpnhtPeBWqO0lzOIrznqOxpmpnWgEUYOFRt/GbaQso7/gbTxmIhnxJS6W2ohsCzadr0I2gub/NTKMKrpbTTfNPpd4BtU6zyz3v9Z2MrIHa9x3W3cNP6YJJRzZ3sGPZMdauCpWgA9xqCKT2pyzU4ikmVXcUHxhcf38akJWjrTFmdio3G4MbsZdJFBl6ID8Z6PgzOE3ppKHhVqCwkvaDzBS7RRf801+h+MsTFkRlJ2ZAjRAiDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwYQ7P+IVnaO15JfQ/hyqZ47ZpCjWBwOMPAJ0ZfmCp7nFiYuKpn2OifYAPUtdwvUJRRdB/TofoSRMO1ykgEoUW3qz7m1R2Jm91RMsTYDvMwhtZo5I814XKveJuPHHiahjj7tVLwe28YiH1BLYCERqYZDkmvhBlGHDl+f1L5AB51cWXICRO7wMvZJLvE5ReOSVqbGyYrHLwGFoM8hWdM+/ctDipudwcPOu4RzRON1r2alCNEX9TKgNw+bFnxMO1njX8zkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMGEOz/iFZ2jteSX0P4cqmeJ67wzxIUunKyX8TtRGjH4eMBXys0jSCYF1vXf/3/3lIPGYiGfElLpbaiGwLNp2vQjApKmfAjJXQ8DEECPqaBz0G1TrPLPe/1nYysgdr3Hdbdw0/pgklHNnewY9kx1q4KlaAD3GoIpPanLNTiKSZVdxQfGFx/fxqQlaOtMWZ2Kjcbgxuxl0kUGXogPxno+DM4TemkoeFWoLCS9oPMFLtFF/zTX6H4yxMWRGUnZkCNECIM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDBhDs/4hWdo7Xkl9D+HKpniORTJDy+V1dnStoJgfQcNfxINOocfrTgmeGSLmJrYIcDxmIhnxJS6W2ohsCzadr0J0fzjhLSCqnwvCdfwn7JdbBtU6zyz3v9Z2MrIHa9x3W3cNP6YJJRzZ3sGPZMdauCpWgA9xqCKT2pyzU4ikmVXcUHxhcf38akJWjrTFmdio3G4MbsZdJFBl6ID8Z6PgzOE3ppKHhVqCwkvaDzBS7RRf801+h+MsTFkRlJ2ZAjRAiDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwYQ7P+IVnaO15JfQ/hyqZ4sy3P2HlxyFm1YISFzp0QEj5VoLkJVaD3zikRj31E6E08ZiIZ8SUultqIbAs2na9CMCkqZ8CMldDwMQQI+poHPQbVOs8s97/WdjKyB2vcd1t3DT+mCSUc2d7Bj2THWrgqVoAPcagik9qcs1OIpJlV3FB8YXH9/GpCVo60xZnYqNxuDG7GXSRQZeiA/Gej4MzhN6aSh4VagsJL2g8wUu0UX/NNfofjLExZEZSdmQI0QIgzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMGEOz/iFZ2jteSX0P4cqmeJ0N1GaFKl/SLx9+qsCB+wN4Kg0HOfuAk3n9FxdtVPBnUXQf06H6EkTDtcpIBKFFt9FJ8YjDvr2oxi7kdABySIjWaOSPNeFyr3ibjxx4moY4+7VS8HtvGIh9QS2AhEamGQ5Jr4QZRhw5fn9S+QAedXFlyAkTu8DL2SS7xOUXjklamxsmKxy8BhaDPIVnTPv3LQ4qbncHDzruEc0Tjda9mpQjRF/UyoDcPmxZ8TDtZ41/M5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDBhDs/4hWdo7Xkl9D+HKpnicDRLQg9o7NMox3vYGx0+Cluki502myoKEkhGEgqo9CzxmIhnxJS6W2ohsCzadr0LuslSA/smQxjQoUY5ayDw1BtU6zyz3v9Z2MrIHa9x3W3cNP6YJJRzZ3sGPZMdauCpWgA9xqCKT2pyzU4ikmVXcUHxhcf38akJWjrTFmdio3G4MbsZdJFBl6ID8Z6PgzOE3ppKHhVqCwkvaDzBS7RRf801+h+MsTFkRlJ2ZAjRAiDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwYQ7P+IVnaO15JfQ/hyqZ4d3POFpyS9sxyHIVr89sdZ2nc47GaELPhq6ZK5IocGfRRdB/TofoSRMO1ykgEoUW3lozcSi1ACgCvH1UmvA3cWdZo5I814XKveJuPHHiahjj7tVLwe28YiH1BLYCERqYZDkmvhBlGHDl+f1L5AB51cWXICRO7wMvZJLvE5ReOSVqbGyYrHLwGFoM8hWdM+/ctDipudwcPOu4RzRON1r2alCNEX9TKgNw+bFnxMO1njX8zkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMGEOz/iFZ2jteSX0P4cqmeLhJMdHwIRr02mYxxPNMwD9F3i3PCmDIRTjg5SiylDwnUXQf06H6EkTDtcpIBKFFt91HHtsxwKTvID7xWM0L2C/WaOSPNeFyr3ibjxx4moY4+7VS8HtvGIh9QS2AhEamGQ5Jr4QZRhw5fn9S+QAedXFlyAkTu8DL2SS7xOUXjklamxsmKxy8BhaDPIVnTPv3LQ4qbncHDzruEc0Tjda9mpQjRF/UyoDcPmxZ8TDtZ41/M5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDBhDs/4hWdo7Xkl9D+HKpnjPquFIDTSEVLv8n4VDkjbVJx/Y+Xrao4wGqiJ6UKBiVzxmIhnxJS6W2ohsCzadr0KjnSFfU9zO7lAEQ5/xFNIPBtU6zyz3v9Z2MrIHa9x3W3cNP6YJJRzZ3sGPZMdauCpWgA9xqCKT2pyzU4ikmVXcUHxhcf38akJWjrTFmdio3G4MbsZdJFBl6ID8Z6PgzOE3ppKHhVqCwkvaDzBS7RRf801+h+MsTFkRlJ2ZAjRAiDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwYQ7P+IVnaO15JfQ/hyqZ40X46Nq8L7RzcyQ1Jj9MEPmFKCKrM6fedOF9Ved/iURVRdB/TofoSRMO1ykgEoUW3ZUHhTAN+Kvo+yE9xnCbLutZo5I814XKveJuPHHiahjj7tVLwe28YiH1BLYCERqYZDkmvhBlGHDl+f1L5AB51cWXICRO7wMvZJLvE5ReOSVqbGyYrHLwGFoM8hWdM+/ctDipudwcPOu4RzRON1r2alCNEX9TKgNw+bFnxMO1njX8zkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMGEOz/iFZ2jteSX0P4cqmeKKJlzf3It0d1CdulYr4ovX3WKybkTg6kI8lRimF1VI+UXQf06H6EkTDtcpIBKFFtz9xwrxSzdZKjD46TtUo4pTWaOSPNeFyr3ibjxx4moY4+7VS8HtvGIh9QS2AhEamGQ5Jr4QZRhw5fn9S+QAedXFlyAkTu8DL2SS7xOUXjklamxsmKxy8BhaDPIVnTPv3LQ4qbncHDzruEc0Tjda9mpQjRF/UyoDcPmxZ8TDtZ41/M5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDBhDs/4hWdo7Xkl9D+HKpniUsWS+x94jK5WqRX7PT2Pd6nmuzPWwaVIUKTbZdX3NpDxmIhnxJS6W2ohsCzadr0KNvoUgGG695L5Fn4TXtRHdBtU6zyz3v9Z2MrIHa9x3W3cNP6YJJRzZ3sGPZMdauCpWgA9xqCKT2pyzU4ikmVXcUHxhcf38akJWjrTFmdio3G4MbsZdJFBl6ID8Z6PgzOE3ppKHhVqCwkvaDzBS7RRf801+h+MsTFkRlJ2ZAjRAiDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwYQ7P+IVnaO15JfQ/hyqZ49v+wXot6G1D83jKpVRgMPvkTkIK5/Es/H6Z4d9wvrPFRdB/TofoSRMO1ykgEoUW3kPACu5/VZ1UUhAuWR1rqHNZo5I814XKveJuPHHiahjj7tVLwe28YiH1BLYCERqYZDkmvhBlGHDl+f1L5AB51cWXICRO7wMvZJLvE5ReOSVqbGyYrHLwGFoM8hWdM+/ctDipudwcPOu4RzRON1r2alCNEX9TKgNw+bFnxMO1njX8zkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMGEOz/iFZ2jteSX0P4cqmePWvkscwkkThbAEuCAOWPjzx+LzHO8PE0bcXRIXm7EX6UXQf06H6EkTDtcpIBKFFtwGknfKHjKfMcvl9rX0gGQ3WaOSPNeFyr3ibjxx4moY4+7VS8HtvGIh9QS2AhEamGQ5Jr4QZRhw5fn9S+QAedXFlyAkTu8DL2SS7xOUXjklamxsmKxy8BhaDPIVnTPv3LQ4qbncHDzruEc0Tjda9mpQjRF/UyoDcPmxZ8TDtZ41/M5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDBhDs/4hWdo7Xkl9D+HKpnjUdr6230KpmbF9lpbFaVDRY0o38bHfDXf5aWtlhRKQ7TxmIhnxJS6W2ohsCzadr0J3DM6bpdAVC/9jn4MzB51uBtU6zyz3v9Z2MrIHa9x3W3cNP6YJJRzZ3sGPZMdauCpWgA9xqCKT2pyzU4ikmVXcUHxhcf38akJWjrTFmdio3G4MbsZdJFBl6ID8Z6PgzOE3ppKHhVqCwkvaDzBS7RRf801+h+MsTFkRlJ2ZAjRAiDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAw=

     

    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    However, after getting that "0xC004D401 pop up", I will get the following results:
    Diagnostic Report (1.7.0062.0):
    -----------------------------------------
    WGA Data-->
    Validation Status: Invalid License
    Validation Code: 50
    Online Validation Code: 0xc004d401
    Cached Validation Code: N/A, hr = 0xc004d401
    Windows Product Key: *****-*****-XY9X3-JDXYP-6CJ97
    Windows Product Key Hash: xFQJU8srKsovk6p1Lk1yW93in4E=
    Windows Product ID: 89578-OEM-7332157-00211
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.0.6000.2.00010300.0.0.000
    CSVLK Server: N/A
    CSVLK PID: N/A
    ID: {01567746-5390-4691-ABA1-FE5A520F4977}(3)
    Is Admin: Yes
    TestCab: 0x0
    WGA Version: Registered, 1.7.59.0
    Signed By: Microsoft
    Product Name: Windows Vista (TM) Home Premium
    Architecture: 0x00000000
    Build lab: 6000.vista_gdr.070627-1500
    TTS Error: M:20071014172636804-
    Validation Diagnostic:
    Resolution Status: N/A

    WgaER Data-->
    Grace Flag: N/A, hr = 0xc004d401
    Commit: N/A, hr = 0xc004d401
    Reboot Flag: 0x0
    ThreatID(s): N/A, hr = 0xc004d401
    Wgaer.exe Version: N/A, hr = 0x80070002
    Wgaer.exe Signed By: N/A, hr = 0x80070002

    Notifications Data-->
    Cached Result: N/A
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 104 Unknown PID
    OGA Version: Registered, 1.6.21.0
    Signed By: Microsoft
    Office Diagnostics: B4D0AA8B-531-645_77F760FE-152-80070002_7E90FEE8-175-80070002_025D1FF3-282-80041010_025D1FF3-170-80041010_025D1FF3-171-1_025D1FF3-434-80040154_025D1FF3-178-80040154_025D1FF3-179-2_025D1FF3-185-80070002_025D1FF3-199-3_B4D0AA8B-818-80070057

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{01567746-5390-4691-ABA1-FE5A520F4977}</UGUID><Version>1.7.0062.0</Version><OS>6.0.6000.2.00010300.0.0.000</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-6CJ97</PKey><PID>89578-OEM-7332157-00211</PID><PIDType>2</PIDType><SID>S-1-5-21-745790364-2859089862-191273994</SID><SYSTEM><Manufacturer>Acer, inc.</Manufacturer><Model>Aspire 5920G    </Model></SYSTEM><BIOS><Manufacturer>Acer   </Manufacturer><Version>v0.3508</Version><SMBIOSVersion major="2" minor="4"/><Date>20070522000000.000000+000</Date></BIOS><HWID>E8313507018400FA</HWID><UserLCID>4409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Malay Peninsula Standard Time(GMT+08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><BRT/></MachineData><Software><Office><Result>104</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>104</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><PidType>0</PidType></Product></Products></Office></Software></GenuineResults> 

    Spsys.log Content: U1BMRwEAAAAAAQAABAAAAAcFAAAAAAAAYWECADAgAACsQoj4ugvIARhDs/4hWdo7Xkl9D+HKpnhtPeBWqO0lzOIrznqOxpmpnWgEUYOFRt/GbaQso7/gbTxmIhnxJS6W2ohsCzadr0I2gub/NTKMKrpbTTfNPpd4BtU6zyz3v9Z2MrIHa9x3W3cNP6YJJRzZ3sGPZMdauCpWgA9xqCKT2pyzU4ikmVXcUHxhcf38akJWjrTFmdio3G4MbsZdJFBl6ID8Z6PgzOE3ppKHhVqCwkvaDzBS7RRf801+h+MsTFkRlJ2ZAjRAiDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwYQ7P+IVnaO15JfQ/hyqZ47ZpCjWBwOMPAJ0ZfmCp7nFiYuKpn2OifYAPUtdwvUJRRdB/TofoSRMO1ykgEoUW3qz7m1R2Jm91RMsTYDvMwhtZo5I814XKveJuPHHiahjj7tVLwe28YiH1BLYCERqYZDkmvhBlGHDl+f1L5AB51cWXICRO7wMvZJLvE5ReOSVqbGyYrHLwGFoM8hWdM+/ctDipudwcPOu4RzRON1r2alCNEX9TKgNw+bFnxMO1njX8zkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMGEOz/iFZ2jteSX0P4cqmeJ67wzxIUunKyX8TtRGjH4eMBXys0jSCYF1vXf/3/3lIPGYiGfElLpbaiGwLNp2vQjApKmfAjJXQ8DEECPqaBz0G1TrPLPe/1nYysgdr3Hdbdw0/pgklHNnewY9kx1q4KlaAD3GoIpPanLNTiKSZVdxQfGFx/fxqQlaOtMWZ2Kjcbgxuxl0kUGXogPxno+DM4TemkoeFWoLCS9oPMFLtFF/zTX6H4yxMWRGUnZkCNECIM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDBhDs/4hWdo7Xkl9D+HKpniORTJDy+V1dnStoJgfQcNfxINOocfrTgmeGSLmJrYIcDxmIhnxJS6W2ohsCzadr0J0fzjhLSCqnwvCdfwn7JdbBtU6zyz3v9Z2MrIHa9x3W3cNP6YJJRzZ3sGPZMdauCpWgA9xqCKT2pyzU4ikmVXcUHxhcf38akJWjrTFmdio3G4MbsZdJFBl6ID8Z6PgzOE3ppKHhVqCwkvaDzBS7RRf801+h+MsTFkRlJ2ZAjRAiDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwYQ7P+IVnaO15JfQ/hyqZ4sy3P2HlxyFm1YISFzp0QEj5VoLkJVaD3zikRj31E6E08ZiIZ8SUultqIbAs2na9CMCkqZ8CMldDwMQQI+poHPQbVOs8s97/WdjKyB2vcd1t3DT+mCSUc2d7Bj2THWrgqVoAPcagik9qcs1OIpJlV3FB8YXH9/GpCVo60xZnYqNxuDG7GXSRQZeiA/Gej4MzhN6aSh4VagsJL2g8wUu0UX/NNfofjLExZEZSdmQI0QIgzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMGEOz/iFZ2jteSX0P4cqmeJ0N1GaFKl/SLx9+qsCB+wN4Kg0HOfuAk3n9FxdtVPBnUXQf06H6EkTDtcpIBKFFt9FJ8YjDvr2oxi7kdABySIjWaOSPNeFyr3ibjxx4moY4+7VS8HtvGIh9QS2AhEamGQ5Jr4QZRhw5fn9S+QAedXFlyAkTu8DL2SS7xOUXjklamxsmKxy8BhaDPIVnTPv3LQ4qbncHDzruEc0Tjda9mpQjRF/UyoDcPmxZ8TDtZ41/M5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDBhDs/4hWdo7Xkl9D+HKpnicDRLQg9o7NMox3vYGx0+Cluki502myoKEkhGEgqo9CzxmIhnxJS6W2ohsCzadr0LuslSA/smQxjQoUY5ayDw1BtU6zyz3v9Z2MrIHa9x3W3cNP6YJJRzZ3sGPZMdauCpWgA9xqCKT2pyzU4ikmVXcUHxhcf38akJWjrTFmdio3G4MbsZdJFBl6ID8Z6PgzOE3ppKHhVqCwkvaDzBS7RRf801+h+MsTFkRlJ2ZAjRAiDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwYQ7P+IVnaO15JfQ/hyqZ4d3POFpyS9sxyHIVr89sdZ2nc47GaELPhq6ZK5IocGfRRdB/TofoSRMO1ykgEoUW3lozcSi1ACgCvH1UmvA3cWdZo5I814XKveJuPHHiahjj7tVLwe28YiH1BLYCERqYZDkmvhBlGHDl+f1L5AB51cWXICRO7wMvZJLvE5ReOSVqbGyYrHLwGFoM8hWdM+/ctDipudwcPOu4RzRON1r2alCNEX9TKgNw+bFnxMO1njX8zkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMGEOz/iFZ2jteSX0P4cqmeLhJMdHwIRr02mYxxPNMwD9F3i3PCmDIRTjg5SiylDwnUXQf06H6EkTDtcpIBKFFt91HHtsxwKTvID7xWM0L2C/WaOSPNeFyr3ibjxx4moY4+7VS8HtvGIh9QS2AhEamGQ5Jr4QZRhw5fn9S+QAedXFlyAkTu8DL2SS7xOUXjklamxsmKxy8BhaDPIVnTPv3LQ4qbncHDzruEc0Tjda9mpQjRF/UyoDcPmxZ8TDtZ41/M5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDBhDs/4hWdo7Xkl9D+HKpnjPquFIDTSEVLv8n4VDkjbVJx/Y+Xrao4wGqiJ6UKBiVzxmIhnxJS6W2ohsCzadr0KjnSFfU9zO7lAEQ5/xFNIPBtU6zyz3v9Z2MrIHa9x3W3cNP6YJJRzZ3sGPZMdauCpWgA9xqCKT2pyzU4ikmVXcUHxhcf38akJWjrTFmdio3G4MbsZdJFBl6ID8Z6PgzOE3ppKHhVqCwkvaDzBS7RRf801+h+MsTFkRlJ2ZAjRAiDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwYQ7P+IVnaO15JfQ/hyqZ40X46Nq8L7RzcyQ1Jj9MEPmFKCKrM6fedOF9Ved/iURVRdB/TofoSRMO1ykgEoUW3ZUHhTAN+Kvo+yE9xnCbLutZo5I814XKveJuPHHiahjj7tVLwe28YiH1BLYCERqYZDkmvhBlGHDl+f1L5AB51cWXICRO7wMvZJLvE5ReOSVqbGyYrHLwGFoM8hWdM+/ctDipudwcPOu4RzRON1r2alCNEX9TKgNw+bFnxMO1njX8zkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMGEOz/iFZ2jteSX0P4cqmeKKJlzf3It0d1CdulYr4ovX3WKybkTg6kI8lRimF1VI+UXQf06H6EkTDtcpIBKFFtz9xwrxSzdZKjD46TtUo4pTWaOSPNeFyr3ibjxx4moY4+7VS8HtvGIh9QS2AhEamGQ5Jr4QZRhw5fn9S+QAedXFlyAkTu8DL2SS7xOUXjklamxsmKxy8BhaDPIVnTPv3LQ4qbncHDzruEc0Tjda9mpQjRF/UyoDcPmxZ8TDtZ41/M5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDBhDs/4hWdo7Xkl9D+HKpniUsWS+x94jK5WqRX7PT2Pd6nmuzPWwaVIUKTbZdX3NpDxmIhnxJS6W2ohsCzadr0KNvoUgGG695L5Fn4TXtRHdBtU6zyz3v9Z2MrIHa9x3W3cNP6YJJRzZ3sGPZMdauCpWgA9xqCKT2pyzU4ikmVXcUHxhcf38akJWjrTFmdio3G4MbsZdJFBl6ID8Z6PgzOE3ppKHhVqCwkvaDzBS7RRf801+h+MsTFkRlJ2ZAjRAiDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwYQ7P+IVnaO15JfQ/hyqZ49v+wXot6G1D83jKpVRgMPvkTkIK5/Es/H6Z4d9wvrPFRdB/TofoSRMO1ykgEoUW3kPACu5/VZ1UUhAuWR1rqHNZo5I814XKveJuPHHiahjj7tVLwe28YiH1BLYCERqYZDkmvhBlGHDl+f1L5AB51cWXICRO7wMvZJLvE5ReOSVqbGyYrHLwGFoM8hWdM+/ctDipudwcPOu4RzRON1r2alCNEX9TKgNw+bFnxMO1njX8zkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMGEOz/iFZ2jteSX0P4cqmePWvkscwkkThbAEuCAOWPjzx+LzHO8PE0bcXRIXm7EX6UXQf06H6EkTDtcpIBKFFtwGknfKHjKfMcvl9rX0gGQ3WaOSPNeFyr3ibjxx4moY4+7VS8HtvGIh9QS2AhEamGQ5Jr4QZRhw5fn9S+QAedXFlyAkTu8DL2SS7xOUXjklamxsmKxy8BhaDPIVnTPv3LQ4qbncHDzruEc0Tjda9mpQjRF/UyoDcPmxZ8TDtZ41/M5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDBhDs/4hWdo7Xkl9D+HKpnjUdr6230KpmbF9lpbFaVDRY0o38bHfDXf5aWtlhRKQ7TxmIhnxJS6W2ohsCzadr0J3DM6bpdAVC/9jn4MzB51uBtU6zyz3v9Z2MrIHa9x3W3cNP6YJJRzZ3sGPZMdauCpWgA9xqCKT2pyzU4ikmVXcUHxhcf38akJWjrTFmdio3G4MbsZdJFBl6ID8Z6PgzOE3ppKHhVqCwkvaDzBS7RRf801+h+MsTFkRlJ2ZAjRAiDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwYQ7P+IVnaO15JfQ/hyqZ4FVhv8YH/lz6nRWZBNdTRxAjmyilQ/pOLAVhdD0YpHJxRdB/TofoSRMO1ykgEoUW3vT9e0UDM1GS8g466793lqtZo5I814XKveJuPHHiahjj7tVLwe28YiH1BLYCERqYZDkmvhBlGHDl+f1L5AB51cWXICRO7wMvZJLvE5ReOSVqbGyYrHLwGFoM8hWdM+/ctDipudwcPOu4RzRON1r2alCNEX9TKgNw+bFnxMO1njX8zkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMGEOz/iFZ2jteSX0P4cqmeO+FIPurWV39TO9fAxDogIurVn7mOslG/L3pivYW0ZJhUXQf06H6EkTDtcpIBKFFt0f8IyJQ53SgW8rHQ+lfXdzWaOSPNeFyr3ibjxx4moY4+7VS8HtvGIh9QS2AhEamGQ5Jr4QZRhw5fn9S+QAedXFlyAkTu8DL2SS7xOUXjklamxsmKxy8BhaDPIVnTPv3LQ4qbncHDzruEc0Tjda9mpQjRF/UyoDcPmxZ8TDtZ41/M5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDBhDs/4hWdo7Xkl9D+HKpnguTuDvPy9ImsaVpJyn+REFid/y++nJ3Ya2/cq7czD7aDxmIhnxJS6W2ohsCzadr0J5GM5/VAW3h6L8p3pH4UG3BtU6zyz3v9Z2MrIHa9x3W3cNP6YJJRzZ3sGPZMdauCpWgA9xqCKT2pyzU4ikmVXcUHxhcf38akJWjrTFmdio3G4MbsZdJFBl6ID8Z6PgzOE3ppKHhVqCwkvaDzBS7RRf801+h+MsTFkRlJ2ZAjRAiDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwYQ7P+IVnaO15JfQ/hyqZ4o8yBJ+2OB8NrfQIzA6r4Jk6vt9Xj98HmZ4/bkwr+LZE8ZiIZ8SUultqIbAs2na9C+OLDuf808buiGWxEn80CRQbVOs8s97/WdjKyB2vcd1t3DT+mCSUc2d7Bj2THWrgqVoAPcagik9qcs1OIpJlV3FB8YXH9/GpCVo60xZnYqNxuDG7GXSRQZeiA/Gej4MzhN6aSh4VagsJL2g8wUu0UX/NNfofjLExZEZSdmQI0QIgzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM


    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    I tried the recommendation given in:
    http://forums.microsoft.com/Genuine/ShowPost.aspx?PostID=2246216&SiteID=25

    and execute as administrator, during another clean start
    cscript %windir%\System32\slmgr.vbs /ilc %windir%\System32\licensing\ppdlic\Security-Licensing-SLC-ppdlic.xrm-ms

    the following message was returned:
    Microsoft Windows Script Host Version 5.7
    Copyright (C) Microsoft Corporation. All rights reserved.

    C:\Windows\System32\slmgr.vbs(391, 5) (null): 0xC004D401


    with the "0xC004D401 pop up"!!!


    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    Software Licensing Service is Automatic and Started
    SL UI Notification Service is Manual and NOT Started


    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    The Event Log shows a few of possibly related entries:

    License Activation Schedule (SLUINotify.dll) failed with the following error code:
    0xC004D401

    Windows license is invalid. Error 0xC004027. Policy value 0x00000000

    The system has been tampered.
    hr-0xC004D401

    The license consumption has failed.
    hr=0xC004D401,[3,2].


    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    Noticing the first date of Vista use (10-May-2007) and the first instance of
    License Invalid issues (11-Oct-2007), could this be related to activation of
    OEM installation which, I suspect, expired after 5 months???  I recall similar
    situation does happen to Windows 2000 Server evaluation copy at one of my
    client site!!! Acer denied such possibility.

    Sunday, October 14, 2007 10:15 AM

Answers

  • Hi all,

     

    I have not experience any of the 0xC004D401 issue since uninstalled PC Tools Firewall Plus last week. Today, I reapply Windows Update KB941651 which failed every instance before, and it got through without any error as well. It is really a combination of processes and applications that is causing this Darin's team is unable to reproduce such issues with PC Tools Firewall Plus on their Vista machine.

     

    It's due for my notebook to move on with its life Smile Good luck to everyone else here.

     

     

    Regards,

    Ng Sheaufeng

    Wednesday, October 31, 2007 12:17 PM

All replies

  • Hello Ng Sheaufeng,

     

    What's happening is  called a Tamper State. There is a program that is incompatible with Vista and when that program does something that Vista doesn't allow, Vista goes into a Non-Genuine state.

     

    There is two types of programs that cause a Tamper State

      a) A program that can be launched at any time, by the user (such as a game or application)

      b) A program that launches at Start up and that contently runs (such as an anti-virus program)

     

      The problem with pinpointing the exact program that is causing the Tamper is that the process that detects the tamper runs randomly so there isn't a clear Action=Reaction correlation. The program may start at bootup but the Tamper error may not come up for many hours, may come up immediately or might not come up at all (because the proceess that detects tampers didn't run during that Windows session).

     

      We do have 2 tools, in the Diagnostic report, to help track down the cause of the tamper.

     

    1) Is the Tamper Time Stamp (seen in the above reports as TTS) this tells us when the last tamper was detected. We would then go back (up to 3 days) and see what programs were installed during that time. Unfortunately, since the TTS shows the last time you had the tamper (not the first time it happened) If the tamper has been happening for some time, it will be more difficult to identify the time period in which the offending program was installed.

     

    2) Is the Spsys.log Content which is an encrypted .log file that is created when a tamper is detected. The Diagnostic tool transformes the encrypted binary file into that long string of text you can see at the end of the Diagnostic Report.

     

    I am currently having the group, that owns the spsys.log unencryption tool, decode the logs that you supplied and hopefully it will tell us what program is causing your issue. I believe that the fact you posted a diagnostic report from when you computer isn't and from when it is, in a tamper state, will be helpfull.

     

    I will post back when I hear back from the group that is deciphering your logs.

     

    Thank you for your patients,

    Darin Smith

    WGA Forum Manager

     

     

     

    Thursday, October 18, 2007 12:05 AM
  • Hi Darin,

     

    Here are some additional information which I think might be helpful in your diagnosis:

     

    I do not have any of the listed incompatible programs as listed on this forum installed on my system. The most likely candidates installed within one week before the first Temper State incident being PC Tools Spyware Doctor 5.1.0.272 which is part of the Google Pack; PC Tools Firewall Plus 3.0.0.36. I've removed all other program pre-installed with Acer gadgets form the startup group because one of the Support Personnel from Microsoft Malaysia Help Desk told me there are some incompatibility issue with Acer's pre-installed system backup program on some Acer machines (??).

     

    The first Temper State occurs right after I installed 5 Windows Updates on Oct 10 which you published on Oct 9:

    1) KB939653

    2) KB941202

    3) KB933729

    4) KB905866

    5) KB941651

     

    I removed all of them from Safe Mode. And reapply each of them to check. KB941651 seems failed to install every instance since. Attempt to update KB941651 and Vista will immediately goes into Temper State after reboot (reproduceable). Since this is a Windows Media Player 11 patch, fyi, I do have Media Player Classic 6.4.9.0 as part of the K-Lite Codec Pack installed and set as default for most media format.

     

    Running cscript %windir%\System32\slmgr.vbs /ilc %windir%\System32\licensing\ppdlic\Security-Licensing-SLC-ppdlic.xrm-ms under Administrator account will also immediately goes into Temper State (reproduceable).

     

    The Microsoft Malaysia Customer Service gave me a new Product Key to reactivate the Vista yesterday. However, as expected, it doesn't stop the Temper State from reoccuring.

     

    It is so embarassing to have the "Windows license is invalid" message pops up during demo to clients. Do let me know if you need any further info related to this issue. I can still tolerate this unstable state until end of Oct before I have to reformat them into an alternative open source OS Smile.

     

    Regards,

    Ng Sheaufeng

    Thursday, October 18, 2007 3:16 PM
  •  

    Hello Ng Sheaufeng,

     

      The Engineers that are working on your issue would like to know all the programs that were installed within a week of the first time you experienced the tamper state (Oct 3rd thru Oct 10th).

     

    The best way to do this is:

     

    1) Click the 'Start' button

    2) Right Click 'Computer'

    3) Select 'Manage'

    4) Continue thru the "Windows needs your permission to continue" window (if any)

    5) Click the arrow next to 'Reliability and Performance'

    6) Click the arrow next to 'Monitoring Tools'

    7) Click on 'Reliability Monitor'

    8) Click on the graph above the date 10/10/2008

    9) Below the graph, look at the report titled "Software (Un)Installs for 10/10/2007"

    10) Record any program that shows "Application Install" in the 'Activity' column.

    11) Repeat steps 8) thru 10) for each date back to 10/03/2007

     

    Thank you,

    Darin Smith

    WGA Forum Manager

    Thursday, October 18, 2007 4:11 PM
  • Hi Darin,

     

    Did the above procedures. Have 2 entries for "Application Install":

     

    10-Oct-2007 MSXML 4.0 SP2 (KB941833) 4.20.9849.0

    06-Oct-2007 Google Toolbar for Internet Explorer 4.0.0.002

     

    Application Installed not shown in the graph but appears in "Control Panel - Programs and Features":

    05-Oct-2007 AVG 7.5

    06-Oct-2007 PC Tools Firewall Plus 3.0

    06-Oct-2007 Google Updater

    08-Oct-2007 Google Earth

     

    Here are entries for "Application Uninstall" during the period:

    I uninstall the expired Norton AntiVirus trial version pre-installed with Acer to make way for AVG 7.5 above.

    05-Oct-2007

    AV
    AppCore
    LiveUpdate Notice (Symantec Corporation) 1.2.0
    MSRedist 1.0.0.0
    Norton AntiVirus 14.1.0.27
    Norton Confidential browser Component 1.1.0.6
    Norton Confidential Web Protection Component 1.1.0.6
    Norton Internet Security 10.1.0.26 (4 identical entries)
    Norton Internet Security 10.1.0 (1 entry)
    Norton Protection Center 2007.1.2.11
    SPBBC 32bit 3.1.1.4
    SymNet 7.1.0.27
    Symantec Real Time storage Protection Component 10.2.1.8
    ccCommon 106.1.1.4

     

    Also listed here entries for "System Update Install":

    10-Oct-2007
    - Security Update for Windows Vista (KB933729)
    Cumulative Security Update for Internet Explorer 7 in Windows V
    Definition Update for Windows Defender - KB15597
    Security Update for Windows Mail for Windows Vista (KB941202)
    Security Update for Windows Vista (KB933729)
    Update for Microsoft XML Core Services 4.0 Service Pack 2 (KB94...)
    Update for Windows Mail Junk E-mail Filter [October 200] (KB90...)
    Update for Windows Vista (KB941651)
    Windows Malicious Software Removal Tool - October 2007 (KB89082)

     

    Entries for Application Configuration Chage:

    10-Oct-2007
    Skype 3.5 3.5.239
    Google Toolbar for Internet Explorer 4.0.0.002


    08-Oct-2007

    Google Earth 4.2.198.2451

     

    NOTE:

    No Failure shown on the graph between 2007-09-10 to 2007-10-02 and the Reliability Index was at 8.50.

     

    Regards,

    Ng Sheaufeng

    Friday, October 19, 2007 5:43 AM
  • Hi Ng Sheaufeng,

     

      Thank you very much!

     

      The engineers on my team are very appreciative for the detailed information that you are providing. We hope to have a resolution for you as soon as possible.

     

    Thank you,
    Darin Smith
    WGA Forum Manage
    Friday, October 19, 2007 6:11 PM
  • Hi Darin,

     

    I understand it took time to solve an issue like this. However, 5 calendar days awfully long in ICT world especially when the OS keeps getting into Tamper state almost two third of the sessions now.

     

    Would appreciate at least some feedback or update from your engineer on the issue, be it:

    (a) root cause identified with permanent fix in progress;

    (b) root cause identified with temporary workaround, i.e. disable the process that causing this;

    (c) root cause identified and now finding department that is responsible to get it resolve;

    (d) able to reproduce the situation but unable to identify root cause;

    (e) unable to reproduce the situation but still working on it, thus needs more info from my end;

    (f) unable to reproduce the situation but giving up trying, therefore no feedback;

    (g) too busy to work on this issue yet because there are other bigger bugs to take care;

    (h) not working on this because it is an known issue internally;

    (i) not working on this because it's not important;

    (j) others but can't disclose to the public;

    (k) none of the above.

     

    I believed being a paid users, at least your group should acknowledged that Vista WGA is problematics and have been released before fully tested under specific situations like many have reported here.

     

    Transparency is all we request, is that so difficult? Could that be the reason why "open source" is gaining popularity day to day...?

     

    I'll still stick to my word to keep Vista until (only) end of month for the benefit of your findings and the rest who are interested to investigate and resolve the root cause.

     

    Regards,

    Ng Sheaufeng

     

    Wednesday, October 24, 2007 4:40 AM
  • Hey there,

    It might help you to know that I have the exact same problem, and I have "PC Tools Firewall Plus" installed. I installed it yesterday, the problem started today - that is what is causing it as Ng also has that installed. It basically displays when a program is trying to access the Internet. I haven't tried uninstalling it yet because I don't have the time, but that's your problem. Please email me when there's a resolution.

    Simon
    Wednesday, October 24, 2007 12:51 PM
  • Hi Simon,

     

    Appreciate your input. May I know what other programs have you installed/uninstalled for the last one week besides "PC Tools Firewall Plus"? Hopefully the best scenario is this issue is not due to combination of programs interfering with each others.

     

    I'll uninstall that program today and see if this problem goes away or not within the next week. Will let post it here my findings.

     

    Meanwhile, hope the Microsoft engineer can install this on their clean Vista and see if this problem will appear to double confirm.

     

    Regards,

    Ng Sheaufeng

    Wednesday, October 24, 2007 1:55 PM
  • Hey,

    There's not been any other programs installed in the past week or so, so we're all fine there. I'm pretty certain it's the PC Tools Firewall Plus, as when googling this error message, I found that it was caused by a product called PC Tools SpyDoctor, check out: http://blogs.zdnet.com/Bott/?p=220, search for "Error 0xc004d401". I'm that it's to do with the company PC Tools, that the problem is still in this software.

    Thanks,

    Simon
    Wednesday, October 24, 2007 2:09 PM
  • I uninstalled it, restarted and everything's working fine now. Frustrating experience to go through (losing your CP and all that), annoying it's not the first time that Vista has done this to me! But that's none of your faults... But yup, the problem was clearly with that firewall.

    Simon
    Wednesday, October 24, 2007 2:17 PM
  • Hi Simon,

     

    Few notes to make:

    (1) PC Tools Firewall Plus and PC Tools Spyware Doctor are two separate products.

     

    (2) A quick search on Internet indicate only Spyware Doctor version 3.0 has been identified as conflicting with Vista software licensing technology. It has been resolved since November 2006 with new version of Spyware Doctor. Refers to http://forums.microsoft.com/Genuine/ShowPost.aspx?PostID=897109&SiteID=25

     

    (3) I'm glad that you did not experience this issue for the time being but I would recommend giving it a few more days to a week before drawing any conclusion as this error message is too random: kindly refers to the explanation made by Darin above, which I quote

    "The problem with pinpointing the exact program that is causing the Tamper is that the process that detects the tamper runs randomly so there isn't a clear Action=Reaction correlation. The program may start at bootup but the Tamper error may not come up for many hours, may come up immediately or might not come up at all (because the proceess that detects tampers didn't run during that Windows session)."

     

    (4) If only a single program is causing it, then I'm sure it would only take 10 min for Microsoft engineers that are working on this issue to reproduce them and closed this thread.

     

    (5) Microsoft officially states that "the Tamper state is caused by conflicting of certain program with Vista software licensing technology" not without careful thought. Objectively we can read that statement as "Tamper state is cause by Vista software licensing technology that conflicting with certain programs!!!". I would agreed that when such program is identified, then it is up to Microsoft and that program vendor to decide who should give way to the other party to resolve this issue (the outcome is rather obvious); but I would not agreed to say that "the problem was clearly with that firewall" Smile

    In fact, it will be more appropriate to state similarly as KB931573 (http://support.microsoft.com/default.aspx?scid=kb;EN-US;931573) which I quote:

    Note This problem does not occur because of an issue in the installed program or device driver. This problem is caused by a system problem in Windows Vista.

     

    Regards,

    Ng Sheaufeng

     

    Wednesday, October 24, 2007 5:36 PM
  • Hello Ng Sheaufeng,

     

      I wanted to get an update from you on the status of your issue as I see you uninstalled the PC Tools Firewall Plus. I have researched that program and from the PC Tools forum, I don't see any incedents of version 3.0 of that program causing the type of issue you are seeing. I have also had my testers try to reproduce your issue given the programs you listed as installed around the time the issue surfaced, but without any success. But if uninstalling PC Tools Firewall Plus, resolves your issue then you may have pinpointed the cause or at least part of the cause (if that program was interacting with another program to cause the issue).

     

      If your issue is not resolved, I would like to set up direct communication between you and one of my Engineers. But there is only 6 days left till Nov and you had stated you would give us till then to resolve your issue or you would move to a different OS and I am unsure if the cause can be isolated, given that time frame. So it is up to you how you wish to proceed at this point.

     

    Thank you,

    Darin Smith

    WGA Forum Manager

     

     

    Thursday, October 25, 2007 10:59 PM
  • I have just purchased a Vista Business laptop, and experienced that 'Unauthorzied Change' pleasantries. I'd also just installed PC Tools Firewall Plus, which would lead me to beleive that this may be the culprit.

     

    Incidentally, I first thought it must have been an Audio Driver update, because after de-installation my problem went away for a few hours. But now that it has returned and I find this thread, I suspect the firewall.

     

    Hasn't Microsoft realised yet that this puts users in a ridiculous position? I'm an IT person by trade so troubleshooting is not an issue, but for the average user who sees 'Vista compatible' on a genuine looking website and downloads a firewall/antivirus tool, they are going to be extremely put out. This needs to be fixed quick!

     

    I am also running NOD32 Anti-virus, any reported issues with this?

     

    Friday, October 26, 2007 7:55 PM
  • Hi Darin,

     

    Thanks for following up. I have not experience the issue since uninstalled the PC Tools Firewall Plus. I would suggest this is part of the cause since your side is unable to reproduce the issue by installing this software.

     

    What I'll do is continue record down any incident until the end of month and try update that particular Windows Media Player Update (refers to my posting above) as well as run that script that brings the system immediate into Tamper State. If everything is still ok, I'll then install back PC Tools Firewall Plus to see if it reappear. Hope will obtain some useful data for your engineers to pin point the root cause and find a fix for the rest. Will update you the findings.

     

    Regards,

    Ng Sheaufeng

     

    Friday, October 26, 2007 8:18 PM
  • Hi yasslad,

     

    I believed it could be a combination of modules/processes rather then just single software that is causing this, if not Darin's engineers would have reproduced this issue easily.

     

    Audio driver might play a part of it as I'm also experience a few times of load failure of Realtek High Definition Driver during boots thought it's rather random. Another failure I noted is Microsoft Visual C++ 2005 Redistributable. Both of these and the 'Unauthorized Change' issue haven't reappear for a few days since I uninstalled PC Tools Firewall Plus. I am still monitoring my system behavior and would do a few tests as indicated above.

     

    I am an IT consultant and for the past 15 years have been providing technical supports for Microsoft server and desktop products since the MS-DOS age. The WGA technology should go through more stringent tests before it is introduce to the public in the first place. It is time consuming and costly task but "false alarms" that accused customers for being a "thief" like this would really affact customer satisfaction especially when there is no solution to it.

     

    Regards,

    Ng Sheaufeng

    Friday, October 26, 2007 8:47 PM
  • Hi all,

     

    I have not experience any of the 0xC004D401 issue since uninstalled PC Tools Firewall Plus last week. Today, I reapply Windows Update KB941651 which failed every instance before, and it got through without any error as well. It is really a combination of processes and applications that is causing this Darin's team is unable to reproduce such issues with PC Tools Firewall Plus on their Vista machine.

     

    It's due for my notebook to move on with its life Smile Good luck to everyone else here.

     

     

    Regards,

    Ng Sheaufeng

    Wednesday, October 31, 2007 12:17 PM
  • I have the 0xC004D401 Error problem after I installed Adode Acrobat 7.0 proffesional, Adobe Photoshop CS2 and Microsoft Office Enterprise 2007 at November 12.The three softwares are essential to my work,so I can not uninstall them.I have to try several times to open my notebook.It is really a headache!

    Does windows vista just happen to work?

     

     

    Wednesday, December 5, 2007 2:51 AM