Answered by:
An unauthorized changed was made to Windows Vista
Question
-
I recently started to get this message whenever Windows is started. I did not install new software recently, apart from F-secure when I discovered the PC got a virus. F-secure got rid of the Trojan virus.
The error code of the Windows Vista Genuine Validation is [0xC004D401]
The log of the diagnostic utility is below.
Thank you
Diagnostic Report (1.7.0110.1):
-----------------------------------------
WGA Data-->
Validation Status: Invalid License
Validation Code: 50
Online Validation Code: 0xc004d401
Cached Validation Code: N/A, hr = 0xc004d401
Windows Product Key: *****-*****-9TX8Y-WD3YK-Q2CHC
Windows Product Key Hash: 0EdCgMB30bdZIt298toEFkylFvo=
Windows Product ID: 89578-OEM-7304115-60019
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.0.6001.2.00010300.1.0.003
ID: {86E50911-1336-4ECE-9D4E-565F2CBA84F7}(3)
Is Admin: Yes
TestCab: 0x0
WGA Version: Registered, 1.5.723.1
Signed By: Microsoft
Product Name: Windows Vista (TM) Home Premium
Architecture: 0x00000000
Build lab: 6001.vistasp1_gdr.080917-1612
TTS Error: K:20090123202106284-M:20090123220249761-
Validation Diagnostic:
Resolution Status: N/A
WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: 6.0.6002.16398
WGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
WGATray.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 77F760FE-153-80070002_7E90FEE8-203-80070002_025D1FF3-282-80041010_025D1FF3-170-80041010_025D1FF3-171-1_025D1FF3-434-80040154_025D1FF3-178-80040154_025D1FF3-179-2_025D1FF3-185-80070002_025D1FF3-199-3_FA827CE6-153-8007007e_FA827CE6-180-8007007e
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
Default Browser: E:\Program Files\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{86E50911-1336-4ECE-9D4E-565F2CBA84F7}</UGUID><Version>1.7.0110.1</Version><OS>6.0.6001.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-Q2CHC</PKey><PID>89578-OEM-7304115-60019</PID><PIDType>3</PIDType><SID>S-1-5-21-617159096-642253877-2751888035</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>0107 </Version><SMBIOSVersion major="2" minor="3"/><Date>20060802000000.000000+000</Date></BIOS><HWID>F6333507018400EA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>W. Europe Standard Time(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><BRT/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Spsys.log Content: U1BMRwEAAAAAAQAABAAAANIwIwAAAAAAWmICAARQuYWupncYGHTJAW4aG1/FHasdtBRBPRnxqCJX3fOw8gqJOijkI20V6loXiqrroyx39r3HkvkXjiKrw0z+IC6+DkVoY5YIOIKjUKb2WsBZYbIZJJLJezdT4XiJM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAxuGhtfxR2rHbQUQT0Z8agiV93zsPIKiToo5CNtFepaF5o7Ft4p4RNC3k4bQBbxIPJM/iAuvg5FaGOWCDiCo1Cm9lrAWWGyGSSSyXs3U+F4iTOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMbhobX8Udqx20FEE9GfGoIvgonqxmUaen/eUOwzy8Lcj8sIfxzTqFeTjSkUYl47xAsaRLV4kJJwIufDMuL0p/TvZawFlhshkkksl7N1PheIkzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDG4aG1/FHasdtBRBPRnxqCL4KJ6sZlGnp/3lDsM8vC3IRf6dtGGouoBoaqB5w40XMbGkS1eJCScCLnwzLi9Kf072WsBZYbIZJJLJezdT4XiJM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAxuGhtfxR2rHbQUQT0Z8agib6hrscCqQcW1byaC8WerfVZcvChoXDrE+mFp9BL7em7L8caA5dk82PKz8vYItEi79lrAWWGyGSSSyXs3U+F4iTOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMbhobX8Udqx20FEE9GfGoImYu631LkjphPrjKAe1KSSLWoyf2ObjYgtrfjzi0gA5s1o7/74cnEv66AHwGls3SA/ZawFlhshkkksl7N1PheIkzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDG4aG1/FHasdtBRBPRnxqCLbnNmceOlVPX4AQgvcwQofyPIVg28X9fFaFRxu3d0XQ+tsdMhBTjTLt4UKLzl75Db2WsBZYbIZJJLJezdT4XiJM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAxuGhtfxR2rHbQUQT0Z8agi25zZnHjpVT1+AEIL3MEKH8jyFYNvF/XxWhUcbt3dF0PrbHTIQU40y7eFCi85e+Q29lrAWWGyGSSSyXs3U+F4iTOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMbhobX8Udqx20FEE9GfGoIl08n6JaQM6kO21WaF4tCbvtWcLsH21z9LCtR+ka6zCtVa0vT7+OB2muM3q/15VusPZawFlhshkkksl7N1PheIkzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDG4aG1/FHasdtBRBPRnxqCKTFnskMGDjGQfr/8KThTV3aUe2g1ksBnwz4/3Y9ze30ldIqRmDxwJh41yyn8ssp6D2WsBZYbIZJJLJezdT4XiJM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAxuGhtfxR2rHbQUQT0Z8agiT5wZfJplJt7OhsuP57CbCQ3xd2vVoJeHle+BvayC74XxoTsh+9TQlAOdstFgySq/9lrAWWGyGSSSyXs3U+F4iTOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMbhobX8Udqx20FEE9GfGoIqvHJB6fe2sIciWF+vxx3l7aSWBWA3D0OrjfsfMcQ7V/wqluzVa+8Fum/86d0EQ9PPZawFlhshkkksl7N1PheIkzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDG4aG1/FHasdtBRBPRnxqCKrxyQen3trCHIlhfr8cd5e2klgVgNw9Dq437HzHEO1f8Kpbs1WvvBbpv/OndBEPTz2WsBZYbIZJJLJezdT4XiJM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAxuGhtfxR2rHbQUQT0Z8agiXq4MJB20SWUPj6tqpActffq9/AsN+DFQ+cHe5jOsqw1M/iAuvg5FaGOWCDiCo1Cm9lrAWWGyGSSSyXs3U+F4iTOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMbhobX8Udqx20FEE9GfGoIuzwoQtgYi5CL9O+ducBYo+668J6Y28gnM9Ms4WhSjjosaRLV4kJJwIufDMuL0p/TvZawFlhshkkksl7N1PheIkzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDG4aG1/FHasdtBRBPRnxqCIguzNs5z+o3wH8/E/PEwTp+PlCJcn10EJqRK8IKSNqGiayuzSeq5VM/KCbdghq6Lf2WsBZYbIZJJLJezdT4XiJM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAxuGhtfxR2rHbQUQT0Z8agiILszbOc/qN8B/PxPzxME6R1j9BIpsodBuqZP6yw5G5Amsrs0nquVTPygm3YIaui39lrAWWGyGSSSyXs3U+F4iTOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMbhobX8Udqx20FEE9GfGoIo+roiX7JM8IiJCI4Q7HsK26bZTUcw2ZQ1pyxUfOn1hJNtYPsd46L41lFuX81J2ajPZawFlhshkkksl7N1PheIkzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDG4aG1/FHasdtBRBPRnxqCKPq6Il+yTPCIiQiOEOx7Ctum2U1HMNmUNacsVHzp9YSTbWD7HeOi+NZRbl/NSdmoz2WsBZYbIZJJLJezdT4XiJM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAxuGhtfxR2rHbQUQT0Z8agiNJO5Pa1BQsXLG4Aiy4kxYhE3XtHee1UcubKhA6ZJklS+oBjo3NN/kUo6VEiSo6ol9lrAWWGyGSSSyXs3U+F4iTOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMbhobX8Udqx20FEE9GfGoIrk2ye3RnKN8oJVabFaiw4ZpXBKoV+g2g+ixyZBNLQxDvWbrGAy1LiPnzgV2mQGVG/ZawFlhshkkksl7N1PheIkzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDG4aG1/FHasdtBRBPRnxqCIamCAMgI7zmCY5dKa5XaY6NyH/kMCOZRfEg4PJfmlAaP2chyBFv/5UZUEfjWdbdOT2WsBZYbIZJJLJezdT4XiJM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAxuGhtfxR2rHbQUQT0Z8agiIMSdgn7ae1s3qEiZlJiD0gKWEA/FapdwPhlISarYtSWdy/QXzlsfGBChcwvsiseH9lrAWWGyGSSSyXs3U+F4iTOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMbhobX8Udqx20FEE9GfGoIozU9Sy3M3635dkN0GrzO0F5laLYE67nH+N8cQnAKHhTTCXlaFR3SfXd2I56arYwVvZawFlhshkkksl7N1PheIkzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWg
Licensing Data-->
C:\Windows\system32\slmgr.vbs(1634, 5) (null): 0xC004D401
HWID Data-->
HWID Hash Current: PAAAAAEABgABAAEAAQADAAAAAgABAAEAnJ+yTT4c9v2Yk1r/qnZI5HQm3Aqu5/L0rNrYTRMM9EesViqF
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC A M I OEMAPIC
FACP A M I OEMFACP
MCFG A M I OEMMCFG
OEMB A M I AMI_OEMFriday, January 23, 2009 9:30 PM
Answers
-
Hello pierocol,
Your issue is, what we call, an In Memory Mod-Auth Tamper. It is caused by a program that is incompatible with Vista. The program is attempting to access parts of Vista that the OS does not allow.
Regardless if you have recently installed any programs or not, there is a program (Viruses and Trojans are programs too) that is attempting to access parts of Vista that the OS does not allow. It is that incompatible program which is causing your issue.
The key to fixing the issue is to identify the offending program and remove or update it (to a compatible version).
It sounds like you have already researched the forum, for this error and you probably have already seen the steps I am providing below, but I have included them anyways, just in case.
In addition to the below steps, if you believe the issue is being caused by a incompatible Virus or Trojan, I encourage you to call our PC Safety line. PC Safety is a Microsoft group that provides free support for malware related infections.
-----------
Below I have provided a number of steps to help you identify the program that is causing the tamper:
First, go to http://support.microsoft.com/kb/931699/ and confirm that you do not have any of the programs known to cause this type of issue.
Second, in your Diagnostic report above, you can see the line that starts with 'TTS Error:' followed by a bunch numbers: M:xxxxxxxxxxxxxxxxx- This is the Tamper Time Stamp and it breaks down like this:(year) (month) (day) (time in 24format) (millisecond)
M:2009 01 23 2202 49761-
Note, I also see a "K" type Tamper Time Stamp. The “K“ stands for Kernel Mode tamper. This is a minor tamper and is most likey directly related to the Mod-Auth tamper. Once you remove the program that is causing the Mod-Auth tamper, I believe that the Kernel mode tamper will stop as well.
Now that you know the time of the tamper, you can now try to connect that time with a program.1) Login to Vista and select the option that launches an Internet Browser
2) Type into the browser address bar: %windir%\system32\perfmon.msc and hit Enter
3) When asked if you want to Open or Save this file, select Open
4) In the left hand panel, click Reliability Monitor
5) Click on the “System Stability Chart” above the date 01/23
6) Below the chart, in the “System Stability Report” section look at the report titled "Software (Un)Installs for 01/23/2009"
7) Look for any program that shows "Application Install" in the 'Activity' column.
8) Since the process that detects Tampers runs randomly, it can take up to 3 days for the process to detect the tamper and set Vista to a Tamper State. Because of this, please repeat steps 5) thru 7) for the dates 01/22/2009, 01/21/2009 and 01/20/2009
This could tell you what programs were installed on or around the Tamper date and should help you narrow down the possible programs that could be causing the issue . Unfortunately, if you installed the programsome point in the past, but hadn't run it till now, this process may not be helpful. The removal of any application you may have installed recently could go a long way to troubleshooting this issues.
Note: Since everyone has different programs installed on their computer, it is extremely hard for support to figure out what program is causing the problem, but if you still need assistance in identifying the Incompatible Program, please create a no cost support request at http://go.microsoft.com/fwlink/?linkid=52029
Darin MS
Attention Forum All Users: Please Do Not post your issue in someone else's Thread...Create your own.- Edited by Darin Smith MS Friday, January 23, 2009 10:41 PM spelling
- Marked as answer by Darin Smith MS Friday, January 23, 2009 10:43 PM
Friday, January 23, 2009 10:37 PM -
Thank you,
I browsed around the PC safety website and I found out about the OneCare Safety scanner. I did it and it found some other virus, which, once eliminated, actually solved the validation issue!
I am left with one minor problem now. The virus did something to my registry I guess and I am not able to change the desktop background anymore. If I try I get the message: "This feature has been disabled. Contact our system Administrator". But I AM the system administrator I did not find out what to do in order to change things back to their original state. CAn you help me further?
Thank you
- Marked as answer by Darin Smith MS Monday, February 2, 2009 11:27 PM
Monday, February 2, 2009 12:29 PM
All replies
-
Hello pierocol,
Your issue is, what we call, an In Memory Mod-Auth Tamper. It is caused by a program that is incompatible with Vista. The program is attempting to access parts of Vista that the OS does not allow.
Regardless if you have recently installed any programs or not, there is a program (Viruses and Trojans are programs too) that is attempting to access parts of Vista that the OS does not allow. It is that incompatible program which is causing your issue.
The key to fixing the issue is to identify the offending program and remove or update it (to a compatible version).
It sounds like you have already researched the forum, for this error and you probably have already seen the steps I am providing below, but I have included them anyways, just in case.
In addition to the below steps, if you believe the issue is being caused by a incompatible Virus or Trojan, I encourage you to call our PC Safety line. PC Safety is a Microsoft group that provides free support for malware related infections.
-----------
Below I have provided a number of steps to help you identify the program that is causing the tamper:
First, go to http://support.microsoft.com/kb/931699/ and confirm that you do not have any of the programs known to cause this type of issue.
Second, in your Diagnostic report above, you can see the line that starts with 'TTS Error:' followed by a bunch numbers: M:xxxxxxxxxxxxxxxxx- This is the Tamper Time Stamp and it breaks down like this:(year) (month) (day) (time in 24format) (millisecond)
M:2009 01 23 2202 49761-
Note, I also see a "K" type Tamper Time Stamp. The “K“ stands for Kernel Mode tamper. This is a minor tamper and is most likey directly related to the Mod-Auth tamper. Once you remove the program that is causing the Mod-Auth tamper, I believe that the Kernel mode tamper will stop as well.
Now that you know the time of the tamper, you can now try to connect that time with a program.1) Login to Vista and select the option that launches an Internet Browser
2) Type into the browser address bar: %windir%\system32\perfmon.msc and hit Enter
3) When asked if you want to Open or Save this file, select Open
4) In the left hand panel, click Reliability Monitor
5) Click on the “System Stability Chart” above the date 01/23
6) Below the chart, in the “System Stability Report” section look at the report titled "Software (Un)Installs for 01/23/2009"
7) Look for any program that shows "Application Install" in the 'Activity' column.
8) Since the process that detects Tampers runs randomly, it can take up to 3 days for the process to detect the tamper and set Vista to a Tamper State. Because of this, please repeat steps 5) thru 7) for the dates 01/22/2009, 01/21/2009 and 01/20/2009
This could tell you what programs were installed on or around the Tamper date and should help you narrow down the possible programs that could be causing the issue . Unfortunately, if you installed the programsome point in the past, but hadn't run it till now, this process may not be helpful. The removal of any application you may have installed recently could go a long way to troubleshooting this issues.
Note: Since everyone has different programs installed on their computer, it is extremely hard for support to figure out what program is causing the problem, but if you still need assistance in identifying the Incompatible Program, please create a no cost support request at http://go.microsoft.com/fwlink/?linkid=52029
Darin MS
Attention Forum All Users: Please Do Not post your issue in someone else's Thread...Create your own.- Edited by Darin Smith MS Friday, January 23, 2009 10:41 PM spelling
- Marked as answer by Darin Smith MS Friday, January 23, 2009 10:43 PM
Friday, January 23, 2009 10:37 PM -
Thank you,
I did as you suggested. The System Stability report shows that I did not install any program lately. It seems to me that it is more of a Trojan or other virus program.
My understanding is the PC Safety line is available in the US. I am in the Netherlands. Unfortunately I don't understand Dutch very well so I am not able to understand if such a service is available here as well on MS pages in Dutch.
Can you maybe help me further?
Saturday, January 24, 2009 3:18 PM -
Hi pierocol,
I talked to the PC Safety manager that sits by me and he knows there is a PC Safety line for Europe, but was unsure about Netherland coverage. He suggests that instead of a phone call, try the PC Safety Online Chat. Go to http://www.microsoft.com/protect/support/default.mspx and follow the "E-mail or individual chat support" link. (if you are asked to select your country, I suggest selecting US or the closest english speaking county)
Good luck,
Darin MS
Attention Forum All Users: Please Do Not post your issue in someone else's Thread...Create your own.- Edited by Darin Smith MS Tuesday, January 27, 2009 1:23 AM correct spelling
Tuesday, January 27, 2009 1:23 AM -
Thank you,
I browsed around the PC safety website and I found out about the OneCare Safety scanner. I did it and it found some other virus, which, once eliminated, actually solved the validation issue!
I am left with one minor problem now. The virus did something to my registry I guess and I am not able to change the desktop background anymore. If I try I get the message: "This feature has been disabled. Contact our system Administrator". But I AM the system administrator I did not find out what to do in order to change things back to their original state. CAn you help me further?
Thank you
- Marked as answer by Darin Smith MS Monday, February 2, 2009 11:27 PM
Monday, February 2, 2009 12:29 PM -
Hi pierocol,
Very happy to have been helpful in resolving your issue.
As for the secondary problem, that's really outside my area of knowledge. I can suggest describing the issue in one of the Vista newgroups at http://www.microsoft.com/windowsxp/expertzone/newsgroups/reader.mspx and see if anyone has a helpful suggestion, or going to http://support.microsoft.com for additional support options.
Darin MS
Attention Forum All Users: Please Do Not post your issue in someone else's Thread...Create your own.Monday, February 2, 2009 11:25 PM
