Answered by:
Unauthorized Change Error

Question
-
I am getting a error that says I made an unauthorized change and that I need to validate my software. No matter what I do I can't past this error in normal mode. I can start up in safe mode so I tried system restore but that didn't work. I also tried running chkdsk but it won't run on the restart - just goes back to the unauthorized change error. So as recommended, I used the dianostics tool as recommended and got the following results:
Diagnostic Report (1.7.0066.0):
-----------------------------------------
WGA Data-->
Validation Status: Genuine
Validation Code: 0
Online Validation Code: 0x80070426
Cached Validation Code: N/A, hr = 0x80070426
Windows Product Key: *****-*****-F4GJK-KG77H-B9HD2
Windows Product Key Hash: iJAth4TbScMi8HdcPurlASXdEkw=
Windows Product ID: 89578-OEM-7332157-00204
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.0.6000.2.00010300.0.0.003
CSVLK Server: N/A
CSVLK PID: N/A
ID: {A7CB6B45-DB37-404F-A1DB-9D942B567AD9}(3)
Is Admin: Yes
TestCab: 0x0
WGA Version: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows Vista (TM) Home Premium
Architecture: 0x00000000
Build lab: 6000.vista_gdr.071009-1548
TTS Error: M:20080206111338766-
Validation Diagnostic:
Resolution Status: N/A
Notifications Data-->
Cached Result: N/A
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 114 Blocked VLK 2
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: FCEE394C-2989-80070002_025D1FF3-282-80041010_025D1FF3-170-80041010_025D1FF3-171-1_025D1FF3-434-80040154_025D1FF3-178-80040154_025D1FF3-179-2_025D1FF3-185-80070002_025D1FF3-199-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\slc.dll[6.0.6000.16509]
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{A7CB6B45-DB37-404F-A1DB-9D942B567AD9}</UGUID><Version>1.7.0066.0</Version><OS>6.0.6000.2.00010300.0.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-B9HD2</PKey><PID>89578-OEM-7332157-00204</PID><PIDType>2</PIDType><SID>S-1-5-21-706533677-1619551204-2822485649</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron 1420 </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A00</Version><SMBIOSVersion major="2" minor="4"/><Date>20070523000000.000000+000</Date></BIOS><HWID>34323507018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Mountain Standard Time(GMT-07:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL </OEMID><OEMTableID>M08 </OEMTableID></OEM><BRT/></MachineData><Software><Office><Result>114</Result><Products><Product GUID="{90280409-6000-11D3-8CFE-0050048383C9}"><LegitResult>114</LegitResult><Name>Microsoft Office XP Professional with FrontPage</Name><Ver>10</Ver><Val>39476F84C4B4004</Val><Hash>4iCnywwNW1w4s9ukTIwGMGxyGic=</Hash><Pid>54185-640-0000025-17694</Pid><PidType>14</PidType></Product></Products></Office></Software></GenuineResults>
Spsys.log Content: U1BMRwEAAAAAAQAABAAAAHQHAAAAAAAAYWECADAgAACcpduUbVbIAdArSr9MLECc5R83cvYPeMx5747TPEcpYFEr9ileC7Gkg1d10IzUHkBt7UGM6
Thanks for your help.Wednesday, February 6, 2008 9:32 PM
Answers
-
Hi LSewill,
I see two problems.
Problem #1: the error code: 0x80070426 tells me that the Software Licensing service has been stopped. Vista uses this service to check itself to confirm it's Genuine. If the service isn't running, Vista can't self check and will throw errors. To restart the service, you can follow the below steps (before you follow these steps, see Problem #2):
If you have acces to the Start button:
1) Click the Start button
2) Type: cmd in the Start Search field
3) At the top the Start window, you will see cmd.exe
4) Right Click cmd.exe and select Run as Administrator
5) Type: net start slsvc
If you do not have access to the Start button:
1) Click the option that launches an Internet Browser
2) A Browser will open, type: %windir%\system32 into the address field
3) Find the file cmd.exe
4) Right Click on the cmd.exe and select Run as Administrator
5) Type: net start slsvc
Problem #2: The Diagnostic Report also shows that you have an On Disk Mod-Auth Tamper. On Disk Mod-Auth tamper is when a Critical System file (located on your hard drive) has been Tampered with (i.e. modified) or corrupted. There is another type of Mod-Auth called a In Memory Mode-Auth. The In Memory type is when an Incompatible Program tried to hook/shim (i.e. modify) critical system files resident in memeory (the actual on disk files are unaffected).
In your situation, the On Disk Tamper has been done to the file "slc.dll" (build number 6.0.6000.16509). I am unsure how this file was modified or became corrupt, but we need to fix it before you can fix Problem #1.
Now you will notice that I said that file slc.dll build number 6.0.6000.16509 is the file that has been modified/corrupted. The Build Number, that I mentioned, is kind of like a file version number. Each time a file is updated (usually thru Windows Update) the file that was updated get a new build number. Because of this, I know that the last update that was applyed to file slc.dll was Update KB933928. I am NOT saying this update caused the problem, I am only saying that the file was modified/corupted during of after KB933928 was applyed.
So why do we care about what Update updated file slc.dll to build number 6.0.6000.16509? Because to fix your issue, we need to re-install this update so an Unmodified/Uncorrupted slc.dll (build number 6.0.6000.16509) will replace the modified/corrupted one.
Unfortunately, most Vista updates, once they are installed, can not be re-installed. If you try you will usually get the error "This update does not appy to your system". Therefore, we need to uninstall update KB933928 and then re-install it to fix your issue.
To uninstall Update KB933928, you need to:
1) Login to Vista in Safe Mode
2) Once in Safe Mode, go to the Control Panel
3) In the Control Panel find and double-click on "Programs and Features"
4) In the Programs and Features window, click "View installed updates" (it will be located under "Tasks" on the upper left hand side of the window)
5) The list of installed updates may take a long time to load.
6) Once the list loads, find the update with (KB933928) after the name.
7) Right-click that it and select "Uninstall"
8) Once the update uninstalls, reboot back into Normal Mode.
To reinstall Update KB933928, you need to:
1) Click the option that launches an Internet Browser
3) Click the "Download" button
4) You will be asked if you want to Open or Save the file..select Open
5) Some other windows will pop-up, click Allow and/or Continue on these windows.
6) Once the update has installed, reboot (I suggest rebooting 2 times to ensure the Mod-Auth state has cleared)
Your Mode-Auth problem should be fixed, but you will still be in a Non-Genuine state because of Problem #1. At this point, follow the steps above for restarting the Software Licensing service. If you have any problems (or receive any errors) following my steps to fix the Mod-auth or restarting the service, please create a (No Cost) support request at http://go.microsoft.com/fwlink/?linkid=52029 for additional assistance.
Thank you,
Darin Smith
WGA Forum Manager
Wednesday, February 6, 2008 10:52 PM
All replies
-
Hi LSewill,
I see two problems.
Problem #1: the error code: 0x80070426 tells me that the Software Licensing service has been stopped. Vista uses this service to check itself to confirm it's Genuine. If the service isn't running, Vista can't self check and will throw errors. To restart the service, you can follow the below steps (before you follow these steps, see Problem #2):
If you have acces to the Start button:
1) Click the Start button
2) Type: cmd in the Start Search field
3) At the top the Start window, you will see cmd.exe
4) Right Click cmd.exe and select Run as Administrator
5) Type: net start slsvc
If you do not have access to the Start button:
1) Click the option that launches an Internet Browser
2) A Browser will open, type: %windir%\system32 into the address field
3) Find the file cmd.exe
4) Right Click on the cmd.exe and select Run as Administrator
5) Type: net start slsvc
Problem #2: The Diagnostic Report also shows that you have an On Disk Mod-Auth Tamper. On Disk Mod-Auth tamper is when a Critical System file (located on your hard drive) has been Tampered with (i.e. modified) or corrupted. There is another type of Mod-Auth called a In Memory Mode-Auth. The In Memory type is when an Incompatible Program tried to hook/shim (i.e. modify) critical system files resident in memeory (the actual on disk files are unaffected).
In your situation, the On Disk Tamper has been done to the file "slc.dll" (build number 6.0.6000.16509). I am unsure how this file was modified or became corrupt, but we need to fix it before you can fix Problem #1.
Now you will notice that I said that file slc.dll build number 6.0.6000.16509 is the file that has been modified/corrupted. The Build Number, that I mentioned, is kind of like a file version number. Each time a file is updated (usually thru Windows Update) the file that was updated get a new build number. Because of this, I know that the last update that was applyed to file slc.dll was Update KB933928. I am NOT saying this update caused the problem, I am only saying that the file was modified/corupted during of after KB933928 was applyed.
So why do we care about what Update updated file slc.dll to build number 6.0.6000.16509? Because to fix your issue, we need to re-install this update so an Unmodified/Uncorrupted slc.dll (build number 6.0.6000.16509) will replace the modified/corrupted one.
Unfortunately, most Vista updates, once they are installed, can not be re-installed. If you try you will usually get the error "This update does not appy to your system". Therefore, we need to uninstall update KB933928 and then re-install it to fix your issue.
To uninstall Update KB933928, you need to:
1) Login to Vista in Safe Mode
2) Once in Safe Mode, go to the Control Panel
3) In the Control Panel find and double-click on "Programs and Features"
4) In the Programs and Features window, click "View installed updates" (it will be located under "Tasks" on the upper left hand side of the window)
5) The list of installed updates may take a long time to load.
6) Once the list loads, find the update with (KB933928) after the name.
7) Right-click that it and select "Uninstall"
8) Once the update uninstalls, reboot back into Normal Mode.
To reinstall Update KB933928, you need to:
1) Click the option that launches an Internet Browser
3) Click the "Download" button
4) You will be asked if you want to Open or Save the file..select Open
5) Some other windows will pop-up, click Allow and/or Continue on these windows.
6) Once the update has installed, reboot (I suggest rebooting 2 times to ensure the Mod-Auth state has cleared)
Your Mode-Auth problem should be fixed, but you will still be in a Non-Genuine state because of Problem #1. At this point, follow the steps above for restarting the Software Licensing service. If you have any problems (or receive any errors) following my steps to fix the Mod-auth or restarting the service, please create a (No Cost) support request at http://go.microsoft.com/fwlink/?linkid=52029 for additional assistance.
Thank you,
Darin Smith
WGA Forum Manager
Wednesday, February 6, 2008 10:52 PM -
Thank you!
This fixed the problem and my computer is functioning normally once again.Sunday, February 10, 2008 2:58 AM