An unauthorized change was made to Windows 2

[electronicsfreak]

A computer I have been working on for some friends was infected and displaying this error when I first got it. So I loaded in safe mode, installed and did many scans. From what I can tell the system is clean now. I have ran antivir, super anti spyware, malware bytes, housecall, eusing registry cleaner, ccleaner, and hijackthis.

It seems to be clean now, but I can not get the error to go away. I have ran chkdsk /r , sfc/scannow, and also tried to reinstall sp1. The sp1 took forever, and failed. It ran into some problem on part 3 of 3 on the updates, then reverted back to how it was.

So my question is, what do I do now? I have no clue where to start next as I have researched this over and over, and none of the results I have found have helped.

Thanks

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon

 

[linney]

This next link will perhaps help you identify the problem.

Run this MGA Diagnostic Tool (as an Administrator). See what it says

http://go.microsoft.com/fwlink/?linkid=52012

In the results look for any file version mismatches such as similar but not exact to this example only.

File Scan Data-->
File Mismatch: C:\Windows\system32\Slsvc.exe[6.0.6000.16509]
File Mismatch: C:\Windows\system32\uxtheme.dll[6.0.6000.16386]


"An unauthorized change was made to windows"

http://www.howtogeek.com/forum/topic/an-unauthorized-change-was-made-to-windows

Have a look at these too.

http://www.google.com.au/search?q=A...&ie=&oe=&redir_esc=&ei=rZPUS_OUAY7g7APHivC_Dw

 

[electronicsfreak]

I am new to his program, and have looked it up and down. I can not find where you see if it shows file mis matches. Also, I can not run the program as admin in normal mode, as I do not have an option to do so. See, when you load up in normal mode, it gives you the error I showed you. You do not see a start menu or anything, just that error.

Will this work the same in safe mode?

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon

 

[linney]

Are you saying that nothing loads on that machine in Normal Mode, no Desktop, nothing?

You can try Safe Mode and right-clicking on MGA.exe or whatever it is called and selecting the Run As Administrator option. There is a report generated after that program is run.

I think though you have gone past the mismatched file problems and might be better off saving your valuable data and reinstalling Vista.

You could try SP1 once more, then SP2 if successful. You might have to stop all other running programs, especially security type realtime scanners, and non-Microsoft Services. Also remove any easily removed attached hardware. You might get it in in a clean environment.

How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7

http://support.microsoft.com/default.aspx/kb/929135

Startup Repair.

Startup Repair is a Windows recovery tool that can fix certain problems, such as missing or damaged system files, that might prevent Windows from starting.

http://windowshelp.microsoft.com/Wi...809f-ed90-415f-a83f-89b42108b3551033.mspx#EFF

Startup Repair: frequently asked questions

http://windowshelp.microsoft.com/Windows/en-US/Help/5c59f8c1-b0d1-4f1a-af55-74f3922f3f351033.mspx

After that it is time to do a clean install or a restore to the factory defaults if it is an OEM machine.

 

[goombawaho]

Start PC and get into Startup Repair area. System File Checker

 

[electronicsfreak]

Well I tried those, and it did not work. Also tried system restore, not any available according to vista. So later today, I am going to see if the seperate partition has a restore point. As the computer did not come with a system restore cd lol.

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon

 

[linney]

Check the manufacturer's web site for the model of PC in question. Any such recovery partition you mention will probably need to be accessed at boot time via a key combination (which might be displayed on the first boot screen or in the manual).

Recovery disc

http://en.wikipedia.org/wiki/Recovery_disc

 

[electronicsfreak]

Well I found a restore on the partition they created, but apparently they have a trap setup on it, ironically, that traps their own software. As I got this message

"
Your system has detected a configuration error. Please report this error to Customer Care using the phone number found in the Warranty and Support Guide that came with your PC. Unless corrected, this error will prevent your PC from operating properly. Turn off your PC by pressing and holding the Power button. After a few seconds your PC will automatically turn off. (Code Purple)"

I then did some research and came across this. You have got to be kidding me.

http://forums.techguy.org/windows-xp/469752-code-purple-configuration-error-hp.html

Any suggestions?

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon

 

[linney]

Tying your original error of "An unauthorized change was made to Windows" with the later Code Purple error, has there been any major hardware (motherboard) changes made to that machine?

The link you supplied seems to included possible workarounds sprinkled throughout. Have you tried any of them?

Maybe something like this will get you access to the inner sanctum?

You might be able to make use of BartPE (a mini XP self contained on a bootable CD and run from CD).

http://www.nu2.nu/pebuilder/

 

[electronicsfreak]

No work has been done to the hardware to my knowledge. I do have bartpe and ubcd4win as well. Have not tried that but I will later on, just can't believe this much work is having to go into a reinstall of windows lol. I really am starting to dislike compaq/hp even more now.

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon

 

[goombawaho]

What about this link:

http://www.billoblog.com/?p=152

 

[electronicsfreak]

Well, found the file, deleted it, and now I am somewhat installing vista. First time I used typical settings, it bsod. Then I tried only important updates, it locked up.

I am really starting to hate this computer lol.

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon

 

[electronicsfreak]

Told it to ignore the updates, I would do themselves, and now I am in windows. Finally lol.

Thanks for all the help

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon

 

[electronicsfreak]

Think I am about to tell them to ship this thing back to hp. It keeps locking up, and now I just discovered its saying the product key is invalid.

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon

 

[electronicsfreak]

Reentered the key, working now. Never had this much trouble with a computer

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon