0x8c000247 error intermitent with MSE and Windows update

All Replies

• Sunday, April 29, 2012 9:31 AM

  Moderator

   

   
  

  0
  "DavidMos" wrote in message news:c84f25a7-3cf2-48bb-b8c6-748537b63757...

  4/25/2012 MSE automatically downloaded updates, 4/26 and today (4/28) no so (4/27 was travel day).

  MGA tool reports the following (note: not thrilled with the report of tampered files):

  Diagnostic Report (1.9.0027.0):
  -----------------------------------------
  Windows Validation Data-->

  Validation Code: 0x8004FE21
  Cached Online Validation Code: 0x0
  Windows Product Key: *****-*****-J3QHX-WVKMY-CJ7CM
  Windows Product Key Hash: VxcWXURotzWaG2X1Q0Wsk4poI1M=
  Windows Product ID: 00426-066-0289995-86963
  Windows Product ID Type: 5
  Windows License Type: Retail
  Windows OS version: 6.1.7601.2.00010100.1.0.001
  

  File Scan Data-->
  File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[7.1.7600.16395], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\wat\watux.exe[7.1.7600.16395], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\sppobjs.dll[6.1.7601.17514], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\sppc.dll[6.1.7601.17514], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\slc.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\slcext.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppuinotify.dll[6.1.7600.16385], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\slui.exe[6.1.7601.17514], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\sppcomapi.dll[6.1.7601.17514], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppcommdlg.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7601.17514], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\drivers\spsys.sys[6.1.7127.0], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\drivers\spldr.sys[6.1.7127.0], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7601.17514], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\user32.dll[6.1.7601.17514], Hr = 0x800b0100

  Other data-->
  SYSTEM><Manufacturer>LENOVO</Manufacturer><Model>64577WU</Model></SYSTEM><BIOS><Manufacturer>LENOVO</Manufacturer><Version>7LETC6WW (2.26 )</Version><SMBIOSVersion major="2" minor="4"/><Date>20090511000000.000000+000</Date></BIOS

  Licensing Data-->
  Software licensing service version: 6.1.7601.17514

  Name: Windows(R) 7, Ultimate edition
  Description: Windows Operating System - Windows(R) 7, RETAIL channel
  Partial Product Key: CJ7CM
  License Status: Licensed
  Remaining Windows rearm count: 5
  Trusted time: 4/29/2012 2:22:17 AM

  Windows Activation Technologies-->
  HrOffline: 0x8004FE21
  HrOnline: N/A
  HealthStatus: 0x000000000001EFF0
  Event Time Stamp: 2:4:2012 18:21
  ActiveX: Registered, Version: 7.1.7600.16395
  Admin Service: Registered, Version: 7.1.7600.16395
  HealthStatus Bitmask Output:
  Tampered File: %systemroot%\system32\sppobjs.dll
  Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
  Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
  Tampered File: %systemroot%\system32\sppwinob.dll
  Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
  Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
  Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
  Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
  Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
  Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
  Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
  Tampered File: %systemroot%\system32\drivers\spsys.sys

  OEM Activation 2.0 Data-->
  BIOS valid for OA 2.0: yes
  Windows marker version: 0x0
  

  As you correctly divined, the problem lies with the tampered files.

  This may simply be caused by a bad set of Intel Rapid Storage Technology drivers -

  Installing the Intel Rapid Storage Drivers

  try downloading and installing them from here -

  http://downloadcenter.intel.com/Detail_Desc.aspx?ProductID=2101&DwnldID=20624

  Once complete, please reboot twice, then post another MGADiag report.

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
  

  • Edited by Noel D PatonMicrosoft Community Contributor, Moderator Sunday, April 29, 2012 8:01 PM
  •  
  • Reply
  • Quote

   
• Sunday, April 29, 2012 7:49 PM

   

   
  

  0

  "DavidMos" wrote in message news:c84f25a7-3cf2-48bb-b8c6-748537b63757...

  4/25/2012 MSE automatically downloaded updates, 4/26 and today (4/28) no so (4/27 was travel day).

  MGA tool reports the following (note: not thrilled with the report of tampered files):

  Diagnostic Report (1.9.0027.0):
  -----------------------------------------
  Windows Validation Data-->

  Validation Code: 0x8004FE21
  Cached Online Validation Code: 0x0
  Windows Product Key: *****-*****-J3QHX-WVKMY-CJ7CM
  Windows Product Key Hash: VxcWXURotzWaG2X1Q0Wsk4poI1M=
  Windows Product ID: 00426-066-0289995-86963
  Windows Product ID Type: 5
  Windows License Type: Retail
  Windows OS version: 6.1.7601.2.00010100.1.0.001
  ID: {B0A676A8-1E3E-4AFD-A882-026C3FCE6189}(1)
  Is Admin: Yes
  TestCab: 0x0
  LegitcheckControl ActiveX: N/A, hr = 0x80070002
  Signed By: N/A, hr = 0x80070002
  Product Name: Windows 7 Ultimate
  Architecture: 0x00000009
  Build lab: 7601.win7sp1_gdr.110622-1506
  TTS Error:
  Validation Diagnostic:
  Resolution Status: N/A

  Vista WgaER Data-->
  ThreatID(s): N/A, hr = 0x80070002
  Version: N/A, hr = 0x80070002

  Windows XP Notifications Data-->
  Cached Result: N/A, hr = 0x80070002
  File Exists: No
  Version: N/A, hr = 0x80070002
  WgaTray.exe Signed By: N/A, hr = 0x80070002
  WgaLogon.dll Signed By: N/A, hr = 0x80070002

  OGA Notifications Data-->
  Cached Result: N/A, hr = 0x80070002
  Version: N/A, hr = 0x80070002
  OGAExec.exe Signed By: N/A, hr = 0x80070002
  OGAAddin.dll Signed By: N/A, hr = 0x80070002

  OGA Data-->
  Office Status: 109 N/A
  OGA Version: N/A, 0x80070002
  Signed By: N/A, hr = 0x80070002
  Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

  Browser Data-->
  Proxy settings: N/A
  User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
  Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  Download signed ActiveX controls: Prompt
  Download unsigned ActiveX controls: Disabled
  Run ActiveX controls and plug-ins: Allowed
  Initialize and script ActiveX controls not marked as safe: Disabled
  Allow scripting of Internet Explorer Webbrowser control: Disabled
  Active scripting: Allowed
  Script ActiveX controls marked as safe for scripting: Allowed

  File Scan Data-->
  File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[7.1.7600.16395], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\wat\watux.exe[7.1.7600.16395], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\sppobjs.dll[6.1.7601.17514], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\sppc.dll[6.1.7601.17514], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\slc.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\slcext.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppuinotify.dll[6.1.7600.16385], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\slui.exe[6.1.7601.17514], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\sppcomapi.dll[6.1.7601.17514], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppcommdlg.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7601.17514], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\drivers\spsys.sys[6.1.7127.0], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\drivers\spldr.sys[6.1.7127.0], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7601.17514], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\user32.dll[6.1.7601.17514], Hr = 0x800b0100

  Other data-->
  SYSTEM><Manufacturer>LENOVO</Manufacturer><Model>64577WU</Model></SYSTEM><BIOS><Manufacturer>LENOVO</Manufacturer><Version>7LETC6WW (2.26 )</Version><SMBIOSVersion major="2" minor="4"/><Date>20090511000000.000000+000</Date></BIOS

  Licensing Data-->
  Software licensing service version: 6.1.7601.17514

  Name: Windows(R) 7, Ultimate edition
  Description: Windows Operating System - Windows(R) 7, RETAIL channel
  Partial Product Key: CJ7CM
  License Status: Licensed
  Remaining Windows rearm count: 5
  Trusted time: 4/29/2012 2:22:17 AM

  Windows Activation Technologies-->
  HrOffline: 0x8004FE21
  HrOnline: N/A
  HealthStatus: 0x000000000001EFF0
  Event Time Stamp: 2:4:2012 18:21
  ActiveX: Registered, Version: 7.1.7600.16395
  Admin Service: Registered, Version: 7.1.7600.16395
  HealthStatus Bitmask Output:
  Tampered File: %systemroot%\system32\sppobjs.dll
  Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
  Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
  Tampered File: %systemroot%\system32\sppwinob.dll
  Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
  Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
  Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
  Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
  Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
  Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
  Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
  Tampered File: %systemroot%\system32\drivers\spsys.sys

  OEM Activation 2.0 Data-->
  BIOS valid for OA 2.0: yes
  Windows marker version: 0x0
  

  As you correctly divined, the problem lies with the tampered files.

  This may simply be caused by a bad set of Intel Rapid Storage Technology drivers -

  Installing the Intel Rapid Storage Drivers

  try downloading and installing them from here -

  http://downloadcenter.intel.com/Detail_Desc.aspx?ProductID=2101&DwnldID=20624

  Once complete, please reboot twice, then post another MGADiag report.

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  Thank you for your response. The Intel RSD software did not install (system doesn't meet minimum requirements). Also now getting the message that the computer is not running genuine Windows -- nice to know after 4+ years. Not!

  Frustrating!

  
  

  • Edited by DavidMos Sunday, April 29, 2012 7:50 PM
  •  
  • Reply
  • Quote

   
• Sunday, April 29, 2012 8:00 PM

  Moderator

   

   
  

  0

  The message is because of the errors. As far as I can tell your system is otherwise OK

  we'll have to look elsewhere for the problem.

  please run the following commands from an Elevated Command Prompt
  window

  NET START CRYPTSVC

  SC QUERYEX CRYPTSVC

  SC QC CRYPTSVC

  copy and paste the results in your response

  Here are some instructions to maike life easier
  :)

  1) To open an Elevated Command Prompt Window
  (the CP window), click on Start, All Programs, Accessories – then right-click on
  Command Prompt, and select Run as Administrator. Accept the UAC
  prompt.

  2) To run the commands easier, highlight the
  block of commands, and right-click on the highlight – select Copy. In the CP
  Windows, click on the black/white icon at top left – select Paste. The commands
  will run but may not complete the last command, so hit the Enter Key
  once.

  3) To copy the results... click on the
  Black/White icon in the top left, and select Edit... 'Select All', and hit the
  Enter key - then use Ctrl+V or r-click+Paste to paste it into your
  response.

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  • Reply
  • Quote

   
• Monday, April 30, 2012 3:33 AM

   

   
  

  0

  The message is because of the errors. As far as I can tell your system is otherwise OK

  we'll have to look elsewhere for the problem.

  please run the following commands from an Elevated Command Prompt
  window

  NET START CRYPTSVC

  SC QUERYEX CRYPTSVC

  SC QC CRYPTSVC

  copy and paste the results in your response

  Here are some instructions to maike life easier
  :)

  1) To open an Elevated Command Prompt Window
  (the CP window), click on Start, All Programs, Accessories – then right-click on
  Command Prompt, and select Run as Administrator. Accept the UAC
  prompt.

  2) To run the commands easier, highlight the
  block of commands, and right-click on the highlight – select Copy. In the CP
  Windows, click on the black/white icon at top left – select Paste. The commands
  will run but may not complete the last command, so hit the Enter Key
  once.

  3) To copy the results... click on the
  Black/White icon in the top left, and select Edit... 'Select All', and hit the
  Enter key - then use Ctrl+V or r-click+Paste to paste it into your
  response.

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  Per your request:

  C:\users\david>NET START CRYPTSVC
  The requested service has already been started.

  More help is available by typing NET HELPMSG 2182.

  
  C:\users\david>SC QUERYEX CRYPTSVC

  SERVICE_NAME: CRYPTSVC
          TYPE               : 20  WIN32_SHARE_PROCESS
          STATE              : 4  RUNNING
                                  (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
          WIN32_EXIT_CODE    : 0  (0x0)
          SERVICE_EXIT_CODE  : 0  (0x0)
          CHECKPOINT         : 0x0
          WAIT_HINT          : 0x0
          PID                : 1548
          FLAGS              :

  C:\users\david>SC QC CRYPTSVC
  [SC] QueryServiceConfig SUCCESS

  SERVICE_NAME: CRYPTSVC
          TYPE               : 20  WIN32_SHARE_PROCESS
          START_TYPE         : 2   AUTO_START
          ERROR_CONTROL      : 1   NORMAL
          BINARY_PATH_NAME   : C:\Windows\system32\svchost.exe -k NetworkService
          LOAD_ORDER_GROUP   :
          TAG                : 0
          DISPLAY_NAME       : Cryptographic Services
          DEPENDENCIES       : RpcSs
          SERVICE_START_NAME : NT Authority\NetworkService

  • Reply
  • Quote

   
• Monday, April 30, 2012 7:25 AM

  Moderator

   

   
  

  0
  "DavidMos" wrote in message news:0e9637b9-6418-4f29-b448-2b7d3223daad...

   

  C:\users\david>NET START CRYPTSVC
  The requested service has already been started.

  More help is available by typing NET HELPMSG 2182.

  
   

  That all looks normal -  which means that we're unlikely to be able to solve this in these forums without a considerable amount of poking around in the OS.

  I would suggest that you contact MS WGA Support for assistance - they have tools available that we don't, to help.

   

  WGA Support can be found here-

  North America: http://support.microsoft.com/contactus/cu_sc_genadv_master?ws=support&ws=support#tab4
  
  Outside North America:
  http://support.microsoft.com/contactus/?ws=support#tab0
  
  Please let us know if (and how) MS manage to repair the problem without a repair install of the OS - it would be useful for future reference!

   

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  • Marked As Answer by Darin Smith MSOwner Tuesday, May 01, 2012 9:20 PM
  •  
  • Reply
  • Quote

   
• Monday, April 30, 2012 2:34 PM

   

   
  

  0

  "DavidMos" wrote in message news:0e9637b9-6418-4f29-b448-2b7d3223daad...

  C:\users\david>NET START CRYPTSVC
  The requested service has already been started.

  More help is available by typing NET HELPMSG 2182.

  
   

  That all looks normal -  which means that we're unlikely to be able to solve this in these forums without a considerable amount of poking around in the OS.

  I would suggest that you contact MS WGA Support for assistance - they have tools available that we don't, to help.

  WGA Support can be found here-

  North America: http://support.microsoft.com/contactus/cu_sc_genadv_master?ws=support&ws=support#tab4
  
  Outside North America:
  http://support.microsoft.com/contactus/?ws=support#tab0
  
  Please let us know if (and how) MS manage to repair the problem without a repair install of the OS - it would be useful for future reference!

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  
  Been going down the rabbit hole of phone support for over an hour, with no one conversation with any individual lasting more than about 8 to 10 minutes and still no joy. Everyone says basically the same thing, it's genuine. They did ask what the WindowsKey+Pause/Break (same as Computer right-click->Properties). Windows activation at the bottom shows that Windows is activated... and round and round we go... :-(
  

  • Edited by DavidMos Monday, April 30, 2012 2:35 PM
  •  
  • Reply
  • Quote

   
• Monday, April 30, 2012 8:35 PM

  Moderator

   

   
  

  0
  Point them at this thread - that may help them to focus on your problem, rather than their script :)

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  • Reply
  • Quote