"You are not running genuine Windows" False Error
-
04 Maret 2010 3:14Hello,
For the last three or so days, I have been sporadically receiving the "This computer is not running genuine windows" pop-up box, always once at start up and sometimes once or twice during the course of using the computer. My copy of Windows 7 (Home Premium) is genuine, as I had the OS pre-installed on my computer when I bought it approximately a month ago from HP. Strangely, I haven't seen any odd problems with the computer to indicate that my computer has been limited to a non-genuine state of Windows 7. After running the WGA Diagnostic Tool, my suspicion that the pop-up box was falsely stating that I was running non-genuine windows was confirmed. Below is the Diagnostic:
Diagnostic Report (1.9.0019.0):
-----------------------------------------
WGA Data-->
Validation Status: Genuine
Validation Code: 0
Cached Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-73CQT-WMF7J-3Q6C9
Windows Product Key Hash: KaFG+RmurcM3ZxzWyfEP9WtPUJw=
Windows Product ID: 00359-OEM-8992687-00010
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7600.2.00010300.0.0.003
ID: {A269FA25-CD78-4355-9EA4-C82C2230A3D5}(1)
Is Admin: Yes
TestCab: 0x0
WGA Version: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7600.win7_rtm.090713-1255
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
WGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Home and Student 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Tools\Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\sppobjs.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\sppc.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\slc.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\slcext.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\sppuinotify.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\slui.exe[6.1.7600.16385]
File Mismatch: C:\Windows\system32\sppcomapi.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\sppcommdlg.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7600.16385]
File Mismatch: C:\Windows\system32\drivers\spsys.sys[6.1.7127.0]
File Mismatch: C:\Windows\system32\drivers\spldr.sys[6.1.7127.0]
File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\en-us\user32.dll.mui[6.1.7600.16385]
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{A269FA25-CD78-4355-9EA4-C82C2230A3D5}</UGUID><Version>1.9.0019.0</Version><OS>6.1.7600.2.00010300.0.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-3Q6C9</PKey><PID>00359-OEM-8992687-00010</PID><PIDType>2</PIDType><SID>S-1-5-21-3056186110-342503174-2539134952</SID><SYSTEM><Manufacturer>HP-Pavilion</Manufacturer><Model>AZ221AV-ABA HPE-170t</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>5.07</Version><SMBIOSVersion major="2" minor="6"/><Date>20091221000000.000000+000</Date></BIOS><HWID>7DBA3607018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>2695391EABB1F10</Val><Hash>yn5Wc6VR9QC4yhVlMRz20NGVRyE=</Hash><Pid>81602-904-2895623-68987</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7600.16385
Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800010-02-1033-7600.0000-0332010
Installation ID: 008140207702747986589356800093123173912604414853903250
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: 3Q6C9
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 3/3/2010 6:45:40 PM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: 0x00000000
HealthStatus: 0x000000000001EFF0
Event Time Stamp: 3:3:2010 15:12
WAT Activex: Registered
WAT Admin Service: Registered
HWID Data-->
HWID Hash Current: LAAAAAEAAAABAAEAAQACAAAAAQABAAEAln38teRkcDLsmcQxmoj42+jUdlY=
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC HPQOEM SLIC-CPC
FACP HPQOEM SLIC-CPC
HPET HPQOEM SLIC-CPC
MCFG HPQOEM SLIC-CPC
SLIC HPQOEM SLIC-CPC
OEMB HPQOEM SLIC-CPC
GSCI HPQOEM SLIC-CPC
SSDT HPQOEM SLIC-CPC
As one can see, the report states that my OS is perfectly genuine. Is there some reason why the box is suddenly popping up now, and is there some way that I can fix this problem (if I have one) or have the box stop popping up? Also, when I scanned through the report I see that I have a lot of file mismatch errors. Might this be the reason the box is popping up?
I have read around the internet and discovered something about a KB971033 update causing this to pop up. Does this apply to my problem?
Thanks very much in advance!
Semua Balasan
-
04 Maret 2010 4:42 Under file scan data you have allot of file mismatch's not sure if that is causing your problem but many of those are part of the software protection platform. Something has changed, possibly corrupted at least some of those files. If you can think of anything that someone may have installed that would have caused this that information may prove helpful.
System file checker could help or may make things worse, the command is sfc /scannow from a dos prompt. SFC compares the files on your system and will attempt to restore them to the original, sometimes SFC can make things worse depending on what corrupted the files.
Run malwarebytes, adaware or some other antispyware program.
File Mismatch: C:\Windows\system32\sppobjs.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\sppc.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\slc.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\slcext.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\sppuinotify.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\slui.exe[6.1.7600.16385]
File Mismatch: C:\Windows\system32\sppcomapi.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\sppcommdlg.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7600.16385]
File Mismatch: C:\Windows\system32\drivers\spsys.sys[6.1.7127.0]
File Mismatch: C:\Windows\system32\drivers\spldr.sys[6.1.7127.0]
File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7600.16385]
File Mismatch: C:\Windows\system32\en-us\user32.dll.mui[6.1.7600.16385]- Ditandai sebagai Jawaban oleh Darin Smith MSOwner 04 Maret 2010 23:02
- Tanda sebagai Jawaban dihapus oleh Darin Smith MSOwner 04 Maret 2010 23:02
- Disarankan sebagai Jawaban oleh Darin Smith MSOwner 04 Maret 2010 23:02
- Ditandai sebagai Jawaban oleh Darin Smith MSOwner 05 Maret 2010 20:27
-
04 Maret 2010 6:57Thank you for the reply!
I have installed and updated MalwareBytes to the newest version, and did both a quick and thorough scan. On the quick scan, which I performed first, 4 bad entries were found, 3 of which were registry keys and another in temporary internet settings - nothing in system32. I rebooted and re-ran the the Diagnostics tool but the file mismatch entries were the same. I then ran the thorough scan, and zero infected entries were found. I rebooted and ran the Diagnostics tool but nothing changed.
Is there another anti-spyware program that I should try out, or is it that if one does not help then the others will not either? How does SFC make things worse? Does it corrupt or change the files further? Is it worth the risk? Might backing up the mismatch files fix any damage SFC does?
Also, oddly, the Genuine Windows message didn't pop up during the past two reboots. Perhaps that problem is solved, but I am still worried about the mismatches; perhaps they might harm the system in some way in the future - best to fix the mismatches just in case.
Thanks in advance! -
04 Maret 2010 13:31system file checker will attempt to restore the original files, with some malware or even legitimate programs this attempt can break things, it was meant as a note of caution but by all means, try SFC. Back up first is all I am saying.
If the problem reoccurs then let us know.
-
04 Maret 2010 23:20Hm, the "This computer is not running genuine Windows" message came back again.
I re-ran diagnostics and got the same result. I'm going to back up my stuff and run SFC, I'll update soon after I've run it.
Thanks for all the help again so far! -
05 Maret 2010 5:29SFC didn't do anything harmful or helpful. It didn't seem to pick up any of my mismatched files, either.
The genuine windows message is still popping up.
I've read around that the catroot and catroot2 folders in system32 might have something to do with this message popping up with the exact same mismatches as mine - I edited around in that folder following multiple tutorials a while ago in attempt to get a program running that had some compatibility issues with Windows 7 (which I eventually got running).
Anyhow, back on track. Is there some other method by which I can re-obtain the undamaged mismatched files?
Thanks in advance! -
05 Maret 2010 12:12If you have system protection running AND you know when you modified files in those directories AND that is what actually cased the problem AND system protection has a save point dating before that happened you can try restoring to that point. Failing that you may be looking at a reinstall. I wish I could tell you to do an upgrade re installation but you have OEM media or restoration image which means slicking the drive and starting over.
The application that you had to modify system files to run, is there any chance you can find a different program to do the same thing? -
05 Maret 2010 12:17As all those files belong to the original Windows installation, you can recover them from there. Don't you have a recovery disk or partition to do a system repair, or a system image from your first backup to restore? (Given that your OS came pre-installed, you may not have an installation disk.)
"I think there is a world market for maybe five computers.” (Thomas J. Watson, Sr.) -
05 Maret 2010 20:44System restore only reverts system files, right?
I did that about two weeks ago, and since then I have installed some programs - if I restore to a point two weeks ago, will I lose all the programs that I have installed since then?
Thanks for the input! -
06 Maret 2010 1:08I don't use system restore much but from what I remember, it will revert system changes, programs installed after the restore point but data files should remain untouched, however if you have files that reside in the applications install directory then you will want to back them up as that directory will probably be gone, files in your profile folders should be safe.
As always, back up. -
06 Maret 2010 1:39 Alrighty! I've fixed the dll's and the catroot folders and they're now gone from the mismatch list. However, two new files popped up.
File Scan Data-->
File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[7.1.7600.16395]
File Mismatch: C:\Windows\system32\wat\watux.exe[7.1.7600.16395]
Apparently these two are Windows Activation Technology stuff. You think this might harm in the long run? In any case, the Genuine Windows message no longer pops up, hasn't for the past five boots at least.
- Disarankan sebagai Jawaban oleh S. Edd 06 Maret 2010 1:43
-
06 Maret 2010 1:45Accidently clicked the propose button, fat fingers. Are you now genuine? if so uninstall the update, reboot and then reinstall it. Or just leave well enough alone if it stays genuine.
-
06 Maret 2010 1:51Yup, I'm genuine. I'll just leave it alone for now.
Thanks so much for the help! I think it's back to normal now. If anything pops up again, I'll just post in this thread. Thanks again!
