Answered by:
Windows 7 MSDN License is now flagged as 'Not Genuine'?

Question
-
I am running a copy of Windows 7 Enterprise and it is licensed under my MSDN batch of serials. I have always formatted, wiped, re-installed etc as this is testing and that is why I use MSDN of course. Today I was notified by my Microsoft Security Essentials program that my license was not genuine and it is now not actively working. Below is the copied results from your MGA diagnostic tool. Please let me know how to stop this from happening as i run a dozen computers testing our software and such against MS products and this exposes us to uneeded risk etc.
Cheers
Rob
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-*****-*****-VXHVY
Windows Product Key Hash: QETmohtjSqS3fkqcvqoX+ScvnDU=
Windows Product ID: 55041-049-9703797-86530
Windows Product ID Type: 6
Windows License Type: Volume MAK
Windows OS version: 6.1.7600.2.00010100.0.0.027
ID: {5C02CFAF-71C1-4934-B06F-E8D9656CC050}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Enterprise N
Architecture: 0x00000009
Build lab: 7600.win7_gdr.100618-1621
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Professional Plus 2007 - 100 Genuine
Microsoft Office Project Professional 2007 - 100 Genuine
Microsoft Office Visio Professional 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{5C02CFAF-71C1-4934-B06F-E8D9656CC050}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7600.2.00010100.0.0.027</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-BBBBB</PKey><PID>55041-049-9703797-86530</PID><PIDType>6</PIDType><SID>S-1-5-21-2805888825-2369365217-3523256480</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Precision WorkStation T7400 </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A04</Version><SMBIOSVersion major="2" minor="5"/><Date>20080821000000.000000+000</Date></BIOS><HWID>F6BA3607018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Mountain Standard Time(GMT-07:00)</TimeZone><iJoin>1</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL </OEMID><OEMTableID>B9K </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90120000-0011-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Professional Plus 2007</Name><Ver>12</Ver><Val>C0A25836FDBE5AC</Val><Hash>FmDbcrRY1pTOcrz4ZUZRHhpUuc0=</Hash><Pid>89409-726-2958074-65479</Pid><PidType>14</PidType></Product><Product GUID="{90120000-003B-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Project Professional 2007</Name><Ver>12</Ver><Val>3AB862DE70D8D86</Val><Hash>UfpXsJvSSVcPufbDdjd0NK73+ug=</Hash><Pid>89403-707-4159871-63932</Pid><PidType>14</PidType></Product><Product GUID="{90120000-0051-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Visio Professional 2007</Name><Ver>12</Ver><Val>3AB862DE70D8D86</Val><Hash>UfpXsJvSSVcPufbDdjd0NK73+ug=</Hash><Pid>89405-707-4159871-63179</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="3A" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="53" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7600.16385
Name: Windows(R) 7, EnterpriseN edition
Description: Windows Operating System - Windows(R) 7, VOLUME_MAK channel
Activation ID: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 55041-00172-049-970379-03-1033-7600.0000-0072011
Installation ID: 010210083224331645674820665002414693688954801520672840
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: VXHVY
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 1/20/2011 9:17:42 AM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x000000000003EFFF
Event Time Stamp: 1:7:2011 17:10
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\wat\watadminsvc.exe
Tampered File: %systemroot%\system32\wat\watweb.dll
Tampered File: %systemroot%\system32\wat\npwatweb.dll
Tampered File: %systemroot%\system32\wat\watux.exe
Tampered File: %systemroot%\system32\sppobjs.dll
Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
Tampered File: %systemroot%\system32\sppwinob.dll
Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
Tampered File: %systemroot%\system32\drivers\spsys.sys
Tampered File: %systemroot%\system32\drivers\spldr.sys
HWID Data-->
HWID Hash Current: NAAAAAEABAABAAEAAQAAAAAAAwABAAEA6GEwKM5tHJCKd6hpckN+l7Jc7oysmpTiSMVMWA==
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x0
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC DELL B9K
FACP DELL B9K
HPET DELL B9K
BOOT DELL B9K
MCFG DELL B9K
SSDT DELL st_ex
ASF! DELL B9K
____ DELL B9K
SLIC DELL B9K
Thursday, January 20, 2011 4:34 PM
Answers
-
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x000000000003EFFF
Event Time Stamp: 1:7:2011 17:10
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\wat\watadminsvc.exe
Tampered File: %systemroot%\system32\wat\watweb.dll
Tampered File: %systemroot%\system32\wat\npwatweb.dll
Tampered File: %systemroot%\system32\wat\watux.exe
Tampered File: %systemroot%\system32\sppobjs.dll
Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
Tampered File: %systemroot%\system32\sppwinob.dll
Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
Tampered File: %systemroot%\system32\drivers\spsys.sys
Tampered File: %systemroot%\system32\drivers\spldr.sysHello
The above portion of the Diagnostic Report tells me that there are a number of files who's Hash does not match with what is listed in Windows 7's System Catalog. This means these files have been modified in some way.
The first things I suggest are to repair or restore the files.
a. System Scan. The scan will look for bad Windows files and will attempt to repair them, if possible.
(Note: the error "HrOffline: 0x8004FE21" means Windows has already tried a "Selfheal" but was unsuccessful so when doing the below sfc /scannow, it is likely that the result will be that it found corrupt files but was unable to repair).
1) Click the Start Button
2) Type: cmd.exe
3) Right-click the cmd.exe file and select 'Run as Administrator'
4) In the CMD window, type: sfc /scannow
5) Reboot and see if that resolves the issue.
b. Restore files using System Restore:
1) Click the Start button
2) In the Start Search field, type: System Restore and hit “Enter”
3) Select "Choose Different Restore Point", Put a check in the box that says "Show restore points older than 5 days", select the restore point that corresponds to the date Before you first noticed the issue.
4) Click the "Next" button.
5) Reboot and see if that resolves the issue.If neither of those resolved the issue, I have a few (more dramatic) options that you can try:
c. Replace the effected files with copies from a known good installation of Windows. (I am told that it is also possible to extract copies of the files from the Windows installation disk or image, but I don't have any directions on how to do this).
d. Contact Microsoft Assisted Support for further assistance with the issue.
North America: http://support.microsoft.com/contactus/cu_sc_genadv_master?ws=support&ws=support#tab4
Outside North America:
http://support.microsoft.com/contactus/?ws=support#tab0e. Reinstall Windows.
I hope this was helpful,
Darin MS- Proposed as answer by Darin Smith MS Thursday, January 20, 2011 11:30 PM
- Marked as answer by Darin Smith MS Friday, January 21, 2011 8:56 PM
Thursday, January 20, 2011 11:30 PM
All replies
-
"ParallaxIT" wrote in message news:040813e5-3409-4c84-b062-ae6788284e33...
I am running a copy of Windows 7 Enterprise and it is licensed under my MSDN batch of serials. I have always formatted, wiped, re-installed etc as this is testing and that is why I use MSDN of course. Today I was notified by my Microsoft Security Essentials program that my license was not genuine and it is now not actively working. Below is the copied results from your MGA diagnostic tool. Please let me know how to stop this from happening as i run a dozen computers testing our software and such against MS products and this exposes us to uneeded risk etc.
Cheers
Rob
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-*****-*****-VXHVY
Windows Product Key Hash: QETmohtjSqS3fkqcvqoX+ScvnDU=
Windows Product ID: 55041-049-9703797-86530
Windows Product ID Type: 6
Windows License Type: Volume MAK
Windows OS version: 6.1.7600.2.00010100.0.0.027
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Professional Plus 2007 - 100 Genuine
Microsoft Office Project Professional 2007 - 100 Genuine
Microsoft Office Visio Professional 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005
Licensing Data-->
Software licensing service version: 6.1.7600.16385
Name: Windows(R) 7, EnterpriseN edition
Description: Windows Operating System - Windows(R) 7, VOLUME_MAK channel
Partial Product Key: VXHVY
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 1/20/2011 9:17:42 AM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x000000000003EFFF
Event Time Stamp: 1:7:2011 17:10
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\wat\watadminsvc.exe
Tampered File: %systemroot%\system32\wat\watweb.dll
Tampered File: %systemroot%\system32\wat\npwatweb.dll
Tampered File: %systemroot%\system32\wat\watux.exe
Tampered File: %systemroot%\system32\sppobjs.dll
Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
Tampered File: %systemroot%\system32\sppwinob.dll
Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
Tampered File: %systemroot%\system32\drivers\spsys.sys
Tampered File: %systemroot%\system32\drivers\spldr.sys
This is not a normal MSDN license Key - its an MAK license. (although I know there was some discussion about MAK's when I was an MSDN member, I thought it had been abandoned - I may be wrong!)Having said that, your problem is the number of tampered files present - which is surprising, in that one would normally expect to see the same files (more or less) listed as Mismatches.I therefore suspect that you have a malware infestation - do you have any suspicion of the same?I suggest installing Malwarebytes Anti-Malware (www.malwarebytes.org ) - update it and run a full system scan (which will also force your AV to look at every file, so update that as well) see if it finds anything.Once complete reboot, and run a new MGADiag report - this time please do not remove any data - what's in the report is of no use to anyone except MS (who can then check that your license is actually valid, and should therefore activate and validate OK - but they still cannot tie it down to a given machine)
--
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothThursday, January 20, 2011 11:21 PMModerator -
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x000000000003EFFF
Event Time Stamp: 1:7:2011 17:10
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\wat\watadminsvc.exe
Tampered File: %systemroot%\system32\wat\watweb.dll
Tampered File: %systemroot%\system32\wat\npwatweb.dll
Tampered File: %systemroot%\system32\wat\watux.exe
Tampered File: %systemroot%\system32\sppobjs.dll
Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
Tampered File: %systemroot%\system32\sppwinob.dll
Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
Tampered File: %systemroot%\system32\drivers\spsys.sys
Tampered File: %systemroot%\system32\drivers\spldr.sysHello
The above portion of the Diagnostic Report tells me that there are a number of files who's Hash does not match with what is listed in Windows 7's System Catalog. This means these files have been modified in some way.
The first things I suggest are to repair or restore the files.
a. System Scan. The scan will look for bad Windows files and will attempt to repair them, if possible.
(Note: the error "HrOffline: 0x8004FE21" means Windows has already tried a "Selfheal" but was unsuccessful so when doing the below sfc /scannow, it is likely that the result will be that it found corrupt files but was unable to repair).
1) Click the Start Button
2) Type: cmd.exe
3) Right-click the cmd.exe file and select 'Run as Administrator'
4) In the CMD window, type: sfc /scannow
5) Reboot and see if that resolves the issue.
b. Restore files using System Restore:
1) Click the Start button
2) In the Start Search field, type: System Restore and hit “Enter”
3) Select "Choose Different Restore Point", Put a check in the box that says "Show restore points older than 5 days", select the restore point that corresponds to the date Before you first noticed the issue.
4) Click the "Next" button.
5) Reboot and see if that resolves the issue.If neither of those resolved the issue, I have a few (more dramatic) options that you can try:
c. Replace the effected files with copies from a known good installation of Windows. (I am told that it is also possible to extract copies of the files from the Windows installation disk or image, but I don't have any directions on how to do this).
d. Contact Microsoft Assisted Support for further assistance with the issue.
North America: http://support.microsoft.com/contactus/cu_sc_genadv_master?ws=support&ws=support#tab4
Outside North America:
http://support.microsoft.com/contactus/?ws=support#tab0e. Reinstall Windows.
I hope this was helpful,
Darin MS- Proposed as answer by Darin Smith MS Thursday, January 20, 2011 11:30 PM
- Marked as answer by Darin Smith MS Friday, January 21, 2011 8:56 PM
Thursday, January 20, 2011 11:30 PM -
Same today with Windows 7 Home PremiumSunday, January 27, 2013 2:07 AM
-
Please start a NEW thread of your own, and include an MGADiag report.
To properly analyse and solve problems with Activation and Validation, we need to see a full copy of the report produced by the MGADiag tool
(download and save to desktop - http://go.microsoft.com/fwlink/?linkid=52012 )
Once saved, run the tool.
Click on the Continue button, which will produce the report.
To copy the report to your response, click on the Copy button in the tool (ignore any error messages at this point), and then paste (using either r-click/Paste, or Ctrl+V ) into your response.
- **in your own thread**, please
Please also state the Version and Edition of Windows quoted on your COA sticker (if you have one) on the case of your machine (or inside the battery compartment), but do NOT quote the Key on the sticker!
http://www.microsoft.com/en-us/howtotell/Hardware.aspxNoel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
No - I do not work for Microsoft, or any of its contractors.Sunday, January 27, 2013 9:53 AMModerator