locked
Windows 7 MSDN License is now flagged as 'Not Genuine'? RRS feed

  • Question

  • I am running a copy of Windows 7 Enterprise and it is licensed under my MSDN batch of serials. I have always formatted, wiped, re-installed etc as this is testing and that is why I use MSDN of course. Today I was notified by my Microsoft Security Essentials program that my license was not genuine and it is now not actively working. Below is the copied results from your MGA diagnostic tool. Please let me know how to stop this from happening as i run a dozen computers testing our software and such against MS products and this exposes us to uneeded risk etc.

    Cheers

     

    Rob

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-*****-*****-VXHVY
    Windows Product Key Hash: QETmohtjSqS3fkqcvqoX+ScvnDU=
    Windows Product ID: 55041-049-9703797-86530
    Windows Product ID Type: 6
    Windows License Type: Volume MAK
    Windows OS version: 6.1.7600.2.00010100.0.0.027
    ID: {5C02CFAF-71C1-4934-B06F-E8D9656CC050}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Enterprise N
    Architecture: 0x00000009
    Build lab: 7600.win7_gdr.100618-1621
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Professional Plus 2007 - 100 Genuine
    Microsoft Office Project Professional 2007 - 100 Genuine
    Microsoft Office Visio Professional 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{5C02CFAF-71C1-4934-B06F-E8D9656CC050}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7600.2.00010100.0.0.027</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-BBBBB</PKey><PID>55041-049-9703797-86530</PID><PIDType>6</PIDType><SID>S-1-5-21-2805888825-2369365217-3523256480</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Precision WorkStation T7400  </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A04</Version><SMBIOSVersion major="2" minor="5"/><Date>20080821000000.000000+000</Date></BIOS><HWID>F6BA3607018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Mountain Standard Time(GMT-07:00)</TimeZone><iJoin>1</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>B9K    </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90120000-0011-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Professional Plus 2007</Name><Ver>12</Ver><Val>C0A25836FDBE5AC</Val><Hash>FmDbcrRY1pTOcrz4ZUZRHhpUuc0=</Hash><Pid>89409-726-2958074-65479</Pid><PidType>14</PidType></Product><Product GUID="{90120000-003B-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Project Professional 2007</Name><Ver>12</Ver><Val>3AB862DE70D8D86</Val><Hash>UfpXsJvSSVcPufbDdjd0NK73+ug=</Hash><Pid>89403-707-4159871-63932</Pid><PidType>14</PidType></Product><Product GUID="{90120000-0051-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Visio Professional 2007</Name><Ver>12</Ver><Val>3AB862DE70D8D86</Val><Hash>UfpXsJvSSVcPufbDdjd0NK73+ug=</Hash><Pid>89405-707-4159871-63179</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="3A" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="53" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7600.16385

    Name: Windows(R) 7, EnterpriseN edition
    Description: Windows Operating System - Windows(R) 7, VOLUME_MAK channel
    Activation ID: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 55041-00172-049-970379-03-1033-7600.0000-0072011
    Installation ID: 010210083224331645674820665002414693688954801520672840
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: VXHVY
    License Status: Licensed
    Remaining Windows rearm count: 3
    Trusted time: 1/20/2011 9:17:42 AM

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x000000000003EFFF
    Event Time Stamp: 1:7:2011 17:10
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\wat\watadminsvc.exe
    Tampered File: %systemroot%\system32\wat\watweb.dll
    Tampered File: %systemroot%\system32\wat\npwatweb.dll
    Tampered File: %systemroot%\system32\wat\watux.exe
    Tampered File: %systemroot%\system32\sppobjs.dll
    Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
    Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
    Tampered File: %systemroot%\system32\sppwinob.dll
    Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
    Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
    Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
    Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
    Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
    Tampered File: %systemroot%\system32\drivers\spsys.sys
    Tampered File: %systemroot%\system32\drivers\spldr.sys


    HWID Data-->
    HWID Hash Current: NAAAAAEABAABAAEAAQAAAAAAAwABAAEA6GEwKM5tHJCKd6hpckN+l7Jc7oysmpTiSMVMWA==

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x0
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            DELL          B9K   
      FACP            DELL          B9K   
      HPET            DELL          B9K   
      BOOT            DELL          B9K   
      MCFG            DELL          B9K   
      SSDT            DELL        st_ex
      ASF!            DELL          B9K   
      ____            DELL          B9K   
      SLIC            DELL          B9K   


    Thursday, January 20, 2011 4:34 PM

Answers

  • Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x000000000003EFFF
    Event Time Stamp: 1:7:2011 17:10
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\wat\watadminsvc.exe
    Tampered File: %systemroot%\system32\wat\watweb.dll
    Tampered File: %systemroot%\system32\wat\npwatweb.dll
    Tampered File: %systemroot%\system32\wat\watux.exe
    Tampered File: %systemroot%\system32\sppobjs.dll
    Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
    Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
    Tampered File: %systemroot%\system32\sppwinob.dll
    Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
    Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
    Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
    Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
    Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
    Tampered File: %systemroot%\system32\drivers\spsys.sys
    Tampered File: %systemroot%\system32\drivers\spldr.sys

    Hello

    The above portion of the Diagnostic Report tells me that there are a number of files who's Hash does not match with what is listed in Windows 7's System Catalog. This means these files have been modified in some way.

     

    The first things I suggest are to repair or restore the files.

    a. System Scan. The scan will look for bad Windows files and will attempt to repair them, if possible.

    (Note: the error "HrOffline: 0x8004FE21" means Windows has already tried a "Selfheal" but was unsuccessful so when doing the below sfc /scannow, it is likely that the result will be that it found corrupt files but was unable to repair).

    1) Click the Start Button
    2) Type: cmd.exe
    3) Right-click the cmd.exe file and select 'Run as Administrator'
    4) In the CMD window, type: sfc /scannow
    5) Reboot and see if that resolves the issue.



    b. Restore files using System Restore:

    1) Click the Start button
    2) In the Start Search field, type: System Restore and hit “Enter”
    3) Select "Choose Different Restore Point", Put a check in the box that says "Show restore points older than 5 days", select the restore point that corresponds to the date Before you first noticed the issue.
    4) Click the "Next" button.
    5) Reboot and see if that resolves the issue.

     

    If neither of those resolved the issue, I have a few (more dramatic) options that you can try:

    c. Replace the effected files with copies from a known good installation of Windows. (I am told that it is also possible to extract copies of the files from the Windows installation disk or image, but I don't have any directions on how to do this).

     

    d. Contact Microsoft Assisted Support for further assistance with the issue.

    North America: http://support.microsoft.com/contactus/cu_sc_genadv_master?ws=support&ws=support#tab4

    Outside North America:
    http://support.microsoft.com/contactus/?ws=support#tab0

     

    e. Reinstall Windows.

     

    I hope this was helpful,

     


    Darin MS
    • Proposed as answer by Darin Smith MS Thursday, January 20, 2011 11:30 PM
    • Marked as answer by Darin Smith MS Friday, January 21, 2011 8:56 PM
    Thursday, January 20, 2011 11:30 PM

All replies

  • "ParallaxIT" wrote in message news:040813e5-3409-4c84-b062-ae6788284e33...

    I am running a copy of Windows 7 Enterprise and it is licensed under my MSDN batch of serials. I have always formatted, wiped, re-installed etc as this is testing and that is why I use MSDN of course. Today I was notified by my Microsoft Security Essentials program that my license was not genuine and it is now not actively working. Below is the copied results from your MGA diagnostic tool. Please let me know how to stop this from happening as i run a dozen computers testing our software and such against MS products and this exposes us to uneeded risk etc.

    Cheers

     

    Rob

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-*****-*****-VXHVY
    Windows Product Key Hash: QETmohtjSqS3fkqcvqoX+ScvnDU=
    Windows Product ID: 55041-049-9703797-86530
    Windows Product ID Type: 6
    Windows License Type: Volume MAK
    Windows OS version: 6.1.7600.2.00010100.0.0.027

    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Professional Plus 2007 - 100 Genuine
    Microsoft Office Project Professional 2007 - 100 Genuine
    Microsoft Office Visio Professional 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005


    Licensing Data-->
    Software licensing service version: 6.1.7600.16385

    Name: Windows(R) 7, EnterpriseN edition
    Description: Windows Operating System - Windows(R) 7, VOLUME_MAK channel
    Partial Product Key: VXHVY
    License Status: Licensed
    Remaining Windows rearm count: 3
    Trusted time: 1/20/2011 9:17:42 AM

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x000000000003EFFF
    Event Time Stamp: 1:7:2011 17:10
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\wat\watadminsvc.exe
    Tampered File: %systemroot%\system32\wat\watweb.dll
    Tampered File: %systemroot%\system32\wat\npwatweb.dll
    Tampered File: %systemroot%\system32\wat\watux.exe
    Tampered File: %systemroot%\system32\sppobjs.dll
    Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
    Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
    Tampered File: %systemroot%\system32\sppwinob.dll
    Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
    Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
    Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
    Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
    Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
    Tampered File: %systemroot%\system32\drivers\spsys.sys
    Tampered File: %systemroot%\system32\drivers\spldr.sys




    This is not a normal MSDN license Key  - its an MAK license. (although I know there was some discussion about MAK's when I was an MSDN member, I thought it had been abandoned - I may be wrong!)
     
    Having said that, your problem is the number of tampered files present - which is surprising, in that one would normally expect to see the same files (more or less) listed as Mismatches.
    I therefore suspect that you have a malware infestation - do you have any suspicion of the same?
    I suggest installing Malwarebytes Anti-Malware (www.malwarebytes.org ) - update it and run a full system scan (which will also force your AV to look at every file, so update that as well) see if it finds anything.
     
    Once complete reboot, and run a new MGADiag report - this time please do not remove any data - what's in the report is of no use to anyone except MS (who can then check that your license is actually valid, and should therefore activate and validate OK - but they still cannot tie it down to a given machine)
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Thursday, January 20, 2011 11:21 PM
    Moderator
  • Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x000000000003EFFF
    Event Time Stamp: 1:7:2011 17:10
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\wat\watadminsvc.exe
    Tampered File: %systemroot%\system32\wat\watweb.dll
    Tampered File: %systemroot%\system32\wat\npwatweb.dll
    Tampered File: %systemroot%\system32\wat\watux.exe
    Tampered File: %systemroot%\system32\sppobjs.dll
    Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
    Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
    Tampered File: %systemroot%\system32\sppwinob.dll
    Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
    Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
    Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
    Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
    Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
    Tampered File: %systemroot%\system32\drivers\spsys.sys
    Tampered File: %systemroot%\system32\drivers\spldr.sys

    Hello

    The above portion of the Diagnostic Report tells me that there are a number of files who's Hash does not match with what is listed in Windows 7's System Catalog. This means these files have been modified in some way.

     

    The first things I suggest are to repair or restore the files.

    a. System Scan. The scan will look for bad Windows files and will attempt to repair them, if possible.

    (Note: the error "HrOffline: 0x8004FE21" means Windows has already tried a "Selfheal" but was unsuccessful so when doing the below sfc /scannow, it is likely that the result will be that it found corrupt files but was unable to repair).

    1) Click the Start Button
    2) Type: cmd.exe
    3) Right-click the cmd.exe file and select 'Run as Administrator'
    4) In the CMD window, type: sfc /scannow
    5) Reboot and see if that resolves the issue.



    b. Restore files using System Restore:

    1) Click the Start button
    2) In the Start Search field, type: System Restore and hit “Enter”
    3) Select "Choose Different Restore Point", Put a check in the box that says "Show restore points older than 5 days", select the restore point that corresponds to the date Before you first noticed the issue.
    4) Click the "Next" button.
    5) Reboot and see if that resolves the issue.

     

    If neither of those resolved the issue, I have a few (more dramatic) options that you can try:

    c. Replace the effected files with copies from a known good installation of Windows. (I am told that it is also possible to extract copies of the files from the Windows installation disk or image, but I don't have any directions on how to do this).

     

    d. Contact Microsoft Assisted Support for further assistance with the issue.

    North America: http://support.microsoft.com/contactus/cu_sc_genadv_master?ws=support&ws=support#tab4

    Outside North America:
    http://support.microsoft.com/contactus/?ws=support#tab0

     

    e. Reinstall Windows.

     

    I hope this was helpful,

     


    Darin MS
    • Proposed as answer by Darin Smith MS Thursday, January 20, 2011 11:30 PM
    • Marked as answer by Darin Smith MS Friday, January 21, 2011 8:56 PM
    Thursday, January 20, 2011 11:30 PM
  • Same today with Windows 7 Home Premium
    Sunday, January 27, 2013 2:07 AM
  • Please start a NEW thread of your own, and include an MGADiag report.

    To properly analyse and solve problems with Activation and Validation, we need to see a full copy of the report produced by the MGADiag tool
    (download and save to desktop - http://go.microsoft.com/fwlink/?linkid=52012 )
     Once saved, run the tool.
    Click on the Continue button, which will produce the report.
     To copy the report to your response, click on the Copy button in the tool (ignore any error messages at this point), and then paste (using either r-click/Paste, or Ctrl+V ) into your response.
      - **in your own thread**, please
     
    Please also state the Version and Edition of Windows quoted on your COA sticker (if you have one) on the case of your machine (or inside the battery compartment), but do NOT quote the Key on the sticker!
    http://www.microsoft.com/en-us/howtotell/Hardware.aspx


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Sunday, January 27, 2013 9:53 AM
    Moderator