locked
Yet another spontaneous "did not pass genuine validation" RRS feed

  • Question

  • I've been using this computer with this Windows 7 Ultimate for 13 months, activated, validated, etc.  Today, a black background and validation failure.  Looked through the threads for anything that looks like my situation, but I'm baffled.  Here's the MGADIAG output:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-RCDFG-D3H8T-RGWWF
    Windows Product Key Hash: nwSHOswnegku+tI23fJvgKNTaEg=
    Windows Product ID: 00426-OEM-9154234-62822
    Windows Product ID Type: 3
    Windows License Type: OEM System Builder
    Windows OS version: 6.1.7601.2.00010100.1.0.001
    ID: {1B9947C2-783A-4496-93E8-64A638EED2B6}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Ultimate
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.110622-1506
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Enterprise 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{1B9947C2-783A-4496-93E8-64A638EED2B6}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-RGWWF</PKey><PID>00426-OEM-9154234-62822</PID><PIDType>3</PIDType><SID>S-1-5-21-2395378611-1177590832-3458786119</SID><SYSTEM><Manufacturer>BIOSTAR Group</Manufacturer><Model>TA785G3 HD</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>080015 </Version><SMBIOSVersion major="2" minor="6"/><Date>20091224000000.000000+000</Date></BIOS><HWID>B57D3C07018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>QA09   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>A4346A34C2206D4</Val><Hash>NxalpuEx7r4ivcFNpYrlTMB5r4Q=</Hash><Pid>81599-874-9722294-65893</Pid><PidType>1</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, Ultimate edition
    Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
    Activation ID: cfb3e52c-d707-4861-af51-11b27ee6169c
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00426-00182-542-362822-02-1033-7601.0000-3512011
    Installation ID: 012362175513161482427264419563198331867193205883701450
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: RGWWF
    License Status: Initial grace period
    Time remaining: 43200 minute(s) (30 day(s))
    Remaining Windows rearm count: 3
    Trusted time: 12/17/2011 10:55:18 AM

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0x00000000
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 12:17:2011 10:53
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:


    HWID Data-->
    HWID Hash Current: NgAAAAIABAABAAEAAQACAAAAAQABAAEA6GHCFqUYXmfC6FgaEDNU8oSLaj6N75qIxuW+b0Dp

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            122409        APIC0947
      FACP            122409        FACP0947
      HPET            122409        OEMHPET
      MCFG            122409        OEMMCFG
      OEMB            122409        OEMB0947
      SSDT            A M I         POWERNOW
      SLIC            DELL          QA09  



    Saturday, December 17, 2011 3:58 PM

Answers

  • SLIC            DELL          QA09   

     

    You have an activation exploit in your report, as evidenced by a Dell slic table on a retail motherboard.

    You will have to get rid of the exploit or reinstall windows.

    • Marked as answer by Darin Smith MS Monday, December 19, 2011 9:49 PM
    Saturday, December 17, 2011 5:27 PM
    Answerer

All replies

  • SLIC            DELL          QA09   

     

    You have an activation exploit in your report, as evidenced by a Dell slic table on a retail motherboard.

    You will have to get rid of the exploit or reinstall windows.

    • Marked as answer by Darin Smith MS Monday, December 19, 2011 9:49 PM
    Saturday, December 17, 2011 5:27 PM
    Answerer
  • Hmm.  I bought this from a fellow who is still selling on eBay.  Time for me to have a "chat" with him.

    Is there any way to tell if the activation key is good?  I tried feeding it (again) into Windows Activation and I got an error indicating that the key is blocked.  If the key is also rubbish, I have plenty of ammo to use on this guy.

    Saturday, December 17, 2011 7:13 PM
  • Any software sold on ebay is 99.9% chance it is bogus.

    Only the forum owner has the tools to determine the status of this particular key.

     

    Demand a refund from the seller. Don't accept anything other than a refund. These thieves have many delaying tactics to get out of the refund window.

    Saturday, December 17, 2011 9:10 PM
    Answerer
  • I'm out of the refund window - I've had the computer (and its software) for more than a year.  Nonetheless, I may have some leverage.
    Sunday, December 18, 2011 11:47 AM
  • "dplinker" wrote in message news:320773de-8880-4672-89be-678afb5602e9...
    I'm out of the refund window - I've had the computer (and its software) for more than a year.  Nonetheless, I may have some leverage.
     
    Threats of a visit from the FBI can work wonders <eg> – the FBI have jurisdiction over software counterfeiting in the US.
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Sunday, December 18, 2011 11:51 AM
    Moderator
  • So, I can learn the status of the activation key here?  Is there a process that I need to follow?
    Monday, December 19, 2011 10:26 PM
  • "dplinker" wrote in message news:b7abba82-c69f-45f9-855b-171414bfd69d...
    So, I can learn the status of the activation key here?  Is there a process that I need to follow?
     
    Post your MGADiag report.....
    To properly analyse and solve problems with Activation and Validation, we need to see a full copy of the report produced by the MGADiag tool (download and save to desktop - http://go.microsoft.com/fwlink/?linkid=52012 )
    Once saved, run the tool.
    Click on the Continue button, which will produce the report.
    To copy the report to your response, click on the Copy button in the tool (ignore any error messages at this point), and then paste (using either r-click/Paste, or Ctrl+V ) into your response.
      - **in your own thread**, please
     
    Please also state the Version and Edition of Windows quoted on your COA sticker (if you have one) on the case of your machine, but do NOT quote the Key on the sticker!

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Monday, December 19, 2011 11:03 PM
    Moderator
  • This is my thread, so I hope the MGADiag report pasted above will work.  I'm running Windows 7 Ultimate.
    Tuesday, December 20, 2011 12:16 AM
  • Ooops! sorry :)

    Details.....

    The Key appears to be from an OEM System Builder pack. (OK)

    The Motherboard appears to be a retail one. (OK)

    Retail motherboards cannot have a SLIC table present - yet your report shows the presence of a DELL SLIC table for Windows 7.

    This means that something has inserted into the operating system a tool to bypass the activation process (an Activation Exploit, or Loader). With this in place, the installation automatically becomes invalid, whatever the results of any software tests, since it's a direct breach of the terms of the license under which Windows is sold.

    You need to uninstall the Loader (if you know which one it is!), and then attempt proper activation of the Key (which may be perfectly genuine, unless it's been sold a number of times together with a hacked Windows.

    Since you purchased this on eBay, the chances are very high that the whole thing is a counterfeit.

    What was the product description? Did you get a COA Sticker with the pack? How many disks did you get? what packaging?

    Compare teh whole thing with the samples here.

    www.microsoft.com/piracy/howtotell

     

     

     


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Tuesday, December 20, 2011 12:45 AM
    Moderator
  • I'm asking about the administrative status of the activation key because:

    - I've had and used the product for more than a year.  The seller can easily say "I installed everything properly, whatever you did to your computer is your business.  The warranty period is long past.  Please go away."

    - When trying to determine why I was being told that my Windows is not authentic, I re-fed the activation key to Windows Activation and got an error indicating that the key was blocked.  I was also unable to succeed with the automated telephone-based activation.

    If Microsoft has determined that the activation key has been misused, I can go to the seller (and eBay) with a bit more evidence.  Since I don't know what loader was used, I'm looking at a system reload.  I'd love the satisfaction of at least putting a bur in the saddle of the fellow that did this.  And, I would love to know whether my activation will succeed after I do the reload.

    I know that you folks see so much of this you shake your head in a fatigued way when you read "eBay."  Lesson learned on my part.  Thanks for your help.

    Tuesday, December 20, 2011 1:10 AM
  • "dplinker" wrote in message news:3e8bf2ab-4c67-4244-ba85-cee57e6fa581...

    .

    If Microsoft has determined that the activation key has been misused, I can go to the seller (and eBay) with a bit more evidence. 

     
     
    The only person who can give definitive news on your Key is Darin Smith (the forum owner) – hopefully he’ll spot this and check your report with his tools.
     
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Tuesday, December 20, 2011 1:17 AM
    Moderator
  • Is the ebay seller still active? usually they have disappeared with buyers cash or have been removed by ebay. 

     

    I'm personally curious if a reinstall would remove the loader or if it is on the install disk. Just an idle curiosity on my part. If the product key is blocked it won't solve your problem.

    Tuesday, December 20, 2011 1:22 AM
    Answerer
  • Seller is still active.  This is why I'm pursuing further.
    Tuesday, December 20, 2011 12:21 PM
  • I have looked up this key and it is Activation Blocked.

     

    What this means is that the key was Genuine but the key was activated so many times in a short period of time that the system assumes the key has been leaked to the internet and/or is being used by more then the authorized user. When this is detected, the key is Blocked to keep the key being abused further. 

    This key was first activated on 06/01/2010.   It had been activated successfully 24 times. However, between 09/04/2011 to present, there have been over 100 activation attempts for this key (there were 4 attempts today alone). Most likely there are more attempts dating back before September 2011, but the Activation History in my tool only shows the last 100 activation attempts.

    I have done a search of the internet for this key and did not find it, so it doesn't seem to have been publicly leaked, but someone (or more likely, a number of someones) are trying to use this key, allot, which suggests it's been leaked somehow, possibly on a privet site, I don't know.  The fact that there are multiple attempts per day at vastly different times of day (ranging from very early morning, afternoon, evening, middle of the night and so on) suggests it's being used by multiple people in different time zones (probably globally).

    Normally, if there were too many activation because of a mistake by the authorized owner I would suggest using the Activate by Phone option, talk to a Activation Rep and request the Block be removed.  However, this key is being abused currently (and very actively) so even if the Block was removed, given the number of activation attempts that occurred just this week alone, I would foresee the Microsoft's Activation System re-blocking the key within a few days.

     

    Sorry I couldn't be more help,


    Darin MS
    Tuesday, December 20, 2011 10:01 PM
  • This is a great deal of help.  Thank you very much.
    Wednesday, December 21, 2011 1:37 PM