"Windows 7 Build 7601 not genuine" message problem

All replies

• 

  

  0

  Sign in to vote

  You ran that report while in Safe Mode? Why?

  File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7601.17514], Hr = 0x80004005

    

  Please run a full CHKDSK and SFC scan....

   

  Click on Start > All Programs > Accessories

  Right-click on the Command Prompt entry

  Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

   

  At the Command prompt, type

   

  CHKDSK C: /R

   

  and hit the Enter key.

  You will be told that the drive is locked,

  and the CHKDSK will run at he next boot - hit the Y key, press Enter, and then reboot.

   

  The CHKDSK will take a few hours depending on the size of the drive, so be patient!

   

  After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -

  then run the SFC.

   

  SFC -System File Checker - Instructions

  Click on Start > All Programs > Accessories

  Right-click on the Command Prompt entry

  Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

   

  At the Command prompt, type

   

  SFC /SCANNOW

   

  and hit the Enter key

   

  Wait for the scan to finish - make a note of any error messages - and then reboot.

   

   

  Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your SkyDrive Public folder (http://skydrive.live.com ) and post a link to it so that I can take a look.

   

  Post a new MGADiag report with details of any error messages encountered.

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
  No - I do not work for Microsoft, or any of its contractors.

  • Proposed as answer by Noel D PatonModerator Wednesday, August 21, 2013 8:43 AM

  Sunday, August 18, 2013 3:36 PM

  Moderator
• 

  

  0

  Sign in to vote

  Hi Noel,

  Thanks a lot for your reply. I am sorry I was away, so couldn't get back to you earlier. 

  I followed your instructions above. After running SFC, the message said:  "Windows Resource Protection found some corrupt files but was unable to fix some of them."

  I have uploaded the compressed cbs.log file to this location:

  https://skydrive.live.com/#cid=A9F23276FCE0286C&id=A9F23276FCE0286C%21139 

  Thanks again and looking forward to your further help, 

  Sudhir

  
  

  ---

  rkwindows

  Sunday, August 25, 2013 4:07 AM
• 

  

  0

  Sign in to vote

  Here's the problem definition according to the SFC results...

  	Line 56030: 2013-08-24 23:45:58, Info                  CSI    0000030a [SR] Repairing 2 components
  	Line 56031: 2013-08-24 23:45:58, Info                  CSI    0000030b [SR] Beginning Verify and Repair transaction
  	Line 56034: 2013-08-24 23:45:59, Info                  CSI    0000030d [SR] Cannot repair member file [l:20{10}]"tcpmon.ini" of Microsoft-Windows-Printing-StandardPortMonitor-TCPMonINI, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
  	Line 56037: 2013-08-24 23:46:06, Info                  CSI    0000030f [SR] Cannot repair member file [l:20{10}]"sppsvc.exe" of Microsoft-Windows-Security-SPP, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
  

  
  I'll post a fix protocol for it a bit later.

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
  No - I do not work for Microsoft, or any of its contractors.

  • Proposed as answer by Noel D PatonModerator Tuesday, August 27, 2013 2:40 PM

  Monday, August 26, 2013 9:05 AM

  Moderator
• 

  

  1

  Sign in to vote

  I've uploaded a file - rkwaa.zip - to my SkyDrive at Noel's SkyDrive
  
  Please download and save it.

  Right-click on the saved file and select Extract all...
  
  Change the target to C:\ and click on Extract
  
  Close all windows (it would be a good idea to print these instructions!)
  
  Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
  
  Pick that
  
  You'll have to log in with your username and password.

  Pick the option to use a Command Prompt
  
  At the prompt type
  
  DIR C:\rkwaa
  
  hit the enter key - if you get a 'Not Found' error try
  
  DIR D:\rkwaa
  
  or
  
  DIR E:\rkwaa

   

  The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...

   

  XCOPY <drive>:\rkwaa  <drive>:\windows\winsxs /y /i /s /v /h

   

  (e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )

   

  run the command (it should take almost no time) and when the prompt returns, type
  
  EXIT
  
  and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.

  Now run SFC /SCANNOW in an Elevated Command Prompt
  
  then reboot and upload the new CBS.log file to your SkyDrive Public folder, and post a new link

  Also run a new MGADiag report, and post the result.

   

  
  

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
  No - I do not work for Microsoft, or any of its contractors.

  • Proposed as answer by Noel D PatonModerator Tuesday, August 27, 2013 2:39 PM
  • Unproposed as answer by Noel D PatonModerator Tuesday, August 27, 2013 2:41 PM

  Monday, August 26, 2013 11:45 AM

  Moderator
• 

  

  0

  Sign in to vote

  Thank you very much, Noel. 

  I followed your instructions. When I rebooted after that, Windows installed 8 updates.

  I have placed the zipped CBS.log in my skydrive: https://skydrive.live.com/?cid=A9F23276FCE0286C&id=A9F23276FCE0286C%21139

  The output of MAGDiag is below.

  Thanks again,
  Sudhir

  Diagnostic Report (1.9.0027.0):
  -----------------------------------------
  Windows Validation Data-->
  
  Validation Code: 0
  Cached Online Validation Code: 0x0
  Windows Product Key: *****-*****-QCPVQ-KHRB8-RMV82
  Windows Product Key Hash: +Rj3N34NLM2JqoBO/OzgzTZXgbY=
  Windows Product ID: 00359-OEM-8992687-00095
  Windows Product ID Type: 2
  Windows License Type: OEM SLP
  Windows OS version: 6.1.7601.2.00010300.1.0.003
  ID: {CADAA024-C668-4038-880D-D033632E0DF5}(3)
  Is Admin: Yes
  TestCab: 0x0
  LegitcheckControl ActiveX: N/A, hr = 0x80070002
  Signed By: N/A, hr = 0x80070002
  Product Name: Windows 7 Home Premium
  Architecture: 0x00000009
  Build lab: 7601.win7sp1_gdr.130318-1533
  TTS Error: 
  Validation Diagnostic: 
  Resolution Status: N/A
  
  Vista WgaER Data-->
  ThreatID(s): N/A, hr = 0x80070002
  Version: N/A, hr = 0x80070002
  
  Windows XP Notifications Data-->
  Cached Result: N/A, hr = 0x80070002
  File Exists: No
  Version: N/A, hr = 0x80070002
  WgaTray.exe Signed By: N/A, hr = 0x80070002
  WgaLogon.dll Signed By: N/A, hr = 0x80070002
  
  OGA Notifications Data-->
  Cached Result: N/A, hr = 0x80070002
  Version: N/A, hr = 0x80070002
  OGAExec.exe Signed By: N/A, hr = 0x80070002
  OGAAddin.dll Signed By: N/A, hr = 0x80070002
  
  OGA Data-->
  Office Status: 100 Genuine
  Microsoft Office Ultimate 2007 - 100 Genuine
  OGA Version: N/A, 0x80070002
  Signed By: N/A, hr = 0x80070002
  Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
  
  Browser Data-->
  Proxy settings: N/A
  User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
  Default Browser: C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 11\firefox.exe
  Download signed ActiveX controls: Prompt
  Download unsigned ActiveX controls: Disabled
  Run ActiveX controls and plug-ins: Allowed
  Initialize and script ActiveX controls not marked as safe: Disabled
  Allow scripting of Internet Explorer Webbrowser control: Disabled
  Active scripting: Allowed
  Script ActiveX controls marked as safe for scripting: Allowed
  
  File Scan Data-->
  
  Other data-->
  Office Details: <GenuineResults><MachineData><UGUID>{CADAA024-C668-4038-880D-D033632E0DF5}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-RMV82</PKey><PID>00359-OEM-8992687-00095</PID><PIDType>2</PIDType><SID>S-1-5-21-1775644653-3900196017-818714872</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron 1545                   </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A10</Version><SMBIOSVersion major="2" minor="4"/><Date>20090717000000.000000+000</Date></BIOS><HWID>193A3307018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>WN09   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002E-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Ultimate 2007</Name><Ver>12</Ver><Val>66D285F67DB16C2</Val><Hash>PvXcFwVNaKrgo/ftqTH2EEvHSco=</Hash><Pid>81608-865-1705852-65334</Pid><PidType>8</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  
  
  Spsys.log Content: 0x80070002
  
  Licensing Data-->
  Software licensing service version: 6.1.7601.17514
  
  Name: Windows(R) 7, HomePremium edition
  Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
  Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
  Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
  Extended PID: 00359-00178-926-800095-02-1033-7600.0000-2972009
  Installation ID: 006572656990309406037054954301616471466392916255328045
  Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
  Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
  Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
  Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
  Partial Product Key: RMV82
  License Status: Licensed
  Remaining Windows rearm count: 4
  Trusted time: 8/26/2013 12:19:42 PM
  
  Windows Activation Technologies-->
  HrOffline: 0x00000000
  HrOnline: 0x00000000
  HealthStatus: 0x0000000000000000
  Event Time Stamp: 5:4:2013 02:40
  ActiveX: Registered, Version: 7.1.7600.16395
  Admin Service: Registered, Version: 7.1.7600.16395
  HealthStatus Bitmask Output:
  
  
  HWID Data-->
  HWID Hash Current: MAAAAAEAAQABAAIAAAACAAAAAgABAAEAeqiwXPrA2jNeSigfdg5UbW7Wpm5igEbK
  
  OEM Activation 1.0 Data-->
  N/A
  
  OEM Activation 2.0 Data-->
  BIOS valid for OA 2.0: yes
  Windows marker version: 0x20001
  OEMID and OEMTableID Consistent: yes
  BIOS Information: 
    ACPI Table Name OEMID Value OEMTableID Value
    APIC DELL   WN09   
    FACP DELL   WN09   
    HPET DELL   WN09   
    MCFG DELL   WN09   
    SLIC DELL   WN09   
    SSDT PmRef CpuPm
  
  

  ---

  rkwindows

  Monday, August 26, 2013 4:30 PM
• 

  

  1

  Sign in to vote

  Interesting - the sppsvc problem was fixed, but not the tcpmon.ini problem.

  This could either indicate a self-repairing piece of software, or a malware infestation.

  Your system is now showing as genuine, but I suggest that you check it for malware as well...

  Please download and install  Malwarebytes Anti-malware (free version) from  http://www.malwarebytes.org/products/malwarebytes_free/ - UNtick 'Enable free trial of MBAM PRO' at the end of the installation -  and update it, then run a full scan  in your main account, and Quick scans in any other user accounts.

   

  Delete everything it finds   

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
  No - I do not work for Microsoft, or any of its contractors.

  • Marked as answer by rkwindows Tuesday, August 27, 2013 2:42 PM

  Monday, August 26, 2013 5:01 PM

  Moderator
• 

  

  0

  Sign in to vote

  Thanks a lot, Noel. I installed and ran the Malwarebytes Anti-malware, and deleted the 10 files it found.

  After rebooting I ran SFC /SCANNOW and placed the output in the SkyDrive as CBS2.7z

  Also ran MAGDiag, and pasted the output below.

  Thanks again,
  Sudhir
  

  
  

  Diagnostic Report (1.9.0027.0):
  -----------------------------------------
  Windows Validation Data-->
  
  Validation Code: 0
  Cached Online Validation Code: 0x0
  Windows Product Key: *****-*****-QCPVQ-KHRB8-RMV82
  Windows Product Key Hash: +Rj3N34NLM2JqoBO/OzgzTZXgbY=
  Windows Product ID: 00359-OEM-8992687-00095
  Windows Product ID Type: 2
  Windows License Type: OEM SLP
  Windows OS version: 6.1.7601.2.00010300.1.0.003
  ID: {CADAA024-C668-4038-880D-D033632E0DF5}(3)
  Is Admin: Yes
  TestCab: 0x0
  LegitcheckControl ActiveX: N/A, hr = 0x80070002
  Signed By: N/A, hr = 0x80070002
  Product Name: Windows 7 Home Premium
  Architecture: 0x00000009
  Build lab: 7601.win7sp1_gdr.130708-1532
  TTS Error: 
  Validation Diagnostic: 
  Resolution Status: N/A
  
  Vista WgaER Data-->
  ThreatID(s): N/A, hr = 0x80070002
  Version: N/A, hr = 0x80070002
  
  Windows XP Notifications Data-->
  Cached Result: N/A, hr = 0x80070002
  File Exists: No
  Version: N/A, hr = 0x80070002
  WgaTray.exe Signed By: N/A, hr = 0x80070002
  WgaLogon.dll Signed By: N/A, hr = 0x80070002
  
  OGA Notifications Data-->
  Cached Result: N/A, hr = 0x80070002
  Version: N/A, hr = 0x80070002
  OGAExec.exe Signed By: N/A, hr = 0x80070002
  OGAAddin.dll Signed By: N/A, hr = 0x80070002
  
  OGA Data-->
  Office Status: 100 Genuine
  Microsoft Office Ultimate 2007 - 100 Genuine
  OGA Version: N/A, 0x80070002
  Signed By: N/A, hr = 0x80070002
  Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
  
  Browser Data-->
  Proxy settings: N/A
  User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
  Default Browser: C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 11\firefox.exe
  Download signed ActiveX controls: Prompt
  Download unsigned ActiveX controls: Disabled
  Run ActiveX controls and plug-ins: Allowed
  Initialize and script ActiveX controls not marked as safe: Disabled
  Allow scripting of Internet Explorer Webbrowser control: Disabled
  Active scripting: Allowed
  Script ActiveX controls marked as safe for scripting: Allowed
  
  File Scan Data-->
  
  Other data-->
  Office Details: <GenuineResults><MachineData><UGUID>{CADAA024-C668-4038-880D-D033632E0DF5}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-RMV82</PKey><PID>00359-OEM-8992687-00095</PID><PIDType>2</PIDType><SID>S-1-5-21-1775644653-3900196017-818714872</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron 1545                   </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A10</Version><SMBIOSVersion major="2" minor="4"/><Date>20090717000000.000000+000</Date></BIOS><HWID>193A3307018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>WN09   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002E-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Ultimate 2007</Name><Ver>12</Ver><Val>66D285F67DB16C2</Val><Hash>PvXcFwVNaKrgo/ftqTH2EEvHSco=</Hash><Pid>81608-865-1705852-65334</Pid><PidType>8</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  
  
  Spsys.log Content: 0x80070002
  
  Licensing Data-->
  Software licensing service version: 6.1.7601.17514
  
  Name: Windows(R) 7, HomePremium edition
  Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
  Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
  Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
  Extended PID: 00359-00178-926-800095-02-1033-7600.0000-2972009
  Installation ID: 006572656990309406037054954301616471466392916255328045
  Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
  Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
  Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
  Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
  Partial Product Key: RMV82
  License Status: Licensed
  Remaining Windows rearm count: 4
  Trusted time: 8/26/2013 10:00:35 PM
  
  Windows Activation Technologies-->
  HrOffline: 0x00000000
  HrOnline: 0x00000000
  HealthStatus: 0x0000000000000000
  Event Time Stamp: 5:4:2013 02:40
  ActiveX: Registered, Version: 7.1.7600.16395
  Admin Service: Registered, Version: 7.1.7600.16395
  HealthStatus Bitmask Output:
  
  
  HWID Data-->
  HWID Hash Current: MAAAAAEAAQABAAIAAAACAAAAAgABAAEAeqiwXPrA2jNeSigfdg5UbW7Wpm5igEbK
  
  OEM Activation 1.0 Data-->
  N/A
  
  OEM Activation 2.0 Data-->
  BIOS valid for OA 2.0: yes
  Windows marker version: 0x20001
  OEMID and OEMTableID Consistent: yes
  BIOS Information: 
    ACPI Table Name OEMID Value OEMTableID Value
    APIC DELL   WN09   
    FACP DELL   WN09   
    HPET DELL   WN09   
    MCFG DELL   WN09   
    SLIC DELL   WN09   
    SSDT PmRef CpuPm
  
  

  ---

  rkwindows

  Tuesday, August 27, 2013 2:07 AM
• 

  

  1

  Sign in to vote

  With any luck your system should be fine now :)

  Good luck!

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
  No - I do not work for Microsoft, or any of its contractors.

  Tuesday, August 27, 2013 2:39 PM

  Moderator