locked
Windows 7 H.P now apparently not genuine [after installing updates from MS] RRS feed

  • Question

  • Hi there, I bought my new PC the other day from a well known vendor, and after setting it up, I installed 56 updates from Windows Update. Some of these failed, and even though I've restarted my PC many times since, they still won't install.

    Today a message came up saying that my copy of Windows 7 wasn't genuine and, after reading posts here, ran the diagnostic check (which produced the following):

     

     

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: N/A, hr = 0xc0000022
    Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
    Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
    Windows Product ID: 00359-OEM-8992687-00006
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7600.2.00010300.0.0.003
    ID: {F39D448C-7D8F-49DC-BFCE-8A9861A332FD}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7600.win7_gdr.100618-1621
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{F39D448C-7D8F-49DC-BFCE-8A9861A332FD}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7600.2.00010300.0.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-3322594903-3711115336-191971216</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire X3900</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>P01-B0</Version><SMBIOSVersion major="2" minor="6"/><Date>20100120000000.000000+000</Date></BIOS><HWID>83B93607018400FC</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.
    Error: 0x80070426

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0001000000000000
    Event Time Stamp: 1:16:2011 19:12
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered Service: sppsvc


    HWID Data-->
    HWID Hash Current: KgAAAAEAAQABAAEAAAABAAAAAQABAAEAeqiOMoSxkGIe7yow3Ee41lxd

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name OEMID Value OEMTableID Value
      APIC   ACRSYS  APIC0850
      FACP   ACRSYS  FACP0850
      HPET   ACRSYS  OEMHPET
      MCFG   ACRSYS  OEMMCFG
      SLIC   ACRSYS  ACRPRDCT
      OEMB   ACRSYS  OEMB0850
      GSCI   ACRSYS  GMCHSCI
      AWMI   ACRSYS  OEMB0850
      SSDT   DpgPmm  CpuPm

     

    Having noticed 'Tampered Service: sppsvc', I ran 'sfc /scannow' but this only said "Windows Resource Protection did not find any integrity violations".

     

    I'm at a loss as to what I can do. Reinstalling Windows isn't an option as the computer came with no recovery/CD with W7 on it (something I'm currently complaing to them about).

     

    This is stressing me out majorly, especially as I've only had my PC up and running for 4 days! I thought Windows 7 was supposed to be better than XP :(

    Monday, January 17, 2011 8:28 PM

Answers

  • Hello The-Imposter,

    The issue I am seeing is that there is a problem with your Windows 7's Software Protection Platform service.  I know this from the line in your Diagnostic Report:  Tampered Service: sppsvc

     

    Here is what I have regarding Tampered Services:

    CAVEAT: I have Not seen a large number of Tampered Services with Windows 7 so I still have a limited understanding of then.  I believe it's the same as an issue seen sometimes in Vista but just with a different name, however, I have not yet been able to confirm this. The below description of a Tampered Service is based on my experience with that similar/same issue in Vista.

    Background info: There are system files that when they are Run they spawn a Service (usually with the same name as the file that spawned it). In your case, the services sppsvc is a Services being modified in system memory, but the file sppsvc.exe is not modified since this file is not listed as a Tampered File.

      A Tampered Service is when a Service which is running is system memory is activly being shimmed or hooked into (Modified) in an unsupported way. This is an Active tamper meaning the tamper can only occure while something is making it occure. That 'something' is another program.  That program could be a legitimate program that happens to be doing something in a way that Windows 7 does not allow. Or it could be Malware.

     The resolution for this issue tends to be difficult because a) it involves you tracking down the offending program and b) there is very little I can do to help (none of my tools can tell what program is causing the tamper). 

     A few hints and suggestions I can provide: Run Anti-virus scans. Preferably multple times using different software.  Think back to when the issue first started, did you install any software within three (or so) days before the issue occured? Do you have any freeware/sharware software that may not be of the highest quality?  Confirm all your software is Windows 7 compatible and/or has been upgraded to a compatible version. and so on.

     

    Lastly, I also suggest trying the below steps.  The steps have been known to resolve a Tampered File, but I am just not sure if they will as effective for a Tampered Service. The steps will not make the issue any worse. 

    a. System Scan. The scan will look for bad Windows files and will attempt to repair them, if possible.

    1) Click the Start Button
    2) Type: cmd.exe
    3) Right-click the cmd.exe file and select 'Run as Administrator'
    4) In the CMD window, type: sfc /scannow
    5) Reboot and see if that resolves the issue.


    b. Repairing Windows using System Restore:

    1) Click the Start button
    2) In the Start Search field, type: System Restore and hit “Enter”
    3) Select "Choose Different Restore Point", Put a check in the box that says "Show restore points older than 5 days", select the restore point that corresponds to the date Before you first noticed the issue.
    4) Click the "Next" button.
    5) Reboot and see if that resolves the issue.


    If you were unable to resolve the issue using the suggestions I provided above and if neither of these sets of steps resolves the issue, my only other suggestions would be either to contact Microsoft Assisted Support as one of the below URLs for further assistance.

     North America: http://support.microsoft.com/contactus/cu_sc_genadv_master?ws=support&ws=support#tab4

    Outside North America:
    http://support.microsoft.com/contactus/?ws=support#tab0

     

    Thank you,


    Darin MS
    • Marked as answer by Darin Smith MS Tuesday, January 18, 2011 12:02 AM
    Tuesday, January 18, 2011 12:02 AM

All replies

  • Type services.msc at the search box, hit enter, scroll down for a service called software protection, insure it is set to automatic [delayed start]

    To access the settings, right click, properties, change the default startup setting to automatic [delayed start] then click on the start button and click OK. This is only applicable if the service is not running.

     

    Failing that, try this link to generate a no cost support incident

    http://support.microsoft.com/gp/contactwga

    • Proposed as answer by Darin Smith MS Monday, January 17, 2011 11:35 PM
    • Unproposed as answer by Darin Smith MS Tuesday, January 18, 2011 12:00 AM
    • Proposed as answer by Darin Smith MS Tuesday, January 18, 2011 12:02 AM
    Monday, January 17, 2011 10:39 PM
  • Hello The-Imposter,

    The issue I am seeing is that there is a problem with your Windows 7's Software Protection Platform service.  I know this from the line in your Diagnostic Report:  Tampered Service: sppsvc

     

    Here is what I have regarding Tampered Services:

    CAVEAT: I have Not seen a large number of Tampered Services with Windows 7 so I still have a limited understanding of then.  I believe it's the same as an issue seen sometimes in Vista but just with a different name, however, I have not yet been able to confirm this. The below description of a Tampered Service is based on my experience with that similar/same issue in Vista.

    Background info: There are system files that when they are Run they spawn a Service (usually with the same name as the file that spawned it). In your case, the services sppsvc is a Services being modified in system memory, but the file sppsvc.exe is not modified since this file is not listed as a Tampered File.

      A Tampered Service is when a Service which is running is system memory is activly being shimmed or hooked into (Modified) in an unsupported way. This is an Active tamper meaning the tamper can only occure while something is making it occure. That 'something' is another program.  That program could be a legitimate program that happens to be doing something in a way that Windows 7 does not allow. Or it could be Malware.

     The resolution for this issue tends to be difficult because a) it involves you tracking down the offending program and b) there is very little I can do to help (none of my tools can tell what program is causing the tamper). 

     A few hints and suggestions I can provide: Run Anti-virus scans. Preferably multple times using different software.  Think back to when the issue first started, did you install any software within three (or so) days before the issue occured? Do you have any freeware/sharware software that may not be of the highest quality?  Confirm all your software is Windows 7 compatible and/or has been upgraded to a compatible version. and so on.

     

    Lastly, I also suggest trying the below steps.  The steps have been known to resolve a Tampered File, but I am just not sure if they will as effective for a Tampered Service. The steps will not make the issue any worse. 

    a. System Scan. The scan will look for bad Windows files and will attempt to repair them, if possible.

    1) Click the Start Button
    2) Type: cmd.exe
    3) Right-click the cmd.exe file and select 'Run as Administrator'
    4) In the CMD window, type: sfc /scannow
    5) Reboot and see if that resolves the issue.


    b. Repairing Windows using System Restore:

    1) Click the Start button
    2) In the Start Search field, type: System Restore and hit “Enter”
    3) Select "Choose Different Restore Point", Put a check in the box that says "Show restore points older than 5 days", select the restore point that corresponds to the date Before you first noticed the issue.
    4) Click the "Next" button.
    5) Reboot and see if that resolves the issue.


    If you were unable to resolve the issue using the suggestions I provided above and if neither of these sets of steps resolves the issue, my only other suggestions would be either to contact Microsoft Assisted Support as one of the below URLs for further assistance.

     North America: http://support.microsoft.com/contactus/cu_sc_genadv_master?ws=support&ws=support#tab4

    Outside North America:
    http://support.microsoft.com/contactus/?ws=support#tab0

     

    Thank you,


    Darin MS
    • Marked as answer by Darin Smith MS Tuesday, January 18, 2011 12:02 AM
    Tuesday, January 18, 2011 12:02 AM
  • Thank you for giving me more detail about what a tampered service is. Tomorrow I shall try to resolve the methods which you and Carl have suggested and I'll get back to you as to whether they worked or not.

     

    Many thanks !

    Tuesday, January 18, 2011 11:49 PM
  • I've tried system restore, but it's now hung at the 'restoring registry' point. Am I in serious trouble? :(
    Thursday, January 20, 2011 11:44 AM
  • "The-Imposter" wrote in message news:b910208d-a656-4600-a481-48741a46dc5d...
    I've tried system restore, but it's now hung at the 'restoring registry' point. Am I in serious trouble? :(

    It may hang there for a while - be patient! (I've known system restore take an hour or two)

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Thursday, January 20, 2011 1:24 PM
    Moderator