Answered by:
Windows 7 Suddenly not Genuine.

Question
-
Several Days ago my computer which has been running fine for nearly a year suddenly started prompting me with a pop up that says that Windows is not Genuine. The computer was built by GeoStorm and likely has an OEM version of the software. It is running Windows 7 Ultimate.
Tried multiple things including making sure all of the updates ran successfully and checking to make sure new updates were downloading. I also tried reactivating. The OS continues to tell me that Windows is Genuine
Can anyone spot my problem:
Here is what the troubleshooting tool reports:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-JTX9G-P899V-B3MWK
Windows Product Key Hash: QBc9Acf3tDzO+qbbfkhPQim6Xso=
Windows Product ID: 00371-OEM-9044416-10755
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {D06C7BFC-1C92-49C7-9015-F4FB614D095B}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.110622-1506
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Users\Evans\AppData\Local\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{D06C7BFC-1C92-49C7-9015-F4FB614D095B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-B3MWK</PKey><PID>00371-OEM-9044416-10755</PID><PIDType>3</PIDType><SID>S-1-5-21-3758271357-1879685353-2364571816</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>0603 </Version><SMBIOSVersion major="2" minor="5"/><Date>20101029000000.000000+000</Date></BIOS><HWID>4ED43B07018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: e120e868-3df2-464a-95a0-b52fa5ada4bf
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00180-444-110755-02-1033-7600.0000-0122011
Installation ID: 002713423431048735995015758110277002586652171094200670
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: B3MWK
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 1/27/2012 12:13:44 PM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000000040
Event Time Stamp: 1:26:2012 21:45
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
HWID Data-->
HWID Hash Current: OgAAAAMABgABAAEAAAABAAAAAgABAAEA6GGasEPkuXh3Fqp/GLAMVKyLXg54GTg4DD3KxPJcj/zqgg==
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC 102910 APIC2206
FACP 102910 FACP2206
HPET 102910 OEMHPET
MCFG 102910 OEMMCFG
OEMB 102910 OEMB2206
ASPT 102910 PerfTune
OSFR 102910 OEMOSFR
- Moved by Carey FrischMVP, Moderator Friday, January 27, 2012 11:06 PM Moved to more appropriate forum category (From:Windows 7 Installation, Setup, and Deployment)
Friday, January 27, 2012 8:19 PM
Answers
-
Interesting - they appear to be the same file - and they should not be!
You should rename the one in the System32 folder, and then replace it, preferably using SFC (if it'll work then!)
To rename the file you will have to take ownership of it, and amend the permissions.
Once renamed, do NOT reboot until you have checked that the file has been replaced, or you are likely to be unable to boot the system.
If you can't get SFC to work to replace the file, then you will have to do a manual replacement, copying the file from folder
C:\Windows\winsxs\x86_microsoft-windows-security-spp-clientext_31bf3856ad364e35_6.1.7600.16385_none_cc9d4bf812728aae
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth- Proposed as answer by Darin Smith MS Monday, January 30, 2012 11:39 PM
- Marked as answer by eevans24 Sunday, February 12, 2012 10:35 PM
Sunday, January 29, 2012 12:02 PMModerator -
An intermittent problem may mean two programs are contending for resources (race condition) at the time the WAT software is making a check. You can try running in Clean Start mode to shut down third party programs and services and see if the condition continues. If not, then start adding back programs until the condition reappears, thus identifying at least one of the culprits. It is a time-honored debugging technique and is well supported by MS at
http://support.microsoft.com/kb/331796
Colin Barnhorst Windows 7 Ultimate x64 on DIY with 6GB ram.- Proposed as answer by Darin Smith MS Friday, February 3, 2012 11:18 PM
- Marked as answer by Darin Smith MS Monday, February 6, 2012 10:50 PM
Thursday, February 2, 2012 8:06 PMAnswerer
All replies
-
Try running the System File Checker. Click Start, type 'cmd' in the Search/Run box, and right click on the CMD icon at the top of the results pane. Select Run as Administrator. When the cmd window opens type 'sfc /scannow' at the prompt and hit Enter. When the scan completes close the cmd window. Restart and post a new copy of the MGADiag report in your next reply.
You can also try using System Restore to recover to a point before the error appeared.
Colin Barnhorst Windows 7 Ultimate x64 on DIY with 6GB ram.Friday, January 27, 2012 11:51 PMAnswerer -
Thanks,
I ran sfc /scannow and it finished but gave some info about files it couldn't scan. The screen reads: Windows Respurce Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log windir\logs\CBS\CBS.log. Iv'e looked at the log but don't really know what I am looking for. There are errors in it.
I cannot use an old restore point because I switched off system restore to save resources.
Thanks for your continued help! I am still getting the Not "Genuine message"
I also tried reinstalling the recent Activation Security Patch. That didn't resolve things either.
Here's the latest MGA diag:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-JTX9G-P899V-B3MWK
Windows Product Key Hash: QBc9Acf3tDzO+qbbfkhPQim6Xso=
Windows Product ID: 00371-OEM-9044416-10755
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {D06C7BFC-1C92-49C7-9015-F4FB614D095B}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.110622-1506
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Users\Evans\AppData\Local\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{D06C7BFC-1C92-49C7-9015-F4FB614D095B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-B3MWK</PKey><PID>00371-OEM-9044416-10755</PID><PIDType>3</PIDType><SID>S-1-5-21-3758271357-1879685353-2364571816</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>0603 </Version><SMBIOSVersion major="2" minor="5"/><Date>20101029000000.000000+000</Date></BIOS><HWID>4ED43B07018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: e120e868-3df2-464a-95a0-b52fa5ada4bf
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00180-444-110755-02-1033-7600.0000-0122011
Installation ID: 002713423431048735995015758110277002586652171094200670
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: B3MWK
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 1/27/2012 5:38:11 PM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000000040
Event Time Stamp: 1:27:2012 17:04
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
HWID Data-->
HWID Hash Current: OgAAAAMABgABAAEAAAABAAAAAgABAAEA6GGasEPkuXh3Fqp/GLAMVKyLXg54GTg4DD3KxPJcj/zqgg==
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC 102910 APIC2206
FACP 102910 FACP2206
HPET 102910 OEMHPET
MCFG 102910 OEMMCFG
OEMB 102910 OEMB2206
ASPT 102910 PerfTune
OSFR 102910 OEMOSFR
Saturday, January 28, 2012 1:40 AM -
"eevans24" wrote in message news:d2f62d59-ae46-44af-9bd7-70a5b60f6e40...
Thanks,
I ran sfc /scannow and it finished but gave some info about files it couldn't scan. The screen reads: Windows Respurce Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log windir\logs\CBS\CBS.log. Iv'e looked at the log but don't really know what I am looking for. There are errors in it.
I cannot use an old restore point because I switched off system restore to save resources.
Thanks for your continued help! I am still getting the Not "Genuine message"
I also tried reinstalling the recent Activation Security Patch. That didn't resolve things either.
Here's the latest MGA diag:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-JTX9G-P899V-B3MWK
Windows Product Key Hash: QBc9Acf3tDzO+qbbfkhPQim6Xso=
Windows Product ID: 00371-OEM-9044416-10755
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {D06C7BFC-1C92-49C7-9015-F4FB614D095B}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.110622-1506
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Users\Evans\AppData\Local\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{D06C7BFC-1C92-49C7-9015-F4FB614D095B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-B3MWK</PKey><PID>00371-OEM-9044416-10755</PID><PIDType>3</PIDType><SID>S-1-5-21-3758271357-1879685353-2364571816</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>0603 </Version><SMBIOSVersion major="2" minor="5"/><Date>20101029000000.000000+000</Date></BIOS><HWID>4ED43B07018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: e120e868-3df2-464a-95a0-b52fa5ada4bf
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00180-444-110755-02-1033-7600.0000-0122011
Installation ID: 002713423431048735995015758110277002586652171094200670
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: B3MWK
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 1/27/2012 5:38:11 PM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000000040
Event Time Stamp: 1:27:2012 17:04
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
HWID Data-->
HWID Hash Current: OgAAAAMABgABAAEAAAABAAAAAgABAAEA6GGasEPkuXh3Fqp/GLAMVKyLXg54GTg4DD3KxPJcj/zqgg==
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC 102910 APIC2206
FACP 102910 FACP2206
HPET 102910 OEMHPET
MCFG 102910 OEMMCFG
OEMB 102910 OEMB2206
ASPT 102910 PerfTune
OSFR 102910 OEMOSFR
Please open Windows Explorer and look for the fileC:\Windows\System32\SLCEXT.DLLright-click on it and select Propertieswhat is the exact size of the file?If you click on the details tab, what does it say there?repeat for C:\Windows\SysWOW64\SLCEXT.DLL as well -post back with details, and we may be able to assist.
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothSaturday, January 28, 2012 9:24 AMModerator -
C:\Windows\System32\SLCEXT.DLL is 18k
C:\Windows\SysWOW64\SLCEXT.DLL is 16kb
Saturday, January 28, 2012 11:16 PM -
"eevans24" wrote in message news:0fc318da-bf2d-43e5-9ab2-6aa3625719c3...
C:\Windows\System32\SLCEXT.DLL is 18k
C:\Windows\SysWOW64\SLCEXT.DLL is 16kb
I asked for the EXACT size (as indicated on the front page of the Properties window), not the abbreviated size – even 1 byte difference could indicate a major problem.That said, it looks normal, at first glance.Please run the following commands in a Command Prompt window – they may show us what the problem is.ICACLS C:\Windows\System32\slcext.dllICACLS C:\Windows\System32\en-us\slcext.dll.muiICACLS C:\Windows\SysWOW64\slcext.dllICACLS C:\Windows\SysWOW64\en-us\slcext.dll.muiCopy/paste the results to your response.(to copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.)
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothSaturday, January 28, 2012 11:30 PMModerator -
Microsoft Windows [Version 6.1.7601]Copyright (c) 2009 Microsoft Corporation. All rights reserved.C:\Users\Evans>ICACLS C:\Windows\System32\slcext.dllC:\Windows\System32\slcext.dll NT SERVICE\TrustedInstaller:(F)BUILTIN\Administrators:(RX)NT AUTHORITY\SYSTEM:(RX)BUILTIN\Users:(RX)Successfully processed 1 files; Failed processing 0 filesC:\Users\Evans>ICACLS C:\Windows\System32\en-us\slcext.dll.muiC:\Windows\System32\en-us\slcext.dll.mui NT SERVICE\TrustedInstaller:(F)BUILTIN\Administrators:(RX)NT AUTHORITY\SYSTEM:(RX)BUILTIN\Users:(RX)Successfully processed 1 files; Failed processing 0 filesC:\Users\Evans>ICACLS C:\Windows\SysWOW64\slcext.dllC:\Windows\SysWOW64\slcext.dll NT SERVICE\TrustedInstaller:(F)BUILTIN\Administrators:(RX)NT AUTHORITY\SYSTEM:(RX)BUILTIN\Users:(RX)Successfully processed 1 files; Failed processing 0 filesC:\Users\Evans>ICACLS C:\Windows\SysWOW64\en-us\slcext.dll.muiC:\Windows\SysWOW64\en-us\slcext.dll.mui NT SERVICE\TrustedInstaller:(F)BUILTIN\Administrators:(RX)NT AUTHORITY\SYSTEM:(RX)BUILTIN\Users:(RX)Successfully processed 1 files; Failed processing 0 filesC:\Users\Evans>Sunday, January 29, 2012 12:31 AM
-
Here's those file sizes:
C:\Windows\System32\SLCEXT.DLL
C:\Windows\SysWOW64\SLCEXT.DL
Sunday, January 29, 2012 12:40 AM -
"eevans24" wrote in message news:225ee328-f396-44fd-bd7b-73649481b4eb...Microsoft Windows [Version 6.1.7601]Copyright (c) 2009 Microsoft Corporation. All rights reserved.C:\Users\Evans>ICACLS C:\Windows\System32\slcext.dllC:\Windows\System32\slcext.dll NT SERVICE\TrustedInstaller:(F)BUILTIN\Administrators:(RX)NT AUTHORITY\SYSTEM:(RX)BUILTIN\Users:(RX)Successfully processed 1 files; Failed processing 0 filesC:\Users\Evans>ICACLS C:\Windows\System32\en-us\slcext.dll.muiC:\Windows\System32\en-us\slcext.dll.mui NT SERVICE\TrustedInstaller:(F)BUILTIN\Administrators:(RX)NT AUTHORITY\SYSTEM:(RX)BUILTIN\Users:(RX)Successfully processed 1 files; Failed processing 0 filesC:\Users\Evans>ICACLS C:\Windows\SysWOW64\slcext.dllC:\Windows\SysWOW64\slcext.dll NT SERVICE\TrustedInstaller:(F)BUILTIN\Administrators:(RX)NT AUTHORITY\SYSTEM:(RX)BUILTIN\Users:(RX)Successfully processed 1 files; Failed processing 0 filesC:\Users\Evans>ICACLS C:\Windows\SysWOW64\en-us\slcext.dll.muiC:\Windows\SysWOW64\en-us\slcext.dll.mui NT SERVICE\TrustedInstaller:(F)BUILTIN\Administrators:(RX)NT AUTHORITY\SYSTEM:(RX)BUILTIN\Users:(RX)Successfully processed 1 files; Failed processing 0 filesC:\Users\Evans>That also looks normal enough.I don’t think that this is likely to be fixable in a forum context – I suspect that you are suffering the residues of a malware infestation which could be difficult to fix at the best of times.One thing you could try is running SFC from a WinRE bootRestart the PC, and tap the F8 Key as it goes through the POST routine at the start – you should get a menu up eventually which will offer a long list of options. Pick ‘Repair your Computer’Log in, and when the options list comes up pick Command Prompt.At the prompt typeDIR C:\and check that this lists the files in your OS driveIf not, then try D:\ (and so on, until you get the right one)Then, typeSFC /SCANNOW /OFFBOOTDIR=<drive>:\ /OFFWINDIR=<drive>:\windowswhere <drive> is the OS Drive letter you discovered above.This should start SFC scanning for errors, and it may have more success than the online one.Once complete, typeEXIT and hit the Enter key, then reboot the machine.
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothSunday, January 29, 2012 11:46 AMModerator -
Interesting - they appear to be the same file - and they should not be!
You should rename the one in the System32 folder, and then replace it, preferably using SFC (if it'll work then!)
To rename the file you will have to take ownership of it, and amend the permissions.
Once renamed, do NOT reboot until you have checked that the file has been replaced, or you are likely to be unable to boot the system.
If you can't get SFC to work to replace the file, then you will have to do a manual replacement, copying the file from folder
C:\Windows\winsxs\x86_microsoft-windows-security-spp-clientext_31bf3856ad364e35_6.1.7600.16385_none_cc9d4bf812728aae
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth- Proposed as answer by Darin Smith MS Monday, January 30, 2012 11:39 PM
- Marked as answer by eevans24 Sunday, February 12, 2012 10:35 PM
Sunday, January 29, 2012 12:02 PMModerator -
OK. I tried running SFC from the Windows Repair Boot command prompt. While if found errors, it could not apparently fix them.
Next I used SFC to find, change permissions and replace the file c:\windows\system32\slcext.dll. Now the file size has changed:
I'm gonna reboot. Say some "Hail Mary's" for me. I'll advice once I know whether this has fixed my problem. If the computer won't reboot, stay tuned. I'll have to wait until later in the week to reload it.
Wednesday, February 1, 2012 12:42 AM -
"eevans24" wrote in message news:cb55e818-ca3d-4555-b70a-211f22e455ac...
OK. I tried running SFC from the Windows Repair Boot command prompt. While if found errors, it could not apparently fix them.
Next I used SFC to find, change permissions and replace the file c:\windows\system32\slcext.dll. Now the file size has changed:
I'm gonna reboot. Say some "Hail Mary's" for me. I'll advice once I know whether this has fixed my problem. If the computer won't reboot, stay tuned. I'll have to wait until later in the week to reload it.
Good Luck!
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothWednesday, February 1, 2012 12:47 AMModerator -
Well, the computer rebooted fine but I still get the "Not Genuine" prompt maybe 4 times a day. Any more ideas? Thanks for the help. I am learning allot even though I may be headed to Reloadville.Thursday, February 2, 2012 7:43 PM
-
An intermittent problem may mean two programs are contending for resources (race condition) at the time the WAT software is making a check. You can try running in Clean Start mode to shut down third party programs and services and see if the condition continues. If not, then start adding back programs until the condition reappears, thus identifying at least one of the culprits. It is a time-honored debugging technique and is well supported by MS at
http://support.microsoft.com/kb/331796
Colin Barnhorst Windows 7 Ultimate x64 on DIY with 6GB ram.- Proposed as answer by Darin Smith MS Friday, February 3, 2012 11:18 PM
- Marked as answer by Darin Smith MS Monday, February 6, 2012 10:50 PM
Thursday, February 2, 2012 8:06 PMAnswerer -
No reply from the Original Poster.
Issue is assumed to be resolved.
Darin MSMonday, February 6, 2012 10:51 PM -
So I reported that changing this file did not stop the "Not Genuine" Notices. However, a few hours after reporting this, I stopped getting the pop up. Either this fix worked or an update resolved the problem. It is still a bit of a mystery but if nothing else I got some good advice from this string. Thanks!Sunday, February 12, 2012 10:37 PM
-
"eevans24" wrote in message news:d738b5ae-dfbb-4423-8b39-4260c7bf7caa...So I reported that changing this file did not stop the "Not Genuine" Notices. However, a few hours after reporting this, I stopped getting the pop up. Either this fix worked or an update resolved the problem. It is still a bit of a mystery but if nothing else I got some good advice from this string. Thanks!We got there in the end, then :)Please post another MGADiag report (if you dare!) so that we can see what’s changed, if anything.
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothSunday, February 12, 2012 10:43 PMModerator -
Ok Here it is...cringing.
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-JTX9G-P899V-B3MWK
Windows Product Key Hash: QBc9Acf3tDzO+qbbfkhPQim6Xso=
Windows Product ID: 00371-OEM-9044416-10755
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {D06C7BFC-1C92-49C7-9015-F4FB614D095B}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.110622-1506
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Users\Evans\AppData\Local\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\slcext.dll[Hr = 0x80004005]
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{D06C7BFC-1C92-49C7-9015-F4FB614D095B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-B3MWK</PKey><PID>00371-OEM-9044416-10755</PID><PIDType>3</PIDType><SID>S-1-5-21-3758271357-1879685353-2364571816</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>0603 </Version><SMBIOSVersion major="2" minor="5"/><Date>20101029000000.000000+000</Date></BIOS><HWID>4ED43B07018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: e120e868-3df2-464a-95a0-b52fa5ada4bf
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00180-444-110755-02-1033-7600.0000-0122011
Installation ID: 002713423431048735995015758110277002586652171094200670
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: B3MWK
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 2/13/2012 4:17:34 PM
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x8007007F
HealthStatus: 0x0000000000000000
Event Time Stamp: 2:3:2012 17:38
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
HWID Data-->
HWID Hash Current: OgAAAAMABgABAAEAAAABAAAAAgABAAEA6GGasEPkuXh3Fqp/GLAMVKyLXg54GTg4DD3KxPJcj/zqgg==
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC 102910 APIC2206
FACP 102910 FACP2206
HPET 102910 OEMHPET
MCFG 102910 OEMMCFG
OEMB 102910 OEMB2206
ASPT 102910 PerfTune
OSFR 102910 OEMOSFR
Tuesday, February 14, 2012 12:18 AM -
"eevans24" wrote in message news:d8fa390b-b5f9-492e-87fe-d29d5577fa4c...
Ok Here it is...cringing.
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-JTX9G-P899V-B3MWK
Windows Product Key Hash: QBc9Acf3tDzO+qbbfkhPQim6Xso=
Windows Product ID: 00371-OEM-9044416-10755
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.048
File Scan Data-->
File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\slcext.dll[Hr = 0x80004005]
Other data-->
SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>0603 </Version><SMBIOSVersion major="2" minor="5"/><Date>20101029000000.000000+000</Date></BIOSLicensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Partial Product Key: B3MWK
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 2/13/2012 4:17:34 PM
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x8007007F
HealthStatus: 0x0000000000000000
Event Time Stamp: 2:3:2012 17:38
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
There’s two errors – which means that the install won’t validate (last validation was on 3rd Feb)I *think* the problem with the SLCEXT.DLL file is that it is still blocked as a ‘foreign’ file (from another computer).If you find it in System32, and right-click on it, select Properties.it will probably have a Security section at the bottom of the General tab page – click on the Unblock button, and OK out, then run another MGADiag report.let’s see if that problem gets sorted, and then we can see about the SLCEXT.DLL file if necessary.
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothTuesday, February 14, 2012 12:32 AMModerator -
The file is there but it doesn't appear to be blocked. The System has Read, and Read and Execute permissions.
Tuesday, February 14, 2012 9:33 PM