locked
Windows 7 Suddenly not Genuine. RRS feed

  • Question

  • Several Days ago my computer which has been running fine for nearly a year suddenly started prompting me with a pop up that says that Windows is not Genuine.  The computer was built by GeoStorm and likely has an OEM version of the software.  It is running Windows 7 Ultimate. 

    Tried multiple things including making sure all of the updates ran successfully and checking to make sure new updates were downloading.  I also tried reactivating.  The OS continues to tell me that Windows is Genuine

    Can anyone spot my problem:

    Here  is what the troubleshooting tool reports:

     

    Diagnostic Report (1.9.0027.0):

    -----------------------------------------

    Windows Validation Data-->

     

    Validation Code: 0x8004FE21

    Cached Online Validation Code: 0x0

    Windows Product Key: *****-*****-JTX9G-P899V-B3MWK

    Windows Product Key Hash: QBc9Acf3tDzO+qbbfkhPQim6Xso=

    Windows Product ID: 00371-OEM-9044416-10755

    Windows Product ID Type: 3

    Windows License Type: OEM System Builder

    Windows OS version: 6.1.7601.2.00010100.1.0.048

    ID: {D06C7BFC-1C92-49C7-9015-F4FB614D095B}(3)

    Is Admin: Yes

    TestCab: 0x0

    LegitcheckControl ActiveX: N/A, hr = 0x80070002

    Signed By: N/A, hr = 0x80070002

    Product Name: Windows 7 Professional

    Architecture: 0x00000009

    Build lab: 7601.win7sp1_gdr.110622-1506

    TTS Error: 

    Validation Diagnostic: 

    Resolution Status: N/A

     

    Vista WgaER Data-->

    ThreatID(s): N/A, hr = 0x80070002

    Version: N/A, hr = 0x80070002

     

    Windows XP Notifications Data-->

    Cached Result: N/A, hr = 0x80070002

    File Exists: No

    Version: N/A, hr = 0x80070002

    WgaTray.exe Signed By: N/A, hr = 0x80070002

    WgaLogon.dll Signed By: N/A, hr = 0x80070002

     

    OGA Notifications Data-->

    Cached Result: N/A, hr = 0x80070002

    Version: N/A, hr = 0x80070002

    OGAExec.exe Signed By: N/A, hr = 0x80070002

    OGAAddin.dll Signed By: N/A, hr = 0x80070002

     

    OGA Data-->

    Office Status: 109 N/A

    OGA Version: N/A, 0x80070002

    Signed By: N/A, hr = 0x80070002

    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

     

    Browser Data-->

    Proxy settings: N/A

    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)

    Default Browser: C:\Users\Evans\AppData\Local\Google\Chrome\Application\chrome.exe

    Download signed ActiveX controls: Prompt

    Download unsigned ActiveX controls: Disabled

    Run ActiveX controls and plug-ins: Allowed

    Initialize and script ActiveX controls not marked as safe: Disabled

    Allow scripting of Internet Explorer Webbrowser control: Disabled

    Active scripting: Allowed

    Script ActiveX controls marked as safe for scripting: Allowed

     

    File Scan Data-->

    File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100

     

    Other data-->

    Office Details: <GenuineResults><MachineData><UGUID>{D06C7BFC-1C92-49C7-9015-F4FB614D095B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-B3MWK</PKey><PID>00371-OEM-9044416-10755</PID><PIDType>3</PIDType><SID>S-1-5-21-3758271357-1879685353-2364571816</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>0603   </Version><SMBIOSVersion major="2" minor="5"/><Date>20101029000000.000000+000</Date></BIOS><HWID>4ED43B07018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

     

    Spsys.log Content: 0x80070002

     

    Licensing Data-->

    Software licensing service version: 6.1.7601.17514

     

    Name: Windows(R) 7, Professional edition

    Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel

    Activation ID: e120e868-3df2-464a-95a0-b52fa5ada4bf

    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f

    Extended PID: 00371-00180-444-110755-02-1033-7600.0000-0122011

    Installation ID: 002713423431048735995015758110277002586652171094200670

    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338

    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339

    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341

    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340

    Partial Product Key: B3MWK

    License Status: Licensed

    Remaining Windows rearm count: 4

    Trusted time: 1/27/2012 12:13:44 PM

     

    Windows Activation Technologies-->

    HrOffline: 0x8004FE21

    HrOnline: N/A

    HealthStatus: 0x0000000000000040

    Event Time Stamp: 1:26:2012 21:45

    ActiveX: Registered, Version: 7.1.7600.16395

    Admin Service: Registered, Version: 7.1.7600.16395

    HealthStatus Bitmask Output:

    Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui

     

     

    HWID Data-->

    HWID Hash Current: OgAAAAMABgABAAEAAAABAAAAAgABAAEA6GGasEPkuXh3Fqp/GLAMVKyLXg54GTg4DD3KxPJcj/zqgg==

     

    OEM Activation 1.0 Data-->

    N/A

     

    OEM Activation 2.0 Data-->

    BIOS valid for OA 2.0: yes, but no SLIC table

    Windows marker version: N/A

    OEMID and OEMTableID Consistent: N/A

    BIOS Information: 

      ACPI Table Name OEMID Value OEMTableID Value

      APIC 102910 APIC2206

      FACP 102910 FACP2206

      HPET 102910 OEMHPET 

      MCFG 102910 OEMMCFG 

      OEMB 102910 OEMB2206

      ASPT 102910 PerfTune

      OSFR 102910 OEMOSFR 

     

     

    • Moved by Carey FrischMVP, Moderator Friday, January 27, 2012 11:06 PM Moved to more appropriate forum category (From:Windows 7 Installation, Setup, and Deployment)
    Friday, January 27, 2012 8:19 PM

Answers

  • Interesting - they appear to be the same file - and they should not be!

    You should rename the one in the System32 folder, and then replace it, preferably using SFC (if it'll work then!)

    To rename the file you will have to take ownership of it, and amend the permissions.

    Once renamed, do NOT reboot until you have checked that the file has been replaced, or you are likely to be unable to boot the system.

    If you can't get SFC to work  to replace the file, then you will have to do a manual replacement, copying the file from folder

    C:\Windows\winsxs\x86_microsoft-windows-security-spp-clientext_31bf3856ad364e35_6.1.7600.16385_none_cc9d4bf812728aae


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    • Proposed as answer by Darin Smith MS Monday, January 30, 2012 11:39 PM
    • Marked as answer by eevans24 Sunday, February 12, 2012 10:35 PM
    Sunday, January 29, 2012 12:02 PM
    Moderator
  • An intermittent problem may mean two programs are contending for resources (race condition) at the time the WAT software is making a check.  You can try running in Clean Start mode to shut down third party programs and services and see if the condition continues.  If not, then start adding back programs until the condition reappears, thus identifying at least one of the culprits.  It is a time-honored debugging technique and is well supported by MS at

    http://support.microsoft.com/kb/331796


    Colin Barnhorst Windows 7 Ultimate x64 on DIY with 6GB ram.
    • Proposed as answer by Darin Smith MS Friday, February 3, 2012 11:18 PM
    • Marked as answer by Darin Smith MS Monday, February 6, 2012 10:50 PM
    Thursday, February 2, 2012 8:06 PM
    Answerer

All replies

  • Try running the System File Checker.  Click Start, type 'cmd' in the Search/Run box, and right click on the CMD icon at the top of the results pane.  Select Run as Administrator.  When the cmd window opens type 'sfc /scannow' at the prompt and hit Enter.  When the scan completes close the cmd window.  Restart and post a new copy of the MGADiag report in your next reply.

    You can also try using System Restore to recover to a point before the error appeared.

     


    Colin Barnhorst Windows 7 Ultimate x64 on DIY with 6GB ram.
    Friday, January 27, 2012 11:51 PM
    Answerer
  • Thanks,

     

    I ran sfc /scannow and it finished but gave some info about files it couldn't scan.  The screen reads:  Windows Respurce Protection found corrupt files but was unable to fix some of them.  Details are included in the CBS.Log windir\logs\CBS\CBS.log.  Iv'e looked at the log but don't really know what I am looking for.  There are errors in it.

     

    I cannot use an old restore point because I switched off system restore to save resources. 

     

    Thanks for your continued help!  I am still getting the Not "Genuine message"

     

    I also tried reinstalling the recent Activation Security Patch.  That didn't resolve things either.

    Here's the latest MGA diag:

     

    Diagnostic Report (1.9.0027.0):

    -----------------------------------------

    Windows Validation Data-->

     

    Validation Code: 0x8004FE21

    Cached Online Validation Code: 0x0

    Windows Product Key: *****-*****-JTX9G-P899V-B3MWK

    Windows Product Key Hash: QBc9Acf3tDzO+qbbfkhPQim6Xso=

    Windows Product ID: 00371-OEM-9044416-10755

    Windows Product ID Type: 3

    Windows License Type: OEM System Builder

    Windows OS version: 6.1.7601.2.00010100.1.0.048

    ID: {D06C7BFC-1C92-49C7-9015-F4FB614D095B}(3)

    Is Admin: Yes

    TestCab: 0x0

    LegitcheckControl ActiveX: N/A, hr = 0x80070002

    Signed By: N/A, hr = 0x80070002

    Product Name: Windows 7 Professional

    Architecture: 0x00000009

    Build lab: 7601.win7sp1_gdr.110622-1506

    TTS Error: 

    Validation Diagnostic: 

    Resolution Status: N/A

     

    Vista WgaER Data-->

    ThreatID(s): N/A, hr = 0x80070002

    Version: N/A, hr = 0x80070002

     

    Windows XP Notifications Data-->

    Cached Result: N/A, hr = 0x80070002

    File Exists: No

    Version: N/A, hr = 0x80070002

    WgaTray.exe Signed By: N/A, hr = 0x80070002

    WgaLogon.dll Signed By: N/A, hr = 0x80070002

     

    OGA Notifications Data-->

    Cached Result: N/A, hr = 0x80070002

    Version: N/A, hr = 0x80070002

    OGAExec.exe Signed By: N/A, hr = 0x80070002

    OGAAddin.dll Signed By: N/A, hr = 0x80070002

     

    OGA Data-->

    Office Status: 109 N/A

    OGA Version: N/A, 0x80070002

    Signed By: N/A, hr = 0x80070002

    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

     

    Browser Data-->

    Proxy settings: N/A

    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)

    Default Browser: C:\Users\Evans\AppData\Local\Google\Chrome\Application\chrome.exe

    Download signed ActiveX controls: Prompt

    Download unsigned ActiveX controls: Disabled

    Run ActiveX controls and plug-ins: Allowed

    Initialize and script ActiveX controls not marked as safe: Disabled

    Allow scripting of Internet Explorer Webbrowser control: Disabled

    Active scripting: Allowed

    Script ActiveX controls marked as safe for scripting: Allowed

     

    File Scan Data-->

    File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100

     

    Other data-->

    Office Details: <GenuineResults><MachineData><UGUID>{D06C7BFC-1C92-49C7-9015-F4FB614D095B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-B3MWK</PKey><PID>00371-OEM-9044416-10755</PID><PIDType>3</PIDType><SID>S-1-5-21-3758271357-1879685353-2364571816</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>0603   </Version><SMBIOSVersion major="2" minor="5"/><Date>20101029000000.000000+000</Date></BIOS><HWID>4ED43B07018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

     

    Spsys.log Content: 0x80070002

     

    Licensing Data-->

    Software licensing service version: 6.1.7601.17514

     

    Name: Windows(R) 7, Professional edition

    Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel

    Activation ID: e120e868-3df2-464a-95a0-b52fa5ada4bf

    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f

    Extended PID: 00371-00180-444-110755-02-1033-7600.0000-0122011

    Installation ID: 002713423431048735995015758110277002586652171094200670

    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338

    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339

    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341

    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340

    Partial Product Key: B3MWK

    License Status: Licensed

    Remaining Windows rearm count: 4

    Trusted time: 1/27/2012 5:38:11 PM

     

    Windows Activation Technologies-->

    HrOffline: 0x8004FE21

    HrOnline: N/A

    HealthStatus: 0x0000000000000040

    Event Time Stamp: 1:27:2012 17:04

    ActiveX: Registered, Version: 7.1.7600.16395

    Admin Service: Registered, Version: 7.1.7600.16395

    HealthStatus Bitmask Output:

    Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui

     

     

    HWID Data-->

    HWID Hash Current: OgAAAAMABgABAAEAAAABAAAAAgABAAEA6GGasEPkuXh3Fqp/GLAMVKyLXg54GTg4DD3KxPJcj/zqgg==

     

    OEM Activation 1.0 Data-->

    N/A

     

    OEM Activation 2.0 Data-->

    BIOS valid for OA 2.0: yes, but no SLIC table

    Windows marker version: N/A

    OEMID and OEMTableID Consistent: N/A

    BIOS Information: 

      ACPI Table Name OEMID Value OEMTableID Value

      APIC 102910 APIC2206

      FACP 102910 FACP2206

      HPET 102910 OEMHPET 

      MCFG 102910 OEMMCFG 

      OEMB 102910 OEMB2206

      ASPT 102910 PerfTune

      OSFR 102910 OEMOSFR 

     

     

     

     

     

    Saturday, January 28, 2012 1:40 AM
  • "eevans24" wrote in message news:d2f62d59-ae46-44af-9bd7-70a5b60f6e40...

    Thanks,

     

    I ran sfc /scannow and it finished but gave some info about files it couldn't scan.  The screen reads: Windows Respurce Protection found corrupt files but was unable to fix some of them.  Details are included in the CBS.Log windir\logs\CBS\CBS.log.  Iv'e looked at the log but don't really know what I am looking for.  There are errors in it.

     

    I cannot use an old restore point because I switched off system restore to save resources.

     

    Thanks for your continued help!  I am still getting the Not "Genuine message"

     

    I also tried reinstalling the recent Activation Security Patch.  That didn't resolve things either.

    Here's the latest MGA diag:

     

    Diagnostic Report (1.9.0027.0):

    -----------------------------------------

    Windows Validation Data-->

     

    Validation Code: 0x8004FE21

    Cached Online Validation Code: 0x0

    Windows Product Key: *****-*****-JTX9G-P899V-B3MWK

    Windows Product Key Hash: QBc9Acf3tDzO+qbbfkhPQim6Xso=

    Windows Product ID: 00371-OEM-9044416-10755

    Windows Product ID Type: 3

    Windows License Type: OEM System Builder

    Windows OS version: 6.1.7601.2.00010100.1.0.048

    ID: {D06C7BFC-1C92-49C7-9015-F4FB614D095B}(3)

    Is Admin: Yes

    TestCab: 0x0

    LegitcheckControl ActiveX: N/A, hr = 0x80070002

    Signed By: N/A, hr = 0x80070002

    Product Name: Windows 7 Professional

    Architecture: 0x00000009

    Build lab: 7601.win7sp1_gdr.110622-1506

    TTS Error:

    Validation Diagnostic:

    Resolution Status: N/A

     

    Vista WgaER Data-->

    ThreatID(s): N/A, hr = 0x80070002

    Version: N/A, hr = 0x80070002

     

    Windows XP Notifications Data-->

    Cached Result: N/A, hr = 0x80070002

    File Exists: No

    Version: N/A, hr = 0x80070002

    WgaTray.exe Signed By: N/A, hr = 0x80070002

    WgaLogon.dll Signed By: N/A, hr = 0x80070002

     

    OGA Notifications Data-->

    Cached Result: N/A, hr = 0x80070002

    Version: N/A, hr = 0x80070002

    OGAExec.exe Signed By: N/A, hr = 0x80070002

    OGAAddin.dll Signed By: N/A, hr = 0x80070002

     

    OGA Data-->

    Office Status: 109 N/A

    OGA Version: N/A, 0x80070002

    Signed By: N/A, hr = 0x80070002

    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

     

    Browser Data-->

    Proxy settings: N/A

    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)

    Default Browser: C:\Users\Evans\AppData\Local\Google\Chrome\Application\chrome.exe

    Download signed ActiveX controls: Prompt

    Download unsigned ActiveX controls: Disabled

    Run ActiveX controls and plug-ins: Allowed

    Initialize and script ActiveX controls not marked as safe: Disabled

    Allow scripting of Internet Explorer Webbrowser control: Disabled

    Active scripting: Allowed

    Script ActiveX controls marked as safe for scripting: Allowed

     

    File Scan Data-->

    File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100

     

    Other data-->

    Office Details: <GenuineResults><MachineData><UGUID>{D06C7BFC-1C92-49C7-9015-F4FB614D095B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-B3MWK</PKey><PID>00371-OEM-9044416-10755</PID><PIDType>3</PIDType><SID>S-1-5-21-3758271357-1879685353-2364571816</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>0603   </Version><SMBIOSVersion major="2" minor="5"/><Date>20101029000000.000000+000</Date></BIOS><HWID>4ED43B07018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

     

    Spsys.log Content: 0x80070002

     

    Licensing Data-->

    Software licensing service version: 6.1.7601.17514

     

    Name: Windows(R) 7, Professional edition

    Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel

    Activation ID: e120e868-3df2-464a-95a0-b52fa5ada4bf

    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f

    Extended PID: 00371-00180-444-110755-02-1033-7600.0000-0122011

    Installation ID: 002713423431048735995015758110277002586652171094200670

    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338

    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339

    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341

    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340

    Partial Product Key: B3MWK

    License Status: Licensed

    Remaining Windows rearm count: 4

    Trusted time: 1/27/2012 5:38:11 PM

     

    Windows Activation Technologies-->

    HrOffline: 0x8004FE21

    HrOnline: N/A

    HealthStatus: 0x0000000000000040

    Event Time Stamp: 1:27:2012 17:04

    ActiveX: Registered, Version: 7.1.7600.16395

    Admin Service: Registered, Version: 7.1.7600.16395

    HealthStatus Bitmask Output:

    Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui

     

     

    HWID Data-->

    HWID Hash Current: OgAAAAMABgABAAEAAAABAAAAAgABAAEA6GGasEPkuXh3Fqp/GLAMVKyLXg54GTg4DD3KxPJcj/zqgg==

     

    OEM Activation 1.0 Data-->

    N/A

     

    OEM Activation 2.0 Data-->

    BIOS valid for OA 2.0: yes, but no SLIC table

    Windows marker version: N/A

    OEMID and OEMTableID Consistent: N/A

    BIOS Information:

      ACPI Table Name OEMID Value OEMTableID Value

      APIC 102910 APIC2206

      FACP 102910 FACP2206

      HPET 102910 OEMHPET

      MCFG 102910 OEMMCFG

      OEMB 102910 OEMB2206

      ASPT 102910 PerfTune

      OSFR 102910 OEMOSFR

     

     

     

     

     

    Please open Windows Explorer and look for the file
    C:\Windows\System32\SLCEXT.DLL
    right-click on it and select Properties
    what is the exact size of the file?
    If you click on the details tab, what does it say there?
     
    repeat for C:\Windows\SysWOW64\SLCEXT.DLL as well -
    post back with details, and we may be able to assist.
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, January 28, 2012 9:24 AM
    Moderator
  • C:\Windows\System32\SLCEXT.DLL is 18k


    C:\Windows\SysWOW64\SLCEXT.DLL is 16kb


    Saturday, January 28, 2012 11:16 PM
  • "eevans24" wrote in message news:0fc318da-bf2d-43e5-9ab2-6aa3625719c3...

    C:\Windows\System32\SLCEXT.DLL is 18k


     

    C:\Windows\SysWOW64\SLCEXT.DLL is 16kb

     


     
     
     
    I asked for the EXACT size (as indicated on the front page of the Properties window), not the abbreviated size – even 1 byte difference could indicate a major problem.
     
    That said, it looks normal, at first glance.
     
    Please run the following commands in a Command Prompt window – they may show us what the problem is.
    ICACLS C:\Windows\System32\slcext.dll
    ICACLS C:\Windows\System32\en-us\slcext.dll.mui
    ICACLS C:\Windows\SysWOW64\slcext.dll
    ICACLS C:\Windows\SysWOW64\en-us\slcext.dll.mui
    Copy/paste the results to your response.
    (to copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.)
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, January 28, 2012 11:30 PM
    Moderator
  • Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
    C:\Users\Evans>ICACLS C:\Windows\System32\slcext.dll
    C:\Windows\System32\slcext.dll NT SERVICE\TrustedInstaller:(F)
                                   BUILTIN\Administrators:(RX)
                                   NT AUTHORITY\SYSTEM:(RX)
                                   BUILTIN\Users:(RX)
    Successfully processed 1 files; Failed processing 0 files
    C:\Users\Evans>ICACLS C:\Windows\System32\en-us\slcext.dll.mui
    C:\Windows\System32\en-us\slcext.dll.mui NT SERVICE\TrustedInstaller:(F)
                                             BUILTIN\Administrators:(RX)
                                             NT AUTHORITY\SYSTEM:(RX)
                                             BUILTIN\Users:(RX)
    Successfully processed 1 files; Failed processing 0 files
    C:\Users\Evans>ICACLS C:\Windows\SysWOW64\slcext.dll
    C:\Windows\SysWOW64\slcext.dll NT SERVICE\TrustedInstaller:(F)
                                   BUILTIN\Administrators:(RX)
                                   NT AUTHORITY\SYSTEM:(RX)
                                   BUILTIN\Users:(RX)
    Successfully processed 1 files; Failed processing 0 files
    C:\Users\Evans>ICACLS C:\Windows\SysWOW64\en-us\slcext.dll.mui
    C:\Windows\SysWOW64\en-us\slcext.dll.mui NT SERVICE\TrustedInstaller:(F)
                                             BUILTIN\Administrators:(RX)
                                             NT AUTHORITY\SYSTEM:(RX)
                                             BUILTIN\Users:(RX)
    Successfully processed 1 files; Failed processing 0 files
    C:\Users\Evans>
    Sunday, January 29, 2012 12:31 AM
  • Here's those file sizes:

     

    C:\Windows\System32\SLCEXT.DLL


     

    C:\Windows\SysWOW64\SLCEXT.DL

    Sunday, January 29, 2012 12:40 AM
  • "eevans24" wrote in message news:225ee328-f396-44fd-bd7b-73649481b4eb...
    Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
    C:\Users\Evans>ICACLS C:\Windows\System32\slcext.dll
    C:\Windows\System32\slcext.dll NT SERVICE\TrustedInstaller:(F)
                                   BUILTIN\Administrators:(RX)
                                   NT AUTHORITY\SYSTEM:(RX)
                                   BUILTIN\Users:(RX)
    Successfully processed 1 files; Failed processing 0 files
    C:\Users\Evans>ICACLS C:\Windows\System32\en-us\slcext.dll.mui
    C:\Windows\System32\en-us\slcext.dll.mui NT SERVICE\TrustedInstaller:(F)
                                             BUILTIN\Administrators:(RX)
                                             NT AUTHORITY\SYSTEM:(RX)
                                             BUILTIN\Users:(RX)
    Successfully processed 1 files; Failed processing 0 files
    C:\Users\Evans>ICACLS C:\Windows\SysWOW64\slcext.dll
    C:\Windows\SysWOW64\slcext.dll NT SERVICE\TrustedInstaller:(F)
                                   BUILTIN\Administrators:(RX)
                                   NT AUTHORITY\SYSTEM:(RX)
                                   BUILTIN\Users:(RX)
    Successfully processed 1 files; Failed processing 0 files
    C:\Users\Evans>ICACLS C:\Windows\SysWOW64\en-us\slcext.dll.mui
    C:\Windows\SysWOW64\en-us\slcext.dll.mui NT SERVICE\TrustedInstaller:(F)
                                             BUILTIN\Administrators:(RX)
                                             NT AUTHORITY\SYSTEM:(RX)
                                             BUILTIN\Users:(RX)
    Successfully processed 1 files; Failed processing 0 files
    C:\Users\Evans>
     
    That also looks normal enough.
     
    I don’t think that this is likely to be fixable in a forum context – I suspect that  you are suffering the residues of a malware infestation which could be difficult to fix at the best of times.
     
    One thing you could try is running SFC from a WinRE boot
    Restart the PC, and tap the F8 Key as it goes through the  POST routine at the start – you should get a menu up eventually which will offer a long list of options. Pick ‘Repair your Computer’
    Log in, and when the options list comes up pick Command Prompt.
    At the prompt type
    DIR C:\
    and check that this lists the files in your OS drive
    If not, then try D:\ (and so on, until you get the right one)
     
    Then, type
    SFC /SCANNOW /OFFBOOTDIR=<drive>:\ /OFFWINDIR=<drive>:\windows
    where <drive> is the OS Drive  letter you discovered above.
    This should start SFC scanning for errors, and it may have more success than the online one.
    Once complete, type
    EXIT and hit the Enter key, then reboot the machine.

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Sunday, January 29, 2012 11:46 AM
    Moderator
  • Interesting - they appear to be the same file - and they should not be!

    You should rename the one in the System32 folder, and then replace it, preferably using SFC (if it'll work then!)

    To rename the file you will have to take ownership of it, and amend the permissions.

    Once renamed, do NOT reboot until you have checked that the file has been replaced, or you are likely to be unable to boot the system.

    If you can't get SFC to work  to replace the file, then you will have to do a manual replacement, copying the file from folder

    C:\Windows\winsxs\x86_microsoft-windows-security-spp-clientext_31bf3856ad364e35_6.1.7600.16385_none_cc9d4bf812728aae


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    • Proposed as answer by Darin Smith MS Monday, January 30, 2012 11:39 PM
    • Marked as answer by eevans24 Sunday, February 12, 2012 10:35 PM
    Sunday, January 29, 2012 12:02 PM
    Moderator
  • OK.  I tried running SFC from the Windows Repair Boot command prompt.  While if found errors, it could not apparently fix them.  

    Next I used SFC to find, change permissions and replace the file c:\windows\system32\slcext.dll.  Now the file size has changed:

    I'm gonna reboot.  Say some "Hail Mary's" for me.  I'll advice once I know whether this has fixed my problem.  If the computer won't reboot, stay tuned.  I'll have to wait until later in the week to reload it.

    Wednesday, February 1, 2012 12:42 AM
  • "eevans24" wrote in message news:cb55e818-ca3d-4555-b70a-211f22e455ac...

    OK.  I tried running SFC from the Windows Repair Boot command prompt.  While if found errors, it could not apparently fix them. 

    Next I used SFC to find, change permissions and replace the file c:\windows\system32\slcext.dll.  Now the file size has changed:

     

    I'm gonna reboot.  Say some "Hail Mary's" for me.  I'll advice once I know whether this has fixed my problem.  If the computer won't reboot, stay tuned.  I'll have to wait until later in the week to reload it.

    Good Luck!

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Wednesday, February 1, 2012 12:47 AM
    Moderator
  • Well, the computer rebooted fine but I still get the "Not Genuine" prompt maybe 4 times a day.  Any more ideas?  Thanks for the help.  I am learning allot even though I may be headed to Reloadville.
    Thursday, February 2, 2012 7:43 PM
  • An intermittent problem may mean two programs are contending for resources (race condition) at the time the WAT software is making a check.  You can try running in Clean Start mode to shut down third party programs and services and see if the condition continues.  If not, then start adding back programs until the condition reappears, thus identifying at least one of the culprits.  It is a time-honored debugging technique and is well supported by MS at

    http://support.microsoft.com/kb/331796


    Colin Barnhorst Windows 7 Ultimate x64 on DIY with 6GB ram.
    • Proposed as answer by Darin Smith MS Friday, February 3, 2012 11:18 PM
    • Marked as answer by Darin Smith MS Monday, February 6, 2012 10:50 PM
    Thursday, February 2, 2012 8:06 PM
    Answerer
  • No reply from the Original Poster.

    Issue is assumed to be resolved.


    Darin MS
    Monday, February 6, 2012 10:51 PM
  • So I reported that changing this file did not stop the "Not Genuine" Notices.  However, a few hours after reporting this, I stopped getting the pop up.  Either this fix worked or an update resolved the problem.  It is still a bit of a mystery but if nothing else I got some good advice from this string.  Thanks!
    Sunday, February 12, 2012 10:37 PM
  • "eevans24" wrote in message news:d738b5ae-dfbb-4423-8b39-4260c7bf7caa...
    So I reported that changing this file did not stop the "Not Genuine" Notices.  However, a few hours after reporting this, I stopped getting the pop up.  Either this fix worked or an update resolved the problem.  It is still a bit of a mystery but if nothing else I got some good advice from this string.  Thanks!
     
    We got there in the end, then :)
     
    Please post another MGADiag report (if you dare!) so that we can see what’s changed, if anything.
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Sunday, February 12, 2012 10:43 PM
    Moderator
  • Ok Here it is...cringing.

    Diagnostic Report (1.9.0027.0):

    -----------------------------------------
    Windows Validation Data-->


    Validation Code: 0
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-JTX9G-P899V-B3MWK
    Windows Product Key Hash: QBc9Acf3tDzO+qbbfkhPQim6Xso=
    Windows Product ID: 00371-OEM-9044416-10755
    Windows Product ID Type: 3
    Windows License Type: OEM System Builder
    Windows OS version: 6.1.7601.2.00010100.1.0.048
    ID: {D06C7BFC-1C92-49C7-9015-F4FB614D095B}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Professional
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.110622-1506
    TTS Error: 
    Validation Diagnostic: 
    Resolution Status: N/A


    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002


    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002


    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002


    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3


    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Users\Evans\AppData\Local\Google\Chrome\Application\chrome.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed


    File Scan Data-->
    File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100
    File Mismatch: C:\Windows\system32\slcext.dll[Hr = 0x80004005]


    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{D06C7BFC-1C92-49C7-9015-F4FB614D095B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-B3MWK</PKey><PID>00371-OEM-9044416-10755</PID><PIDType>3</PIDType><SID>S-1-5-21-3758271357-1879685353-2364571816</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>0603   </Version><SMBIOSVersion major="2" minor="5"/><Date>20101029000000.000000+000</Date></BIOS><HWID>4ED43B07018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  


    Spsys.log Content: 0x80070002


    Licensing Data-->
    Software licensing service version: 6.1.7601.17514


    Name: Windows(R) 7, Professional edition
    Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
    Activation ID: e120e868-3df2-464a-95a0-b52fa5ada4bf
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00371-00180-444-110755-02-1033-7600.0000-0122011
    Installation ID: 002713423431048735995015758110277002586652171094200670
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: B3MWK
    License Status: Licensed
    Remaining Windows rearm count: 4
    Trusted time: 2/13/2012 4:17:34 PM


    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0x8007007F
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 2:3:2012 17:38
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:




    HWID Data-->
    HWID Hash Current: OgAAAAMABgABAAEAAAABAAAAAgABAAEA6GGasEPkuXh3Fqp/GLAMVKyLXg54GTg4DD3KxPJcj/zqgg==


    OEM Activation 1.0 Data-->
    N/A


    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes, but no SLIC table
    Windows marker version: N/A
    OEMID and OEMTableID Consistent: N/A
    BIOS Information: 
      ACPI Table Name OEMID Value OEMTableID Value
      APIC 102910 APIC2206
      FACP 102910 FACP2206
      HPET 102910 OEMHPET 
      MCFG 102910 OEMMCFG 
      OEMB 102910 OEMB2206
      ASPT 102910 PerfTune
      OSFR 102910 OEMOSFR 




    Tuesday, February 14, 2012 12:18 AM
  • "eevans24" wrote in message news:d8fa390b-b5f9-492e-87fe-d29d5577fa4c...

    Ok Here it is...cringing.

    Diagnostic Report (1.9.0027.0):

    -----------------------------------------
    Windows Validation Data-->


    Validation Code: 0
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-JTX9G-P899V-B3MWK
    Windows Product Key Hash: QBc9Acf3tDzO+qbbfkhPQim6Xso=
    Windows Product ID: 00371-OEM-9044416-10755
    Windows Product ID Type: 3
    Windows License Type: OEM System Builder
    Windows OS version: 6.1.7601.2.00010100.1.0.048


    File Scan Data-->
    File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100
    File Mismatch: C:\Windows\system32\slcext.dll[Hr = 0x80004005]



    Other data-->
    SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>0603   </Version><SMBIOSVersion major="2" minor="5"/><Date>20101029000000.000000+000</Date></BIOSLicensing Data-->
    Software licensing service version: 6.1.7601.17514


    Name: Windows(R) 7, Professional edition
    Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
    Partial Product Key: B3MWK
    License Status: Licensed
    Remaining Windows rearm count: 4
    Trusted time: 2/13/2012 4:17:34 PM


    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0x8007007F
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 2:3:2012 17:38
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:





     

    There’s two errors – which means that the install won’t validate (last validation was on 3rd Feb)
    I *think* the problem with the SLCEXT.DLL file is that it is still blocked as a ‘foreign’ file (from another computer).
    If you find it in System32, and right-click on it, select Properties.
    it will probably have a Security section at the bottom of the General tab page – click on the Unblock button, and OK out, then run another MGADiag report.
     
    let’s see if that problem gets sorted, and then we can see about the SLCEXT.DLL file if necessary.
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Tuesday, February 14, 2012 12:32 AM
    Moderator
  • The file is there but it doesn't appear to be blocked.  The System has Read, and Read and Execute permissions.

    Tuesday, February 14, 2012 9:33 PM