locked
Windows 7 suddenly says its not legit? Please help RRS feed

  • Question

  • Suddenly happened, I'm not sure what kicked it off, but something is going on.  All of a sudden it says I'm not genuine, but this is a legit purchase from best Buy.  Any help on what I need to do and how I should do it?

    Thanks everyone!

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 50
    Cached Online Validation Code: 0xc004c4ab
    Windows Product Key: *****-*****-73CQT-WMF7J-3Q6C9
    Windows Product Key Hash: KaFG+RmurcM3ZxzWyfEP9WtPUJw=
    Windows Product ID: 00359-OEM-8992687-00010
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {C769D49B-4F0B-4314-BFDA-7041345A6954}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.120503-2030
    TTS Error: 
    Validation Diagnostic: 
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Users\Wallstra\AppData\Local\Google\Chrome\Application\chrome.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{C769D49B-4F0B-4314-BFDA-7041345A6954}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-3Q6C9</PKey><PID>00359-OEM-8992687-00010</PID><PIDType>2</PIDType><SID>S-1-5-21-2641853453-1150842180-4098100634</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>s5-1114</Model></SYSTEM><BIOS><Manufacturer>AMI</Manufacturer><Version>7.13</Version><SMBIOSVersion major="2" minor="6"/><Date>20110722000000.000000+000</Date></BIOS><HWID>B8543307018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-MPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, HomePremium edition
    Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
    Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00359-00178-926-800010-02-1033-7601.0000-0422011
    Installation ID: 010553047413738846493110419803825142778680619864707861
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: 3Q6C9
    License Status: Notification
    Notification Reason: 0xC004F200 (non-genuine).
    Remaining Windows rearm count: 1
    Trusted time: 9/19/2012 6:23:09 PM

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0xC004C4AB
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 8:18:2012 22:10
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:


    HWID Data-->
    HWID Hash Current: LAAAAAIAAQABAAEAAAABAAAAAQABAAEA6GFgyDRcdxYk6dh1sEBYpQ6aLnM=

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information: 
      ACPI Table Name OEMID Value OEMTableID Value
      APIC HPQOEM SLIC-CPC
      FACP HPQOEM SLIC-CPC
      DBGP HPQOEM SLIC-CPC
      HPET HPQOEM SLIC-CPC
      MCFG HPQOEM SLIC-CPC
      SSDT HPQOEM SLIC-CPC
      SLIC HPQOEM SLIC-MPC

    Wednesday, September 19, 2012 10:25 PM

Answers

  • We know that's what is installed - but what is it licensed for, according to the COA sticker??

    There is NO safe way to remove an Activation Exploit unless you know exactly which one was installed in the first place - and even then it's uncertain.

    You need to reformat and reinstall.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Friday, September 21, 2012 3:14 PM
    Moderator

All replies

  • Windows has detected the presence of a hacker's Activation Exploit to force acceptance on a non-genuine Key.

    For what version and edition of Windows is this machine licensed, according to the COA sticker on the case??

    Activation Exploits can leave backdoors wide open into your system, the only sure fix therefore is a reformat/reinstall using the manufacturer's Recovery media, or a retail disk for the licensed operating system.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Thursday, September 20, 2012 7:14 AM
    Moderator
  • The problem here is possibly a corrupted Licensing Store - until it's fixed not activation can be successful..
    Recreate the Licensing Store

    1) Click Start button.
    2) Type: CMD.exe into the 'Search programs and files' field
    3) Right-Click on CMD.exe and select Run as Administrator
    4) Type: net stop sppsvc (It may ask you if you are sure, select yes)
    Note: the Software Protection service may not be running, this is ok.
    5) Type: cd %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform
    6) Type: rename tokens.dat tokens.bar
    7) Type: cd %windir%\system32
    8) Type: net start sppsvc
    9) Type: slui.exe
    10) After a couple of seconds Windows Activation dialog will appear. You may be asked to re-activate and/or re-enter your product key or Activation may occur automatically.

    You may have to use telephone activation.

    Reboot and Post back with a new MGADiag report.

    - PCCare247
    Thursday, September 20, 2012 12:12 PM
  • It has nothing to do with a corrupted licensing store - Windows has discovered an Activation Exploit, pure and simple.

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth


    Thursday, September 20, 2012 2:18 PM
    Moderator
  • Its running Win 7 Home Premium.

    How do I remove the activation exploit? 

    Friday, September 21, 2012 2:41 PM
  • We know that's what is installed - but what is it licensed for, according to the COA sticker??

    There is NO safe way to remove an Activation Exploit unless you know exactly which one was installed in the first place - and even then it's uncertain.

    You need to reformat and reinstall.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Friday, September 21, 2012 3:14 PM
    Moderator