locked
Dell laptop Latidude E4300 says "Not genuine Windows" after 6 months of use RRS feed

  • Question

  • I purchased a new DELL Latitude E4300 in October 2009 and installed the Windows 7 sent to me by DELL in November.

    Everything has worked fine until May 19th 2010. This very day I identified virus on my USB-stick that included data from one of my clients.

    These were the problem found on the USB stick by the ClamWin antivirus:

    F:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx: Worm.Kido-59 FOUND

    F:\hjqffk.exe: Trojan.Autoit-77 FOUND

    F:\autorun.inf: Worm.Downadup-496 FOUND

    F:\cold\hott\sysdiag64.exe: Trojan.Agent-130466 FOUND

    I executed the program "Exterminate It" and scanned the full computer/memory and removed the viruses as well as the aproved to the rest of the suggested registry fixes.

    After a few hours the "Not Genuine Windows" message appeared for the first time.

    However, it seems that almost every program works fine - my only notified problem is that the old Visual Studio 6 (VB6) erases all the string values in the key: "HKEY_CURRENT_USER\Software\Microsoft\Visual Basic\6.0\RecentFiles" in the registry - each time I close the software.

    I have enclosed the output from the Windows Genuine Diagnostic Tool below.

    There is a message about file mismatches but I do not understand the implications nor what to do about it.

    I would be grateful to receive some clarifications and hints how to resolve the problem.

    Best regards

    Hakan Tornevik, Narsil AB

    (hakan@narsil.se)

     

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: N/A, hr = 0xc004f012
    Windows Product Key: *****-*****-MVRCM-TBWRT-QW3R7
    Windows Product Key Hash: vrwwiqKvQxbXXB6LJJol2Qc38Gs=
    Windows Product ID: 00371-OEM-9072926-67821
    Windows Product ID Type: 3
    Windows License Type: OEM System Builder
    Windows OS version: 6.1.7600.2.00010100.0.0.048
    ID: {D952E50C-BB2A-4AAB-8A18-B2A8BC30621C}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Professional
    Architecture: 0x00000000
    Build lab: 7600.win7_gdr.100226-1909
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->
    File Mismatch: C:\Windows\system32\en-US\sppc.dll.mui[6.1.7600.16385], Hr = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\sppcext.dll.mui[6.1.7600.16385], Hr = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\slc.dll.mui[6.1.7600.16385], Hr = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\slcext.dll.mui[6.1.7600.16385], Hr = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\sppuinotify.dll.mui[6.1.7600.16385], Hr = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\slui.exe.mui[6.1.7600.16385], Hr = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\sppcomapi.dll.mui[6.1.7600.16385], Hr = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\sppcommdlg.dll.mui[6.1.7600.16385], Hr = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\sppsvc.exe.mui[6.1.7600.16385], Hr = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\user32.dll.mui[6.1.7600.16385], Hr = 0x800b0100

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{D952E50C-BB2A-4AAB-8A18-B2A8BC30621C}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7600.2.00010100.0.0.048</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-QW3R7</PKey><PID>00371-OEM-9072926-67821</PID><PIDType>3</PIDType><SID>S-1-5-21-3978620304-3910224344-27151331</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Latitude E4300                  </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A07</Version><SMBIOSVersion major="2" minor="4"/><Date>20090507000000.000000+000</Date></BIOS><HWID>2EB83607018400F8</HWID><UserLCID>041D</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>W. Europe Standard Time(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>M09    </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7600.16385

    Name: Windows(R) 7, Professional edition
    Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
    Activation ID: e120e868-3df2-464a-95a0-b52fa5ada4bf
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00371-00180-729-267821-02-1053-7600.0000-3362009
    Installation ID: 009841420494321216832094533675948774096270139516513062
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: QW3R7
    License Status: Licensed
    Remaining Windows rearm count: 3
    Trusted time: 2010-05-31 07:48:10

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x000000000000EF60
    Event Time Stamp: 5:25:2010 18:13
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
    Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
    Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
    Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
    Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
    Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
    Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui


    HWID Data-->
    HWID Hash Current: MAAAAAEAAQABAAIAAQACAAAAAQABAAEAeqgGTMBDbAjO2SQ1hEDag8ys1F9iAkbK

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            DELL          M09   
      FACP            DELL          M09   
      HPET            DELL          M09   
      BOOT            DELL          M09   
      MCFG            DELL          M09   
      ____            DELL          M09   
      ASF!            DELL          M09   
      TCPA                   
      SLIC            DELL          M09   
      SSDT            PmRef        CpuPm

    Monday, May 31, 2010 7:00 AM

Answers

  • "Hispan" wrote in message news:303a952b-c2ec-4855-839b-de33b188cbae...
    >I purchased a new DELL Latitude E4300 in October 2009 and installed the
    >Windows 7 sent to me by DELL in November.
    >
    > Everything has worked fine until May 19th 2010. This very day I identified
    > virus on my USB-stick that included data from one of my clients.
    >
    > These were the problem found on the USB stick by the ClamWin antivirus:
     
    If you're only using ClamWin for AV - then you need to run another AV over
    the system and the stick! ClamWin is NOT a good AV.
     
     
    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
     
    Validation Code: 0x8004FE21
    Cached Online Validation Code: N/A, hr = 0xc004f012
    Windows Product Key: *****-*****-MVRCM-TBWRT-QW3R7
    Windows Product Key Hash: vrwwiqKvQxbXXB6LJJol2Qc38Gs=
    Windows Product ID: 00371-OEM-9072926-67821
    Windows Product ID Type: 3
    Windows License Type: OEM System Builder
    Windows OS version: 6.1.7600.2.00010100.0.0.048
     
     
    File Scan Data-->
    File Mismatch: C:\Windows\system32\en-US\sppc.dll.mui[6.1.7600.16385], Hr =
    0x800b0100
    File Mismatch: C:\Windows\system32\en-US\sppcext.dll.mui[6.1.7600.16385], Hr
    = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\slc.dll.mui[6.1.7600.16385], Hr =
    0x800b0100
    File Mismatch: C:\Windows\system32\en-US\slcext.dll.mui[6.1.7600.16385], Hr
    = 0x800b0100
    File Mismatch:
    C:\Windows\system32\en-US\sppuinotify.dll.mui[6.1.7600.16385], Hr =
    0x800b0100
    File Mismatch: C:\Windows\system32\en-US\slui.exe.mui[6.1.7600.16385], Hr =
    0x800b0100
    File Mismatch: C:\Windows\system32\en-US\sppcomapi.dll.mui[6.1.7600.16385],
    Hr = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\sppcommdlg.dll.mui[6.1.7600.16385],
    Hr = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\sppsvc.exe.mui[6.1.7600.16385], Hr
    = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\user32.dll.mui[6.1.7600.16385], Hr
    = 0x800b0100
     
    You have some major problems there! those files are critical not only to the
    Validation/Activation system, but also to the OS as a whole.
    Are you using Vistalisator? (a program to allow use on Language packs in
    systems not licensed to use them) If so, please Uninstall the Language
    pack, and re-run the MGADiag.
     
     
    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x000000000000EF60
    Event Time Stamp: 5:25:2010 18:13
     
    Your problems seem to have started on the 25th - how come it's taken 6 days
    to get here? <g>
     
    Run another GOOD AV over the system - preferably from an external host
    Download and install, update, and run MalwareBytes Anti-Malware from
    www.malwarebytes.org and scan on the Full scan settings.
     
    --
    Noel Paton
    CrashFixPC
     
    Nil Carborundum Illegitemi
    www.crashfixpc.co.uk
     
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Monday, May 31, 2010 8:51 AM
    Moderator

All replies

  • PLEASE REMOVE YOUR EMAIL ADDRESS FROM YOUR POST!!
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Monday, May 31, 2010 8:44 AM
    Moderator
  • "Hispan" wrote in message news:303a952b-c2ec-4855-839b-de33b188cbae...
    >I purchased a new DELL Latitude E4300 in October 2009 and installed the
    >Windows 7 sent to me by DELL in November.
    >
    > Everything has worked fine until May 19th 2010. This very day I identified
    > virus on my USB-stick that included data from one of my clients.
    >
    > These were the problem found on the USB stick by the ClamWin antivirus:
     
    If you're only using ClamWin for AV - then you need to run another AV over
    the system and the stick! ClamWin is NOT a good AV.
     
     
    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
     
    Validation Code: 0x8004FE21
    Cached Online Validation Code: N/A, hr = 0xc004f012
    Windows Product Key: *****-*****-MVRCM-TBWRT-QW3R7
    Windows Product Key Hash: vrwwiqKvQxbXXB6LJJol2Qc38Gs=
    Windows Product ID: 00371-OEM-9072926-67821
    Windows Product ID Type: 3
    Windows License Type: OEM System Builder
    Windows OS version: 6.1.7600.2.00010100.0.0.048
     
     
    File Scan Data-->
    File Mismatch: C:\Windows\system32\en-US\sppc.dll.mui[6.1.7600.16385], Hr =
    0x800b0100
    File Mismatch: C:\Windows\system32\en-US\sppcext.dll.mui[6.1.7600.16385], Hr
    = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\slc.dll.mui[6.1.7600.16385], Hr =
    0x800b0100
    File Mismatch: C:\Windows\system32\en-US\slcext.dll.mui[6.1.7600.16385], Hr
    = 0x800b0100
    File Mismatch:
    C:\Windows\system32\en-US\sppuinotify.dll.mui[6.1.7600.16385], Hr =
    0x800b0100
    File Mismatch: C:\Windows\system32\en-US\slui.exe.mui[6.1.7600.16385], Hr =
    0x800b0100
    File Mismatch: C:\Windows\system32\en-US\sppcomapi.dll.mui[6.1.7600.16385],
    Hr = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\sppcommdlg.dll.mui[6.1.7600.16385],
    Hr = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\sppsvc.exe.mui[6.1.7600.16385], Hr
    = 0x800b0100
    File Mismatch: C:\Windows\system32\en-US\user32.dll.mui[6.1.7600.16385], Hr
    = 0x800b0100
     
    You have some major problems there! those files are critical not only to the
    Validation/Activation system, but also to the OS as a whole.
    Are you using Vistalisator? (a program to allow use on Language packs in
    systems not licensed to use them) If so, please Uninstall the Language
    pack, and re-run the MGADiag.
     
     
    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x000000000000EF60
    Event Time Stamp: 5:25:2010 18:13
     
    Your problems seem to have started on the 25th - how come it's taken 6 days
    to get here? <g>
     
    Run another GOOD AV over the system - preferably from an external host
    Download and install, update, and run MalwareBytes Anti-Malware from
    www.malwarebytes.org and scan on the Full scan settings.
     
    --
    Noel Paton
    CrashFixPC
     
    Nil Carborundum Illegitemi
    www.crashfixpc.co.uk
     
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Monday, May 31, 2010 8:51 AM
    Moderator
  • If you need assistance removing the Language Packs, please create a (no cost) support request at http://support.microsoft.com/gp/contactwga

    Mention to the support person that you think it is Vistalisator related and they will know what to do.

    Thank you,


    Darin MS
    Tuesday, June 1, 2010 10:21 PM