locked
windows is not genuine RRS feed

  • Question

  • Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 50
    Cached Online Validation Code: 0xc004c4ab
    Windows Product Key: *****-*****-MV8MH-98QJM-24367
    Windows Product Key Hash: wgci5Gdejx4esg7++zTOe3LWF+4=
    Windows Product ID: 00371-OEM-8992671-00437
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010100.1.0.048
    ID: {BD60D6A8-0F54-4E1F-86D8-F6208F4668D3}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Professional
    Architecture: 0x00000000
    Build lab: 7601.win7sp1_gdr.120330-1504
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Project Professional 2003 - 100 Genuine
    Microsoft Office Visio Professional 2003 - 100 Genuine
    Microsoft Office Professional Plus 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->
    File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[Hr = 0x80070003]
    File Mismatch: C:\Windows\system32\wat\npwatweb.dll[Hr = 0x80070003]
    File Mismatch: C:\Windows\system32\wat\watux.exe[Hr = 0x80070003]
    File Mismatch: C:\Windows\system32\wat\watweb.dll[Hr = 0x80070003]

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{BD60D6A8-0F54-4E1F-86D8-F6208F4668D3}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-24367</PKey><PID>00371-OEM-8992671-00437</PID><PIDType>2</PIDType><SID>S-1-5-21-2229995793-1469633091-3938006892</SID><SYSTEM><Manufacturer>LENOVO</Manufacturer><Model>42915M8</Model></SYSTEM><BIOS><Manufacturer>LENOVO</Manufacturer><Version>8DET56WW (1.26 )</Version><SMBIOSVersion major="2" minor="6"/><Date>20111201000000.000000+000</Date></BIOS><HWID>CC220400018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Arab Standard Time(GMT+03:00)</TimeZone><iJoin>1</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-MPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{903B0409-6000-11D3-8CFE-0150048383C9}"><LegitResult>100</LegitResult><Name>Microsoft Office Project Professional 2003</Name><Ver>11</Ver><Val>5EA9C3672EB0500</Val><Hash>GZD+9sfb5ecL3RxyV4F75a86u2M=</Hash><Pid>72077-640-0000106-55542</Pid><PidType>14</PidType></Product><Product GUID="{90510409-6000-11D3-8CFE-0150048383C9}"><LegitResult>100</LegitResult><Name>Microsoft Office Visio Professional 2003</Name><Ver>11</Ver><Val>5EA9C3672EB0500</Val><Hash>GZD+9sfb5ecL3RxyV4F75a86u2M=</Hash><Pid>72085-640-0000106-55560</Pid><PidType>14</PidType></Product><Product GUID="{90120000-0011-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Professional Plus 2007</Name><Ver>12</Ver><Val>ACBEB860B122586</Val><Hash>TmN0IVUCFZneqXqrPs2iVcZjs7Q=</Hash><Pid>89409-707-1133364-65173</Pid><PidType>14</PidType></Product></Products><Applications><App Id="3B" Version="11" Result="100"/><App Id="51" Version="11" Result="100"/><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, Professional edition
    Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
    Activation ID: 50e329f7-a5fa-46b2-85fd-f224e5da7764
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00371-00178-926-700437-02-2052-7601.0000-1702012
    Installation ID: 008424848142876380803832902522285644726222216656117864
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: 24367
    License Status: Notification
    Notification Reason: 0xC004F200 (non-genuine).
    Remaining Windows rearm count: 2
    Trusted time: 11/5/2012 7:04:26 PM

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0xC004C4AB
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 11:5:2012 11:04
    ActiveX: Not Registered - 0x80040154
    Admin Service: Not Registered - 0x80040154
    HealthStatus Bitmask Output:


    HWID Data-->
    HWID Hash Current: LAAAAAAAAgABAAEAAAABAAAAAgABAAEA6GGgoZY0VqZIMG4/bgY0MIBtLnM=

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            LENOVO        TP-8D   
      FACP            LENOVO        TP-8D   
      HPET            LENOVO        TP-8D   
      MCFG            LENOVO        TP-8D   
      SLIC            HPQOEM        SLIC-MPC
      SSDT            LENOVO        TP-SSDT2
      SSDT            LENOVO        TP-SSDT2
      SSDT            LENOVO        TP-SSDT2
      ECDT            LENOVO        TP-8D   
      ASF!            LENOVO        TP-8D   
      TCPA            PTL        LENOVO
      SSDT            LENOVO        TP-SSDT2
      SSDT            LENOVO        TP-SSDT2
      UEFI            LENOVO        TP-8D   
      UEFI            LENOVO        TP-8D   
      UEFI            LENOVO        TP-8D   

    Monday, November 5, 2012 5:11 PM

Answers

  • YOur installation is counterfeit.

    You have a Lenovo PC with an HP SLIC table in the BIOS (apparently!)

    For which version and edition of Windows is the PC licensed, according to the COA sticker on the case?

    You will need to reformat and reinstall using legitimate media and the COA Key for that machine or the manufacturer's proper Recovery media


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Monday, November 5, 2012 5:43 PM
    Moderator

All replies

  • YOur installation is counterfeit.

    You have a Lenovo PC with an HP SLIC table in the BIOS (apparently!)

    For which version and edition of Windows is the PC licensed, according to the COA sticker on the case?

    You will need to reformat and reinstall using legitimate media and the COA Key for that machine or the manufacturer's proper Recovery media


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Monday, November 5, 2012 5:43 PM
    Moderator
  • I have a lenovo PC with windows 7 professional genuine installed by the IT in the company.

    What do you mean by HP SLIC table in the BIOS!?

    Monday, November 5, 2012 7:42 PM
  • If what you're saying is true, then you should bring it to the attention of the company's Compliance officer, before they get audited by MS and sued for piracy.

    Your BIOS results indicate the 'resence' of a SLIC table from a Hewlett Packard machine -

      SLIC            HPQOEM        SLIC-MPC

    This is ONLY possible in the presence of a hacker's Activation Exploit. Such exploits are installed to circumvent the requirements for activation and validation - and the error

    Cached Online Validation Code: 0xc004c4ab

    indicates that such an Exploit has been discovered by Windows.

    By definition therefore the installation is counterfeit.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Monday, November 5, 2012 8:24 PM
    Moderator
  • does this action could happen due to a hacker action, malware program or it can happen when trying to make a dual boot with the internal HD or using external HD.
    • Edited by Weelo Tuesday, November 6, 2012 5:37 AM
    Tuesday, November 6, 2012 5:34 AM
  • and can this overcome by upgrading the BIOS.
    Tuesday, November 6, 2012 5:36 AM
  • No, this is deliberate action on the part of an administrator user on the machine - updating the BIOS will not remove the problem.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Tuesday, November 6, 2012 8:04 AM
    Moderator
  • That means the computer has been hacked!?

    there is no other solution than formatting and reinstall the windows?

    Tuesday, November 6, 2012 9:40 AM
  • No - it means that an Admin User sat down at the Keyboard and deleiberately installed software to circumvent activation and validation requirements.

    For what version and edition of Windows (if any!) is your computer licensed, according to teh COA stiaker on the case (if any)?

    No, there is no safe  way around it except a reformat/reinstall. It's almost impossible to tell which Exploit was used, and withuot that knowledge, it's very difficult to remove it - and you cannot be sure that the software didn't leave back-doors into the system.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Tuesday, November 6, 2012 9:52 AM
    Moderator
  • The licensed is Windows 7 Professional.

    It is not on the case or a sticker it is done by the IT, i have no idea how.

    Could be a dual boot, I am suspecting that there was a dual boot from an external HDD


    • Edited by Weelo Tuesday, November 6, 2012 10:28 AM
    Tuesday, November 6, 2012 10:26 AM
  • In that case, report it to IT, and get them to fix it - it's their responsibility, rather than yours.

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth


    Tuesday, November 6, 2012 12:12 PM
    Moderator
  • What leads you believe there was a dual boot from an external hard drive?  That cannot be done with a usb drive.  It can be done with an eSata ensclosure but your computer would need to have an eSata port.  If your computer was set up for dual boot you would most likely still see the effects by right clicking on Computer and choosing Properties and then choosing Advanced System Settings.  Choose "Settings" under Startup and Recovery and then in the drop-down menu under System Startup see if there are two OSs.  If not then dual booting was probably not involved. 

    Colin Barnhorst Windows 7 Ultimate x64 on DIY with 8GB ram.

    Wednesday, November 7, 2012 3:09 PM
    Answerer