Sign in
Microsoft.com
 
Microsoft
 
 
 

locked
Windows 7 Build 7601 This copy of Windows is not genuine RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello! I've been using my HP laptop for a good two years with little problems until recently:

    Windows 7
    Build 7601
    This copy of Windows is not genuine

    I've seen many people reporting but I'm a tech noob and can't differentiate them from mine. Help! 


    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->


    Validation Code: 0x8004FE21
    Cached Online Validation Code: N/A, hr = 0xc0000022
    Windows Product Key: *****-*****-73CQT-WMF7J-3Q6C9
    Windows Product Key Hash: KaFG+RmurcM3ZxzWyfEP9WtPUJw=
    Windows Product ID: 00359-OEM-8992687-00010
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {332ACCEB-0571-4B41-95E9-B839113E5C47}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000000
    Build lab: 7601.win7sp1_gdr.111025-1505
    TTS Error: 
    Validation Diagnostic: 
    Resolution Status: N/A


    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002


    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002


    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002


    OGA Data-->
    Office Status: 102
    2007 Microsoft Office system - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 77F760FE-153-80070002_7E90FEE8-175-80070002_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_B4D0AA8B-920-80070057


    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Users\sweety\AppData\Local\Google\Chrome\Application\chrome.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed


    File Scan Data-->


    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{332ACCEB-0571-4B41-95E9-B839113E5C47}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-3Q6C9</PKey><PID>00359-OEM-8992687-00010</PID><PIDType>2</PIDType><SID>S-1-5-21-4045023722-3459639858-265504593</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>HP Pavilion dm3 Notebook PC     </Model></SYSTEM><BIOS><Manufacturer>Hewlett-Packard</Manufacturer><Version>F.03</Version><SMBIOSVersion major="2" minor="6"/><Date>20090910000000.000000+000</Date></BIOS><HWID>41863B07018400F8</HWID><UserLCID>4809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Malay Peninsula Standard Time(GMT+08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-MPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>102</Result><Products><Product GUID="{91120000-0031-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>2007 Microsoft Office system</Name><Ver>12</Ver><PidType>19</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  


    Spsys.log Content: 0x80070002


    Licensing Data-->
    On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.
    Error: 0x80070426 


    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0001000000000000
    Event Time Stamp: 3:14:2012 20:59
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered Service: sppsvc




    HWID Data-->
    HWID Hash Current: LgAAAAEAAQABAAEAAQABAAAAAgABAAEAJJQCSU40dii8JhiN3oiuxUC7vvBGyg==


    OEM Activation 1.0 Data-->
    N/A


    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information: 
      ACPI Table Name OEMID Value OEMTableID Value
      APIC HPQOEM SLIC-MPC
      FACP HP     SLIC-MPC
      HPET HPQOEM SLIC-MPC
      BOOT HPQOEM SLIC-MPC
      MCFG HPQOEM SLIC-MPC
      DMAR 
      ASF! HPQOEM SLIC-MPC
      SLIC HPQOEM SLIC-MPC
      SSDT INTEL SataAhci
      SSDT INTEL SataAhci
      SSDT INTEL SataAhci
      SSDT INTEL SataAhci



         
    • Edited by livory Wednesday, March 14, 2012 1:09 PM
    Wednesday, March 14, 2012 1:09 PM

Answers

  • Question
    Sign in to vote
    0
    Sign in to vote
    "livory" wrote in message news:a5dcb149-5b76-4e1c-b88b-81ae9351557f...

    Okay then

     

    -----

    There has to be a problem with one of the files that the SPPSVC is loading – as far as I can see, the service itself is configured fine, and its ‘user’ (the Network Service) is fine. I expected the ‘tampered service’ error to have been in the first layer, rather than deeper.
     
    Unfortunately that’s further into the system than I’ve delved before. This means that unless you want to carry on here while we both learn, I recommend that you try WGA Support for assistance. In the past their usual response has been a repair install.
     
    WGA Support can be found here-
    North America: http://support.microsoft.com/contactus/cu_sc_genadv_master?ws=support&ws=support#tab4

    Outside North America:
    http://support.microsoft.com/contactus/?ws=support#tab0

    Please let us know if (and how) MS manage to repair the problem without a repair install of the OS - it would be useful for future reference!
    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    • Marked as answer by Darin Smith MS Wednesday, March 14, 2012 7:24 PM
    Wednesday, March 14, 2012 4:40 PM
    Moderator

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote
    "livory" wrote in message news:3924c57f-8274-4107-859d-f14eca12aa57...

    Hello! I've been using my HP laptop for a good two years with little problems until recently:

    Windows 7
    Build 7601
    This copy of Windows is not genuine

    I've seen many people reporting but I'm a tech noob and can't differentiate them from mine. Help!


    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: N/A, hr = 0xc0000022
    Windows Product Key: *****-*****-73CQT-WMF7J-3Q6C9
    Windows Product Key Hash: KaFG+RmurcM3ZxzWyfEP9WtPUJw=
    Windows Product ID: 00359-OEM-8992687-00010
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003

    Licensing Data-->
    On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.
    Error: 0x80070426     


    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0001000000000000
    Event Time Stamp: 3:14:2012 20:59
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered Service: sppsvc

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001

     
     
     
    The Software Protection Service is not running...
    Click on Start
    in the Search box, type
    SERVICES.MSC
    and hit the Enter key - accept the UAC prompt if you get one.
    Look in the console for the Software Protection service, right-click on it and select Properties.
    make sure that the Startup Type is set to Automatic (Delayed Start), and click Apply.

    Try starting the service now - do you get an error message? Does it start? does it almost immediately stop again?
    Post back with your results, and a new MGADiag report.

    If it doesn't start, then please do the following...
    Please open an Elevated (Administrator) Command Prompt window and use the following commands....

    net start sppsvc
    sc qc sppsvc
    sc queryex sppsvc
    sc qprivs sppsvc
    sc qsidtype sppsvc
    sc sdshow sppsvc

    copy and paste the results into your response (to copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response), together with the EXACT error message you get when you attempt to start the service from the Services control panel..

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Wednesday, March 14, 2012 2:37 PM
    Moderator
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hey thanks for the quick reply. 

    There was no UAC promit and the Startup Type is Automatic (Delayed Start) by default when I opened it.

    ----

    When I tried to start the service, could not start:

    Windows could not start Software Protection service on Local Computer

    Error 5: Access is denied

    ---

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->


    Validation Code: 0x8004FE21
    Cached Online Validation Code: N/A, hr = 0xc0000022
    Windows Product Key: *****-*****-73CQT-WMF7J-3Q6C9
    Windows Product Key Hash: KaFG+RmurcM3ZxzWyfEP9WtPUJw=
    Windows Product ID: 00359-OEM-8992687-00010
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {332ACCEB-0571-4B41-95E9-B839113E5C47}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000000
    Build lab: 7601.win7sp1_gdr.111025-1505
    TTS Error: 
    Validation Diagnostic: 
    Resolution Status: N/A


    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002


    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002


    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002


    OGA Data-->
    Office Status: 102
    2007 Microsoft Office system - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 77F760FE-153-80070002_7E90FEE8-175-80070002_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_B4D0AA8B-920-80070057


    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Users\sweety\AppData\Local\Google\Chrome\Application\chrome.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed


    File Scan Data-->


    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{332ACCEB-0571-4B41-95E9-B839113E5C47}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-3Q6C9</PKey><PID>00359-OEM-8992687-00010</PID><PIDType>2</PIDType><SID>S-1-5-21-4045023722-3459639858-265504593</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>HP Pavilion dm3 Notebook PC     </Model></SYSTEM><BIOS><Manufacturer>Hewlett-Packard</Manufacturer><Version>F.03</Version><SMBIOSVersion major="2" minor="6"/><Date>20090910000000.000000+000</Date></BIOS><HWID>41863B07018400F8</HWID><UserLCID>4809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Malay Peninsula Standard Time(GMT+08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-MPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>102</Result><Products><Product GUID="{91120000-0031-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>2007 Microsoft Office system</Name><Ver>12</Ver><PidType>19</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  


    Spsys.log Content: 0x80070002


    Licensing Data-->
    On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.
    Error: 0x80070426 


    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0001000000000000
    Event Time Stamp: 3:14:2012 20:59
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered Service: sppsvc




    HWID Data-->
    HWID Hash Current: LgAAAAEAAQABAAEAAQABAAAAAgABAAEAJJQCSU40dii8JhiN3oiuxUC7vvBGyg==


    OEM Activation 1.0 Data-->
    N/A


    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information: 
      ACPI Table Name OEMID Value OEMTableID Value
      APIC HPQOEM SLIC-MPC
      FACP HP     SLIC-MPC
      HPET HPQOEM SLIC-MPC
      BOOT HPQOEM SLIC-MPC
      MCFG HPQOEM SLIC-MPC
      DMAR       
      ASF! HPQOEM SLIC-MPC
      SLIC HPQOEM SLIC-MPC
      SSDT INTEL SataAhci
      SSDT INTEL SataAhci
      SSDT INTEL SataAhci
      SSDT INTEL SataAhci



    -----

    Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation.  All rights reserved.


    C:\Users\sweety>net start sppsvc
    The Software Protection service is starting.
    The Software Protection service could not be started.


    A system error has occurred.


    System error 5 has occurred.


    Access is denied.




    C:\Users\sweety>sc qc sppsvc
    [SC] QueryServiceConfig SUCCESS


    SERVICE_NAME: sppsvc
            TYPE               : 10  WIN32_OWN_PROCESS
            START_TYPE         : 2   AUTO_START  (DELAYED)
            ERROR_CONTROL      : 1   NORMAL
            BINARY_PATH_NAME   : C:\Windows\system32\sppsvc.exe
            LOAD_ORDER_GROUP   :
            TAG                : 0
            DISPLAY_NAME       : Software Protection
            DEPENDENCIES       : RpcSs
            SERVICE_START_NAME : NT AUTHORITY\NetworkService


    C:\Users\sweety>sc queryex sppsvc


    SERVICE_NAME: sppsvc
            TYPE               : 10  WIN32_OWN_PROCESS
            STATE              : 1  STOPPED
            WIN32_EXIT_CODE    : 5  (0x5)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0
            PID                : 0
            FLAGS              :


    C:\Users\sweety>sc qprivs sppsvc
    [SC] QueryServiceConfig2 SUCCESS


    SERVICE_NAME: sppsvc
            PRIVILEGES       : SeAuditPrivilege
                             : SeChangeNotifyPrivilege
                             : SeCreateGlobalPrivilege
                             : SeImpersonatePrivilege


    C:\Users\sweety>sc qsidtype sppsvc
    [SC] QueryServiceConfig2 SUCCESS


    SERVICE_NAME: sppsvc
    SERVICE_SID_TYPE:  UNRESTRICTED


    C:\Users\sweety>sc sdshow sppsvc


    D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO
    CRRC;;;IU)(A;;CCLCSWRPLOCRRC;;;SU)(A;;LCRP;;;AU)


    C:\Users\sweety>

    ----

    Wednesday, March 14, 2012 2:46 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    "livory" wrote in message news:e30df6c2-44d0-418f-977a-65b6e46f6a62...

    Hey thanks for the quick reply.

    There was no UAC promit and the Startup Type is Automatic (Delayed Start) by default when I opened it.

    ----

    When I tried to start the service, could not start:

    Windows could not start Software Protection service on Local Computer

    Error 5: Access is denied





    -----

    Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation.  All rights reserved.


    C:\Users\sweety>net start sppsvc
    The Software Protection service is starting.
    The Software Protection service could not be started.


    A system error has occurred.


    System error 5 has occurred.


    Access is denied.




    C:\Users\sweety>sc qc sppsvc
    [SC] QueryServiceConfig SUCCESS


    SERVICE_NAME: sppsvc
            TYPE               : 10  WIN32_OWN_PROCESS
            START_TYPE         : 2   AUTO_START  (DELAYED)
            ERROR_CONTROL      : 1   NORMAL
            BINARY_PATH_NAME   : C:\Windows\system32\sppsvc.exe
            LOAD_ORDER_GROUP   :
            TAG                : 0
            DISPLAY_NAME       : Software Protection
            DEPENDENCIES       : RpcSs
            SERVICE_START_NAME : NT AUTHORITY\NetworkService


    ----

     
     
     
    I suspect that I know what the problem is....
     
    Please run the following commands from an Elevated (Administrator) Command Prompt window, and post the response
     
    REG QUERY HKU
    REG QUERY HKU\S-1-5-20
    REG QUERY HKU\S-1-5-20\Environment
    REG QUERY HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20
    ICACLS C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
    ICACLS C:\Windows\ServiceProfiles\NetworkService
     
     
    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Wednesday, March 14, 2012 2:55 PM
    Moderator
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hey i think i didnt run the previous CMD as administrator -_- would you like me to re-do that one? This one is though:

    -----

    Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation.  All rights reserved.


    C:\Windows\system32>reg query hku


    HKEY_USERS\.DEFAULT
    HKEY_USERS\S-1-5-19
    HKEY_USERS\S-1-5-20
    HKEY_USERS\S-1-5-21-4045023722-3459639858-265504593-1000
    HKEY_USERS\S-1-5-21-4045023722-3459639858-265504593-1000_Classes
    HKEY_USERS\S-1-5-21-4045023722-3459639858-265504593-1004
    HKEY_USERS\S-1-5-21-4045023722-3459639858-265504593-1004_Classes
    HKEY_USERS\S-1-5-18


    C:\Windows\system32>reg query hku\s-1-5-20


    HKEY_USERS\s-1-5-20\AppEvents
    HKEY_USERS\s-1-5-20\Console
    HKEY_USERS\s-1-5-20\Control Panel
    HKEY_USERS\s-1-5-20\Environment
    HKEY_USERS\s-1-5-20\EUDC
    HKEY_USERS\s-1-5-20\Keyboard Layout
    HKEY_USERS\s-1-5-20\Network
    HKEY_USERS\s-1-5-20\Printers
    HKEY_USERS\s-1-5-20\Software
    HKEY_USERS\s-1-5-20\System


    C:\Windows\system32>reg query hku\s-1-5-20\environment


    HKEY_USERS\s-1-5-20\environment
        TEMP    REG_EXPAND_SZ    %USERPROFILE%\AppData\Local\Temp
        TMP    REG_EXPAND_SZ    %USERPROFILE%\AppData\Local\Temp




    C:\Windows\system32>reg query hku\software\microsoft\windows nt\currentversion\p
    rofilelist\s-1-5-20
    ERROR: Invalid syntax.
    Type "REG QUERY /?" for usage.


    C:\Windows\system32>icacls c:\windows\serviceprofiles\networkservice\ntuser.dat
    c:\windows\serviceprofiles\networkservice\ntuser.dat NT AUTHORITY\SYSTEM:(I)(F)
                                                         BUILTIN\Administrators:(I)(
    F)
                                                         NT AUTHORITY\NETWORK SERVIC
    E:(I)(F)


    Successfully processed 1 files; Failed processing 0 files


    C:\Windows\system32>icacls c:\windows\serviceprofiles\networkservice
    c:\windows\serviceprofiles\networkservice NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                                              BUILTIN\Administrators:(OI)(CI)(F)
                                              NT AUTHORITY\NETWORK SERVICE:(OI)(CI)(
    F)


    Successfully processed 1 files; Failed processing 0 files


    C:\Windows\system32>

    -----

    Wednesday, March 14, 2012 3:06 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    "livory" wrote in message news:0d2d8944-3557-4926-ac2a-1a024f220929...

    Hey i think i didnt run the previous CMD as administrator -_- would you like me to re-do that one? This one is though:

    -----

    Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation.  All rights reserved.





    -----

    Nah – there was only one command where it mattered, and it’s very unusual for that particular one to show anything amiss in the part that isn’t shown in the User mode CP window/
     
    All of that looks normal enough ( apart from the line where I forgot to use quotes!)
     
    Looks like I guessed wrong about the problem :(
     
    OK back to file access problems then....
     
    in an Elevated Command Prompt, run the following commands
     
    ICACLS C:\Windows\System32\sppsvc.exe
    REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /s
     
    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Wednesday, March 14, 2012 3:42 PM
    Moderator
  • Question
    Sign in to vote
    0
    Sign in to vote

    Okay then

    -----

    Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation.  All rights reserved.


    C:\Windows\system32>icacls C:\windows\system32\sppsvc.exe
    C:\windows\system32\sppsvc.exe NT SERVICE\TrustedInstaller:(F)
                                   BUILTIN\Administrators:(RX)
                                   NT AUTHORITY\SYSTEM:(RX)
                                   BUILTIN\Users:(RX)


    Successfully processed 1 files; Failed processing 0 files


    C:\Windows\system32>reg query hklm\system\currentcontrolset\services\sppsvc /s


    HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sppsvc
        DisplayName    REG_SZ    @%SystemRoot%\system32\sppsvc.exe,-101
        ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\sppsvc.exe
        Description    REG_SZ    @%SystemRoot%\system32\sppsvc.exe,-100
        ObjectName    REG_SZ    NT AUTHORITY\NetworkService
        ErrorControl    REG_DWORD    0x1
        Start    REG_DWORD    0x2
        DelayedAutoStart    REG_DWORD    0x1
        Type    REG_DWORD    0x10
        DependOnService    REG_MULTI_SZ    RpcSs
        ServiceSidType    REG_DWORD    0x1
        RequiredPrivileges    REG_MULTI_SZ    SeAuditPrivilege\0SeChangeNotifyPrivil
    ege\0SeCreateGlobalPrivilege\0SeImpersonatePrivilege
        FailureActions    REG_BINARY    80510100000000000000000003000000140000000100
    0000C0D4010001000000E09304000000000000000000


    HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sppsvc\Security
        Security    REG_BINARY    01001480A0000000AC000000140000003000000002001C0001
    00000002801400FF010F00010100000000000100000000020070000500000000001400FD01020001
    010000000000051200000000001800FF010F0001020000000000052000000020020000000014009D
    010200010100000000000504000000000014009D0102000101000000000005060000000000140014
    00000001010000000000050B000000010100000000000512000000010100000000000512000000




    C:\Windows\system32>

    -----

    Wednesday, March 14, 2012 3:46 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    "livory" wrote in message news:a5dcb149-5b76-4e1c-b88b-81ae9351557f...

    Okay then

     

    -----

    There has to be a problem with one of the files that the SPPSVC is loading – as far as I can see, the service itself is configured fine, and its ‘user’ (the Network Service) is fine. I expected the ‘tampered service’ error to have been in the first layer, rather than deeper.
     
    Unfortunately that’s further into the system than I’ve delved before. This means that unless you want to carry on here while we both learn, I recommend that you try WGA Support for assistance. In the past their usual response has been a repair install.
     
    WGA Support can be found here-
    North America: http://support.microsoft.com/contactus/cu_sc_genadv_master?ws=support&ws=support#tab4

    Outside North America:
    http://support.microsoft.com/contactus/?ws=support#tab0

    Please let us know if (and how) MS manage to repair the problem without a repair install of the OS - it would be useful for future reference!
    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    • Marked as answer by Darin Smith MS Wednesday, March 14, 2012 7:24 PM
    Wednesday, March 14, 2012 4:40 PM
    Moderator
  • Question
    Sign in to vote
    0
    Sign in to vote
    Alright then thanks, and sure I'll ask them see what they say. If it works I'll post it here...Hopefully it works.
    Wednesday, March 14, 2012 4:48 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    "livory" wrote in message news:702ee198-5273-435c-8055-5fcd96617977...
    Alright then thanks, and sure I'll ask them see what they say. If it works I'll post it here...Hopefully it works.
     
    Good luck! – if you want to come back here and try again, I’ll be here :)
     
    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Wednesday, March 14, 2012 5:50 PM
    Moderator