locked
Windows XP unable to complete Windows Geniune Validation RRS feed

  • Question

  • I was attack by the Trojan:Dos/Alureon.A and Microsoft Security Essentials failed to stop it.  I used AVG to remove the virus successfully, rebooted and now my system is giving me pop ups from the system tray that it is unalbe to complete genuine Windows validation.  When I attempt to perform the validation, it goes out to the MS site, attempts to validate and ends up at a blank screen and that's it!  HELP!  Oh, I also did the C:\Windows\system32\oobe\msoobe.exe /a, it states windows is already activated, so I went and changed a key at the WPAEvents key from 71 to 70 and went through the process, same thing!
    David L. Rogers
    Saturday, December 25, 2010 3:40 PM

Answers

  • "DLRogers59" wrote in message news:a81de6ad-4dc3-4c6c-be39-13175d83fced...

    Noel, after I sent the report findings to you, I actually read the thing and tried to make some sense out of it.  Here's what happened with the office.  My kid, found my Office 2007 Cd that my company gave me, the key is not on the crytal case, so what does he do, goes out on the web and grabs the first frigging key he can find and installs it.  He is in college and needed to finish a report for class.  I was at work and anyway, he is now dead, I cut his head off and we are having it for dinner today.  About the clock issue, don't know why that is the case, how do I fix that one?  Will the clock issue being fixed correct the XP activation issue as well?  Oh, also I uninstalled the office and will reinstall it with the correct key and the way I want it installed.  One more point, I work for Raytheon Missile Systems here in Tucson AZ and this is a Corporate laptop!

    Thanks

    Dave


    David L. Rogers
    LOL!

     
    If it's a Corporate laptop, I'm surprised you can do anything to it except use the installed programs :)
    Your Region is set to CST (GMT-6) - it should be Mountain Standard Time.(I think?). Once you have that set right, you'll need to reset the clock back to the right time. That should make any validation problems with Windows go away.
     
    Don't let the blood get into the keyboard - it's a b*gg*r to clean out <g>
     
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    • Marked as answer by DLRogers59 Sunday, December 26, 2010 2:33 AM
    Saturday, December 25, 2010 5:55 PM

All replies

  • "DLRogers59" wrote in message news:3c7c9b78-4856-4e98-9766-2654368227c9...
    I was attack by the Trojan:Dos/Alureon.A and Microsoft Security Essentials failed to stop it.  I used AVG to remove the virus successfully, rebooted and now my system is giving me pop ups from the system tray that it is unalbe to complete genuine Windows validation.  When I attempt to perform the validation, it goes out to the MS site, attempts to validate and ends up at a blank screen and that's it!  HELP!  Oh, I also did the C:\Windows\system32\oobe\msoobe.exe /a, it states windows is already activated, so I went and changed a key at the WPAEvents key from 71 to 70 and went through the process, same thing!
    David L. Rogers

    I suggest that you scan the system with an alternative spyware scanner - Malwarebytes Anti-Malware is my favoured one at present (www.malwarebytes.org) I'm surprised that MSE failed to stop the infection, unless there were other problems at the time.
     
    To properly analyse and solve problems with Activation and Validation, we need to see a full copy of the report produced by the MGADiag tool (download and save to desktop - http://go.microsoft.com/fwlink/?linkid=52012 )
    Once saved, run the tool.
    Click on the Continue button, which will produce the report.
    To copy the report to your response, click on the Copy button in the tool (ignore any error messages at this point), and then paste (using either r-click/Paste, or Ctrl+V ) into your response.
     


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, December 25, 2010 4:11 PM
  • First of all, thank you very much for such a quick reply to issue!  Here is the results from the report, I hope it will help.  I did try another app after AVG cleaned it up.  I reinstalled MSSE, and ran a full scan, it found it's previous results from when the system was infected and freaked out it couldn't fix it, had to let it "Fix" and reboot.  Needless to say the "Fix" did nothing, so I uninstalled it.  I am currently running Symantec AV ver 10.1.7.700 with current AV definitions.

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    Validation Status: Clock sync error
    Validation Code: 10
    Cached Validation Code: N/A
    Windows Product Key: *****-*****-Q6BKG-H63R7-W2MFJ
    Windows Product Key Hash: 5WF8AX17jW+Pn8Wtz6MdCpwzBDo=
    Windows Product ID: 55274-640-0911755-23607
    Windows Product ID Type: 1
    Windows License Type: Volume
    Windows OS version: 5.1.2600.2.00010100.3.0.pro
    ID: {3380E2FC-6E5C-4A58-8563-1539C43561D9}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: Registered, 1.9.42.0
    Signed By: Microsoft
    Product Name: N/A
    Architecture: N/A
    Build lab: N/A
    TTS Error: N/A
    Validation Diagnostic: 025D1FF3-230-1_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A
    Version: N/A

    Windows XP Notifications Data-->
    Cached Result: 10
    File Exists: Yes
    Version: 1.9.40.0
    WgaTray.exe Signed By: Microsoft
    WgaLogon.dll Signed By: Microsoft

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 103 Blocked VLK
    Microsoft Office Enterprise 2007 - 103 Blocked VLK
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-230-1

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{3380E2FC-6E5C-4A58-8563-1539C43561D9}</UGUID><Version>1.9.0027.0</Version><OS>5.1.2600.2.00010100.3.0.pro</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-W2MFJ</PKey><PID>55274-640-0911755-23607</PID><PIDType>1</PIDType><SID>S-1-5-21-1390067357-651377827-839522115</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>ASUS P5NSLI ACPI BIOS Revision 1801</Version><SMBIOSVersion major="2" minor="4"/><Date>20081118000000.000000+000</Date></BIOS><HWID>34DC3F3F0184C07C</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification><File Name="WgaTray.exe" Version="1.9.40.0"/><File Name="WgaLogon.dll" Version="1.9.40.0"/></GANotification></MachineData><Software><Office><Result>103</Result><Products><Product GUID="{90120000-0030-0000-0000-0000000FF1CE}"><LegitResult>103</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>ACD7202654E586</Val><Hash>fFic3JgCreGGRxyF8uMWB4R4Jcg=</Hash><Pid>89388-707-1528066-65714</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="103"/><App Id="16" Version="12" Result="103"/><App Id="18" Version="12" Result="103"/><App Id="19" Version="12" Result="103"/><App Id="1A" Version="12" Result="103"/><App Id="1B" Version="12" Result="103"/><App Id="44" Version="12" Result="103"/><App Id="A1" Version="12" Result="103"/><App Id="BA" Version="12" Result="103"/></Applications></Office></Software></GenuineResults> 

    Licensing Data-->
    N/A

    Windows Activation Technologies-->
    N/A

    HWID Data-->
    N/A

    OEM Activation 1.0 Data-->
    BIOS string matches: no
    Marker string from BIOS: N/A
    Marker string from OEMBIOS.DAT: N/A, hr = 0x80004005

    OEM Activation 2.0 Data-->
    N/A

    Thanks again!

    Dave


    David L. Rogers
    Saturday, December 25, 2010 4:20 PM
  • "DLRogers59" wrote in message news:2909611c-c9a2-4d4d-baea-bdf674ab066f...

    First of all, thank you very much for such a quick reply to issue!  Here is the results from the report, I hope it will help.  I did try another app after AVG cleaned it up.  I reinstalled MSSE, and ran a full scan, it found it's previous results from when the system was infected and freaked out it couldn't fix it, had to let it "Fix" and reboot.  Needless to say the "Fix" did nothing, so I uninstalled it.  I am currently running Symantec AV ver 10.1.7.700 with current AV definitions.

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    Validation Status: Clock sync error
    Validation Code: 10
    Cached Validation Code: N/A
    Windows Product Key: *****-*****-Q6BKG-H63R7-W2MFJ
    Windows Product Key Hash: 5WF8AX17jW+Pn8Wtz6MdCpwzBDo=
    Windows Product ID: 55274-640-0911755-23607
    Windows Product ID Type: 1
    Windows License Type: Volume
    Windows OS version: 5.1.2600.2.00010100.3.0.pro

    OGA Data-->
    Office Status: 103 Blocked VLK
    Microsoft Office Enterprise 2007 - 103 Blocked VLK
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-230-1

     

    N/A

    Thanks again!

    Dave


    David L. Rogers

    OK - you still need to run Malwarebytes (Norton misses even more than AVG does)
    Did you run the AVG cleanup too after uninstalling it? It could be resides from that that borked MSSE.
    As to your report, the primary problems are
     
    1) Clock Synch error - your system clock is not set to the correct time
     
    2) Your Office install is of a version only sold in bulk to organisations for use on their own machines - and the key used for it has been blocked because of abuse. If you bought this copy of Office, then you were sold a counterfeit.

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, December 25, 2010 5:03 PM
  • Noel, after I sent the report findings to you, I actually read the thing and tried to make some sense out of it.  Here's what happened with the office.  My kid, found my Office 2007 Cd that my company gave me, the key is not on the crytal case, so what does he do, goes out on the web and grabs the first frigging key he can find and installs it.  He is in college and needed to finish a report for class.  I was at work and anyway, he is now dead, I cut his head off and we are having it for dinner today.  About the clock issue, don't know why that is the case, how do I fix that one?  Will the clock issue being fixed correct the XP activation issue as well?  Oh, also I uninstalled the office and will reinstall it with the correct key and the way I want it installed.  One more point, I work for Raytheon Missile Systems here in Tucson AZ and this is a Corporate laptop!

    Thanks

    Dave


    David L. Rogers
    Saturday, December 25, 2010 5:20 PM
  • "DLRogers59" wrote in message news:a81de6ad-4dc3-4c6c-be39-13175d83fced...

    Noel, after I sent the report findings to you, I actually read the thing and tried to make some sense out of it.  Here's what happened with the office.  My kid, found my Office 2007 Cd that my company gave me, the key is not on the crytal case, so what does he do, goes out on the web and grabs the first frigging key he can find and installs it.  He is in college and needed to finish a report for class.  I was at work and anyway, he is now dead, I cut his head off and we are having it for dinner today.  About the clock issue, don't know why that is the case, how do I fix that one?  Will the clock issue being fixed correct the XP activation issue as well?  Oh, also I uninstalled the office and will reinstall it with the correct key and the way I want it installed.  One more point, I work for Raytheon Missile Systems here in Tucson AZ and this is a Corporate laptop!

    Thanks

    Dave


    David L. Rogers
    LOL!

     
    If it's a Corporate laptop, I'm surprised you can do anything to it except use the installed programs :)
    Your Region is set to CST (GMT-6) - it should be Mountain Standard Time.(I think?). Once you have that set right, you'll need to reset the clock back to the right time. That should make any validation problems with Windows go away.
     
    Don't let the blood get into the keyboard - it's a b*gg*r to clean out <g>
     
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    • Marked as answer by DLRogers59 Sunday, December 26, 2010 2:33 AM
    Saturday, December 25, 2010 5:55 PM
  • Well, I was kind of suprised at the full rights on this box as well, I guess it's because I'm an Engineer, and no I don't wheir a conductors hat, lol.  The time zone is set to Arizona, don't know how that could be wrong, but with computers you never know.  I went and looked just to make sure and he had changed the time zone to what New Mexico is so he would know what time it is where his finace lives!  I told him, he better grow a brain before he gets married to her so she doesn't kill him if I don't.  So anyway, guess what, I changed the time zone to AZ and clicked on the validation icon in the system tray and it worked!  I am so embarassed, I just added another body part to our dinner menu.  I am so sorry I have waisted your time Noel!  I should have done more digging knowing my son had touched the computer.  I guess I have a pretty good Idea how this machine got the virus aye, did some more digging and you'll never guess what I found in the IE history?  I've got the machine running the Malwarebytes right now, man that's not cheap!  Oh well, with this kid of mine going to the UofA in the house, I'll probably need it again, expecially with him thinking with the wrong head! So, lastly his pecker is now on the dinner menu, I have also been reimbursed for the Malwarebytes so that's cool.  Oh, it just got done running, it found nothing, oh well that's good, at least I know my tactics to clean up the machine were effective.  Thank you so much Noel, Merry Christmas and Happy New Year!

    A Bewildered Conductor in Tucson Arizona...


    David L. Rogers
    Saturday, December 25, 2010 6:36 PM
  • Well, I was kind of suprised at the full rights on this box as well, I guess it's because I'm an Engineer, and no I don't wheir a conductors hat, lol.  The time zone is set to Arizona, don't know how that could be wrong, but with computers you never know.  I went and looked just to make sure and he had changed the time zone to what New Mexico is so he would know what time it is where his finace lives!  I told him, he better grow a brain before he gets married to her so she doesn't kill him if I don't.  So anyway, guess what, I changed the time zone to AZ and clicked on the validation icon in the system tray and it worked!  I am so embarassed, I just added another body part to our dinner menu.  I am so sorry I have waisted your time Noel!  I should have done more digging knowing my son had touched the computer.  I guess I have a pretty good Idea how this machine got the virus aye, did some more digging and you'll never guess what I found in the IE history?  I've got the machine running the Malwarebytes right now, man that's not cheap!  Oh well, with this kid of mine going to the UofA in the house, I'll probably need it again, expecially with him thinking with the wrong head! So, lastly his pecker is now on the dinner menu, I have also been reimbursed for the Malwarebytes so that's cool.  Oh, it just got done running, it found nothing, oh well that's good, at least I know my tactics to clean up the machine were effective.  Thank you so much Noel, Merry Christmas and Happy New Year!

    A Bewildered Conductor in Tucson Arizona...


    David L. Rogers

    Man, I love a person with a wicked sense of humor.  Good pickup, Noel on the time.  Wish all a Merry Christmas, Season Greetings or whatever holidays you embrace.
    Saturday, December 25, 2010 6:51 PM
  • "LVTravel" wrote in message news:929b6ac4-1c52-459b-8d46-a07c1f1ecd7a...

    Well, I was kind of suprised at the full rights on this box as well, I guess it's because I'm an Engineer, and no I don't wheir a conductors hat, lol.  The time zone is set to Arizona, don't know how that could be wrong, but with computers you never know.  I went and looked just to make sure and he had changed the time zone to what New Mexico is so he would know what time it is where his finace lives!  I told him, he better grow a brain before he gets married to her so she doesn't kill him if I don't.  So anyway, guess what, I changed the time zone to AZ and clicked on the validation icon in the system tray and it worked!  I am so embarassed, I just added another body part to our dinner menu.  I am so sorry I have waisted your time Noel!  I should have done more digging knowing my son had touched the computer.  I guess I have a pretty good Idea how this machine got the virus aye, did some more digging and you'll never guess what I found in the IE history?  I've got the machine running the Malwarebytes right now, man that's not cheap!  Oh well, with this kid of mine going to the UofA in the house, I'll probably need it again, expecially with him thinking with the wrong head! So, lastly his pecker is now on the dinner menu, I have also been reimbursed for the Malwarebytes so that's cool.  Oh, it just got done running, it found nothing, oh well that's good, at least I know my tactics to clean up the machine were effective.  Thank you so much Noel, Merry Christmas and Happy New Year!

    A Bewildered Conductor in Tucson Arizona...


    David L. Rogers

    Man, I love a person with a wicked sense of humor.  Good pickup, Noel on the time.  Wish all a Merry Christmas, Season Greetings or whatever holidays you embrace.

    Hehe!
     
    'If you can keep your head when all around are losing theirs..... You don't understand the problem!'
     
    @David
    Give the poor guy a break - he's in love :)
    WRT Malwarebytes - it's a freebie as a run-on-demand scanner (which was what I intended for you to get). You still need a full AV to back it up whichever version you got.
    I'm assuming that the Symantec AV you have is the Corporate one? If so, that's fine, and a LOT better than the dross they foist on the public. Bells and whistles are all very well, but when you can't see the wood for the trees, it's time to call in the beavers  to do some felling (how's that for mixing metaphors?)
    Have a good rest-of-the-hols! - I might actually be able to get up tomorrow and eat something, having been confined to quarters with a nasty bug since Thursday evening, and unable to eat until just now (Tomato soup and dry toast - what an Xmas Dinner that was!).

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    • Marked as answer by DLRogers59 Sunday, December 26, 2010 2:32 AM
    • Unmarked as answer by DLRogers59 Sunday, December 26, 2010 2:33 AM
    Saturday, December 25, 2010 7:06 PM
  • Hey Noel, I just wanted to say a couple of things, first of all if I give my son any more breaks he won't be able to walk ever again.  He is 19, young dumb and full of well you know, I have been trying to get him to think before he acts and in this case with my company's laptop, he did not!  In doing what he did, he could have cost me my job, no kidding, corporations are not fooing around with people using company assets to surf for ____ and that's what he did.  What was amazing about this whole incident was his computer was sitting in the next room!  His excuse was, my laptop is faster?  That answer cost him a finger!  But you are right, I remember when I was 19 and in college at Portland State in Oregon.  The main course of study was carnivorous clams and partying, the studies came third, fourth, or what ever year you were in, this was 1978 through 81 for me, but I don't ever remember ____ my dad off like he does me.  Maybe it's his main course of study?  Take care Noel and sorry about your dinner, you know what mine was, I have to admitt, my sons head was kind of gamie tasting....

     

    Dave


    David L. Rogers
    Sunday, December 26, 2010 3:23 AM
  • "DLRogers59" wrote in message news:74c406ae-c558-40fc-bfc8-502155d04add...

    Hey Noel, I just wanted to say a couple of things, first of all if I give my son any more breaks he won't be able to walk ever again.  He is 19, young dumb and full of well you know, I have been trying to get him to think before he acts and in this case with my company's laptop, he did not!  In doing what he did, he could have cost me my job, no kidding, corporations are not fooing around with people using company assets to surf for ____ and that's what he did.  What was amazing about this whole incident was his computer was sitting in the next room!  His excuse was, my laptop is faster?  That answer cost him a finger!  But you are right, I remember when I was 19 and in college at Portland State in Oregon.  The main course of study was carnivorous clams and partying, the studies came third, fourth, or what ever year you were in, this was 1978 through 81 for me, but I don't ever remember ____ my dad off like he does me.  Maybe it's his main course of study?  Take care Noel and sorry about your dinner, you know what mine was, I have to admitt, my sons head was kind of gamie tasting....

     

    Dave


    David L. Rogers

    Maybe you should get together with this guy, and have a feast <eg>
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Sunday, December 26, 2010 1:14 PM