Answered by:
I don't have genuine Windows - tampered files

Question
-
I just bot a new HP athlon build 7600 and now msft alerts me throughout the day that I don't have genuine windows. Windows 7 is activated so I don't know why I need the extra aggrevation. I would appreciate it if this can be resolved here.
Here is data that was requested from another post.
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-73CQT-WMF7J-3Q6C9
Windows Product Key Hash: KaFG+RmurcM3ZxzWyfEP9WtPUJw=
Windows Product ID: 00359-OEM-8992687-00010
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7600.2.00010300.0.0.003
ID: {5D1C4E3C-096C-46CF-873A-CC6D3FAE88B7}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7600.win7_gdr.100618-1621
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[7.1.7600.16395], Hr = 0x80092003
File Mismatch: C:\Windows\system32\wat\watux.exe[7.1.7600.16395], Hr = 0x80092003
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{5D1C4E3C-096C-46CF-873A-CC6D3FAE88B7}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7600.2.00010300.0.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-3Q6C9</PKey><PID>00359-OEM-8992687-00010</PID><PIDType>2</PIDType><SID>S-1-5-21-3230036329-2884360911-3867851601</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>p6624y</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>6.02</Version><SMBIOSVersion major="2" minor="6"/><Date>20100721000000.000000+000</Date></BIOS><HWID>B2BB3607018400F2</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7600.16385
Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800010-02-1033-7600.0000-2052009
Installation ID: 008114967755228252631823966674400486736064933730624172
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: 3Q6C9
License Status: Licensed
Remaining Windows rearm count: 2
Trusted time: 12/23/2010 4:05:50 PM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x000000000000E220
Event Time Stamp: 12:23:2010 09:16
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
HWID Data-->
HWID Hash Current: LgAAAAEAAQABAAIAAAACAAAAAQABAAEAln2UBKjgIJEO5FTIMsTqRQKo5lpCGg==
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC HPQOEM SLIC-CPC
FACP HPQOEM SLIC-CPC
SRAT HPQOEM SLIC-CPC
HPET HPQOEM SLIC-CPC
MCFG HPQOEM SLIC-CPC
SLIC HPQOEM SLIC-CPC
OEMB HPQOEM SLIC-CPC
SSDT HPQOEM SLIC-CPC
SSDT HPQOEM SLIC-CPC
- Edited by Carey FrischMVP, Moderator Thursday, December 23, 2010 10:32 PM Edit title to reflect question asked
Thursday, December 23, 2010 9:29 PM
Answers
-
"getitdon" wrote in message news:0a52c663-a8fa-4846-9afc-18159fca8888...
Merry Christmas to you.
I am a great surfer but don't know a lot about computer mechanics. You're probably right as I have spent countless hours on the phone with hp reps who have taken control of my computer and accomplished nothing. I finally talked to a msft person yesterday and she advised to get a copy of windows 7 from hp and that she would guide me in the reinstalltion. Of course hp would not do that so I guess recovery is about all that is left. if you have any other ideas please let me know.
Neil Siegel
Nope - I ain't gonna argue with HP - AND MS. One I could handle :)Seriously, if you created the recovery disks when you first got the PC, use them. If the system has an option to recover from the HD (usually called one-key recovery or similar), then use that. If neither, then you'll have to buy a set of recovery disks from HP and wait for their arrival.
--
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth- Marked as answer by Darin Smith MS Tuesday, December 28, 2010 1:04 AM
Saturday, December 25, 2010 3:13 PMModerator -
HP rep just did a recovery for me. No more messing around. Didn't lose that much data so now I can start fresh and first clue that everything is good is that updates all installed.
Neil Siegel- Marked as answer by Darin Smith MS Tuesday, December 28, 2010 1:04 AM
Saturday, December 25, 2010 6:31 PM
All replies
-
"getitdon" wrote in message news:3ec9e79b-108e-4c8a-b074-f4ccbbb7deeb...
I just bot a new HP athlon build 7600 and now msft alerts me throughout the day that I don't have genuine windows. Windows 7 is activated so I don't know why I need the extra aggrevation. I would appreciate it if this can be resolved here.
Here is data that was requested from another post.
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-73CQT-WMF7J-3Q6C9
Windows Product Key Hash: KaFG+RmurcM3ZxzWyfEP9WtPUJw=
Windows Product ID: 00359-OEM-8992687-00010
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7600.2.00010300.0.0.003
File Scan Data-->
File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[7.1.7600.16395], Hr = 0x80092003
File Mismatch: C:\Windows\system32\wat\watux.exe[7.1.7600.16395], Hr = 0x80092003
Windows Activation Technologies-->
HrOffline: 0x8004FE21
Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
You have a number of Tampered files present - which is what's causing your non-genuine notice.
To try and fix the file mismatch and tampers, you need to either use System Restore to get back to a time when the system was OK, or use the System File Checker to attempt to replace the affected files....
Click on the Start button
type in the Search box
CMD.EXE
right-click on the only file that is found
Select Run as Administrator
- the Elevated Command Prompt window should pop up
At the Command prompt, type
SFC /SCANNOW
and hit the Enter key
Wait for the scan to finish - make a note of any error messages - and then reboot
Visit the Validation site http://www.microsoft.com/genuine and attempt to Validate Windows - again, make a note of error messages.
Reboot.
Run MGADiag again, and post the report, and error messages in your reply.
--
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothThursday, December 23, 2010 10:28 PMModerator -
Thanks for your help Noel.
The tampered files are still there but I think I know why. I meant to migrate only a few files from my xp computer to new one and inadvertently transferred system files. I say this because i see system32 in tampered files and my former computer was 32 bit. My new computer runs great if I could only stop this msft notice. I paid full price and there are no illegal files on my windows 7. Any help is appreciated.
Could not copy scan results but this is the type of language that I got.
Windows Resource Protection found corrupt files but was unable to fix some of them. Details CBS.Log windir/ogs/cbs/cbs.log
then it said
For example C:/windows/logs/cbs/cbs.log
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-QB87T-3QCTH-JHXY8
Windows Product Key Hash: NYKwzd+cQBSRLqUzz5bVog1elL0=
Windows Product ID: 00359-OEM-9810575-30448
Windows Product ID Type: 8
Windows License Type: COA SLP
Windows OS version: 6.1.7600.2.00010300.0.0.003
ID: {5D1C4E3C-096C-46CF-873A-CC6D3FAE88B7}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7600.win7_gdr.100618-1621
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[7.1.7600.16395], Hr = 0x80092003
File Mismatch: C:\Windows\system32\wat\watux.exe[7.1.7600.16395], Hr = 0x80092003
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{5D1C4E3C-096C-46CF-873A-CC6D3FAE88B7}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7600.2.00010300.0.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-JHXY8</PKey><PID>00359-OEM-9810575-30448</PID><PIDType>8</PIDType><SID>S-1-5-21-3230036329-2884360911-3867851601</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>p6624y</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>6.02</Version><SMBIOSVersion major="2" minor="6"/><Date>20100721000000.000000+000</Date></BIOS><HWID>B2BB3607018400F2</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7600.16385
Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
Activation ID: 5e017a8a-f3f9-4167-b1bd-ba3e236a4d8f
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00196-105-730448-02-1033-7600.0000-3582010
Installation ID: 015204807585427103308752976585238542541150787436012223
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: JHXY8
License Status: Licensed
Remaining Windows rearm count: 2
Trusted time: 12/25/2010 7:55:48 AM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x000000000000E220
Event Time Stamp: 12:23:2010 09:16
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
HWID Data-->
HWID Hash Current: LgAAAAEAAQABAAIAAAACAAAAAQABAAEAln2UBKjgIJEO5FTIMsTqRQKo5lpCGg==
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC HPQOEM SLIC-CPC
FACP HPQOEM SLIC-CPC
SRAT HPQOEM SLIC-CPC
HPET HPQOEM SLIC-CPC
MCFG HPQOEM SLIC-CPC
SLIC HPQOEM SLIC-CPC
OEMB HPQOEM SLIC-CPC
SSDT HPQOEM SLIC-CPC
SSDT HPQOEM SLIC-CPC
Saturday, December 25, 2010 1:07 PM -
Noel, I tried a system restore a couple of weeks ago to no avail. I think that I migrated files the same day that bot the computer. I might have to do a recovery if nothing else works.
Neil SiegelSaturday, December 25, 2010 1:18 PM -
"getitdon" wrote in message news:c60fd78e-5780-4fbe-9770-b14fbecd7ac2...Noel, I tried a system restore a couple of weeks ago to no avail. I think that I migrated files the same day that bot the computer. I might have to do a recovery if nothing else works.
Neil Siegel
Hmmm- the System 32 folder exists in both 32- and 64-bit versions of Windows, from XP upI suspect though, that since you say that it is an almost new system, it would be a good idea to reinstall using the recovery system, and then pull in your data again.
--
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothSaturday, December 25, 2010 2:30 PMModerator -
Merry Christmas to you.
I am a great surfer but don't know a lot about computer mechanics. You're probably right as I have spent countless hours on the phone with hp reps who have taken control of my computer and accomplished nothing. I finally talked to a msft person yesterday and she advised to get a copy of windows 7 from hp and that she would guide me in the reinstalltion. Of course hp would not do that so I guess recovery is about all that is left. if you have any other ideas please let me know.
Neil SiegelSaturday, December 25, 2010 2:43 PM -
"getitdon" wrote in message news:0a52c663-a8fa-4846-9afc-18159fca8888...
Merry Christmas to you.
I am a great surfer but don't know a lot about computer mechanics. You're probably right as I have spent countless hours on the phone with hp reps who have taken control of my computer and accomplished nothing. I finally talked to a msft person yesterday and she advised to get a copy of windows 7 from hp and that she would guide me in the reinstalltion. Of course hp would not do that so I guess recovery is about all that is left. if you have any other ideas please let me know.
Neil Siegel
Nope - I ain't gonna argue with HP - AND MS. One I could handle :)Seriously, if you created the recovery disks when you first got the PC, use them. If the system has an option to recover from the HD (usually called one-key recovery or similar), then use that. If neither, then you'll have to buy a set of recovery disks from HP and wait for their arrival.
--
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth- Marked as answer by Darin Smith MS Tuesday, December 28, 2010 1:04 AM
Saturday, December 25, 2010 3:13 PMModerator -
HP rep just did a recovery for me. No more messing around. Didn't lose that much data so now I can start fresh and first clue that everything is good is that updates all installed.
Neil Siegel- Marked as answer by Darin Smith MS Tuesday, December 28, 2010 1:04 AM
Saturday, December 25, 2010 6:31 PM -
"getitdon" wrote in message news:ac305212-35fb-4079-a869-eb9511135d3c...HP rep just did a recovery for me. No more messing around. Didn't lose that much data so now I can start fresh and first clue that everything is good is that updates all installed.
Neil Siegel
Great - good news at last! Make sure that you install a decent antivirus first off.
--
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothSaturday, December 25, 2010 7:06 PMModerator