locked
I don't have genuine Windows - tampered files RRS feed

  • Question

  • I just bot a new HP athlon build 7600 and now msft alerts me throughout the day that I don't have genuine windows. Windows 7 is activated so I don't know why I need the extra aggrevation. I would appreciate it if this can be resolved here.

     

    Here is data that was requested from another post.

     

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-73CQT-WMF7J-3Q6C9
    Windows Product Key Hash: KaFG+RmurcM3ZxzWyfEP9WtPUJw=
    Windows Product ID: 00359-OEM-8992687-00010
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7600.2.00010300.0.0.003
    ID: {5D1C4E3C-096C-46CF-873A-CC6D3FAE88B7}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7600.win7_gdr.100618-1621
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->
    File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[7.1.7600.16395], Hr = 0x80092003
    File Mismatch: C:\Windows\system32\wat\watux.exe[7.1.7600.16395], Hr = 0x80092003

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{5D1C4E3C-096C-46CF-873A-CC6D3FAE88B7}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7600.2.00010300.0.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-3Q6C9</PKey><PID>00359-OEM-8992687-00010</PID><PIDType>2</PIDType><SID>S-1-5-21-3230036329-2884360911-3867851601</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>p6624y</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>6.02</Version><SMBIOSVersion major="2" minor="6"/><Date>20100721000000.000000+000</Date></BIOS><HWID>B2BB3607018400F2</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7600.16385

    Name: Windows(R) 7, HomePremium edition
    Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
    Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00359-00178-926-800010-02-1033-7600.0000-2052009
    Installation ID: 008114967755228252631823966674400486736064933730624172
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: 3Q6C9
    License Status: Licensed
    Remaining Windows rearm count: 2
    Trusted time: 12/23/2010 4:05:50 PM

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x000000000000E220
    Event Time Stamp: 12:23:2010 09:16
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
    Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
    Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui


    HWID Data-->
    HWID Hash Current: LgAAAAEAAQABAAIAAAACAAAAAQABAAEAln2UBKjgIJEO5FTIMsTqRQKo5lpCGg==

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            HPQOEM        SLIC-CPC
      FACP            HPQOEM        SLIC-CPC
      SRAT            HPQOEM        SLIC-CPC
      HPET            HPQOEM        SLIC-CPC
      MCFG            HPQOEM        SLIC-CPC
      SLIC            HPQOEM        SLIC-CPC
      OEMB            HPQOEM        SLIC-CPC
      SSDT            HPQOEM        SLIC-CPC
      SSDT            HPQOEM        SLIC-CPC

    Thursday, December 23, 2010 9:29 PM

Answers

  • "getitdon" wrote in message news:0a52c663-a8fa-4846-9afc-18159fca8888...

    Merry Christmas to you.

     

    I am a great surfer but don't know a lot about computer mechanics. You're probably right as I have spent countless hours on the phone with hp reps who have taken control of my computer and accomplished nothing. I finally talked to a msft person yesterday and she advised to get a copy of windows 7 from hp and that she would guide me in the reinstalltion. Of course hp would not do that so I guess recovery is about all that is left. if you have any other ideas please let me know.


    Neil Siegel

    Nope - I ain't gonna argue with HP - AND MS. One I could handle :)
    Seriously, if you created the recovery disks when you first got the PC, use them. If the system has an option to recover from the HD (usually called one-key recovery or similar), then use that. If neither, then you'll have to buy a set of recovery disks from HP and wait for their arrival.
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    • Marked as answer by Darin Smith MS Tuesday, December 28, 2010 1:04 AM
    Saturday, December 25, 2010 3:13 PM
    Moderator
  • HP rep just did a recovery for me. No more messing around.   Didn't lose that much data so now I can start fresh and first clue that everything is good is that updates all installed.
    Neil Siegel
    • Marked as answer by Darin Smith MS Tuesday, December 28, 2010 1:04 AM
    Saturday, December 25, 2010 6:31 PM

All replies

  • "getitdon" wrote in message news:3ec9e79b-108e-4c8a-b074-f4ccbbb7deeb...

    I just bot a new HP athlon build 7600 and now msft alerts me throughout the day that I don't have genuine windows. Windows 7 is activated so I don't know why I need the extra aggrevation. I would appreciate it if this can be resolved here.

     

    Here is data that was requested from another post.

     

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-73CQT-WMF7J-3Q6C9
    Windows Product Key Hash: KaFG+RmurcM3ZxzWyfEP9WtPUJw=
    Windows Product ID: 00359-OEM-8992687-00010
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7600.2.00010300.0.0.003

    File Scan Data-->
    File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[7.1.7600.16395], Hr = 0x80092003
    File Mismatch: C:\Windows\system32\wat\watux.exe[7.1.7600.16395], Hr = 0x80092003


    Windows Activation Technologies-->
    HrOffline: 0x8004FE21

    Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
    Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
    Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui

    You have a number of Tampered files present - which is what's causing your non-genuine notice.

     
    To try and fix the file mismatch and tampers, you need to either use System Restore to get back to a time when the system was OK, or use the System File Checker to attempt to replace the affected files....
    Click on the Start button
    type in the Search  box
    CMD.EXE
    right-click on the only file that is found
    Select Run as Administrator
     - the Elevated Command Prompt window should pop up
    At the Command prompt, type
     
    SFC   /SCANNOW
     
    and hit the Enter key
    Wait for the scan to finish - make a note of any error messages - and then reboot
    Visit the Validation site  http://www.microsoft.com/genuine and attempt to Validate Windows - again, make a note of error messages.
    Reboot.
    Run MGADiag again, and post the report, and error messages in your reply.
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Thursday, December 23, 2010 10:28 PM
    Moderator
  • Thanks for your help Noel.

     

    The tampered files are still there but I think I know why. I meant to migrate only a few files from my xp computer to new one and inadvertently transferred system files. I say this because i see system32 in tampered files and my former computer was 32 bit. My new computer runs great if I could only stop this msft notice. I paid full price and there are no illegal files on my windows 7. Any help is appreciated.

     

    Could not copy scan results but this is the type of language that I got.

     

    Windows Resource Protection found corrupt files but was unable to fix some of them. Details CBS.Log  windir/ogs/cbs/cbs.log

    then it said

    For example  C:/windows/logs/cbs/cbs.log

     

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-QB87T-3QCTH-JHXY8
    Windows Product Key Hash: NYKwzd+cQBSRLqUzz5bVog1elL0=
    Windows Product ID: 00359-OEM-9810575-30448
    Windows Product ID Type: 8
    Windows License Type: COA SLP
    Windows OS version: 6.1.7600.2.00010300.0.0.003
    ID: {5D1C4E3C-096C-46CF-873A-CC6D3FAE88B7}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7600.win7_gdr.100618-1621
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->
    File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[7.1.7600.16395], Hr = 0x80092003
    File Mismatch: C:\Windows\system32\wat\watux.exe[7.1.7600.16395], Hr = 0x80092003

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{5D1C4E3C-096C-46CF-873A-CC6D3FAE88B7}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7600.2.00010300.0.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-JHXY8</PKey><PID>00359-OEM-9810575-30448</PID><PIDType>8</PIDType><SID>S-1-5-21-3230036329-2884360911-3867851601</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>p6624y</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>6.02</Version><SMBIOSVersion major="2" minor="6"/><Date>20100721000000.000000+000</Date></BIOS><HWID>B2BB3607018400F2</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7600.16385

    Name: Windows(R) 7, HomePremium edition
    Description: Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
    Activation ID: 5e017a8a-f3f9-4167-b1bd-ba3e236a4d8f
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00359-00196-105-730448-02-1033-7600.0000-3582010
    Installation ID: 015204807585427103308752976585238542541150787436012223
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: JHXY8
    License Status: Licensed
    Remaining Windows rearm count: 2
    Trusted time: 12/25/2010 7:55:48 AM

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x000000000000E220
    Event Time Stamp: 12:23:2010 09:16
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
    Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
    Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui


    HWID Data-->
    HWID Hash Current: LgAAAAEAAQABAAIAAAACAAAAAQABAAEAln2UBKjgIJEO5FTIMsTqRQKo5lpCGg==

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            HPQOEM        SLIC-CPC
      FACP            HPQOEM        SLIC-CPC
      SRAT            HPQOEM        SLIC-CPC
      HPET            HPQOEM        SLIC-CPC
      MCFG            HPQOEM        SLIC-CPC
      SLIC            HPQOEM        SLIC-CPC
      OEMB            HPQOEM        SLIC-CPC
      SSDT            HPQOEM        SLIC-CPC
      SSDT            HPQOEM        SLIC-CPC


    Saturday, December 25, 2010 1:07 PM
  • Noel, I tried a system restore a couple of weeks ago to no avail. I think that I migrated files the same day that  bot the computer. I might have to do a recovery if nothing else works.

    Neil Siegel
    Saturday, December 25, 2010 1:18 PM
  • "getitdon" wrote in message news:c60fd78e-5780-4fbe-9770-b14fbecd7ac2...
    Noel, I tried a system restore a couple of weeks ago to no avail. I think that I migrated files the same day that  bot the computer. I might have to do a recovery if nothing else works.

    Neil Siegel

    Hmmm- the System 32 folder exists in both 32- and 64-bit versions of Windows, from XP up
    I suspect though, that since you say that it is an almost new system, it would be a good idea to reinstall using the recovery system, and then pull in your data again.

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, December 25, 2010 2:30 PM
    Moderator
  • Merry Christmas to you.

     

    I am a great surfer but don't know a lot about computer mechanics. You're probably right as I have spent countless hours on the phone with hp reps who have taken control of my computer and accomplished nothing. I finally talked to a msft person yesterday and she advised to get a copy of windows 7 from hp and that she would guide me in the reinstalltion. Of course hp would not do that so I guess recovery is about all that is left. if you have any other ideas please let me know.


    Neil Siegel
    Saturday, December 25, 2010 2:43 PM
  • "getitdon" wrote in message news:0a52c663-a8fa-4846-9afc-18159fca8888...

    Merry Christmas to you.

     

    I am a great surfer but don't know a lot about computer mechanics. You're probably right as I have spent countless hours on the phone with hp reps who have taken control of my computer and accomplished nothing. I finally talked to a msft person yesterday and she advised to get a copy of windows 7 from hp and that she would guide me in the reinstalltion. Of course hp would not do that so I guess recovery is about all that is left. if you have any other ideas please let me know.


    Neil Siegel

    Nope - I ain't gonna argue with HP - AND MS. One I could handle :)
    Seriously, if you created the recovery disks when you first got the PC, use them. If the system has an option to recover from the HD (usually called one-key recovery or similar), then use that. If neither, then you'll have to buy a set of recovery disks from HP and wait for their arrival.
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    • Marked as answer by Darin Smith MS Tuesday, December 28, 2010 1:04 AM
    Saturday, December 25, 2010 3:13 PM
    Moderator
  • HP rep just did a recovery for me. No more messing around.   Didn't lose that much data so now I can start fresh and first clue that everything is good is that updates all installed.
    Neil Siegel
    • Marked as answer by Darin Smith MS Tuesday, December 28, 2010 1:04 AM
    Saturday, December 25, 2010 6:31 PM
  • "getitdon" wrote in message news:ac305212-35fb-4079-a869-eb9511135d3c...
    HP rep just did a recovery for me. No more messing around.   Didn't lose that much data so now I can start fresh and first clue that everything is good is that updates all installed.
    Neil Siegel

    Great - good news at last! Make sure that you install a decent antivirus first off.
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, December 25, 2010 7:06 PM
    Moderator