Answered by:
I'm getting the windows genuine notice for unknown reason...

Question
-
I purchased a windows 7 ultimate upgrade license through my academic institution some 18 months ago. It installed and activated fine. Even now, Windows activation claims that I've been successfully activated, but the message still comes up "this copy of Windows is not genuine"
I have not recently changed any hardware or installed any programs that would have done this.
Here's is my diagnostic report:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-PXDKY-4PXXP-GWGBB
Windows Product Key Hash: ywASlhuYhPcUwuQLSWCsuEUdvLE=
Windows Product ID: 00426-293-0664041-85993
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {F1B32D89-E2F6-4225-8131-40903AA57DF2}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.111118-2330
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{F1B32D89-E2F6-4225-8131-40903AA57DF2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-GWGBB</PKey><PID>00426-293-0664041-85993</PID><PIDType>5</PIDType><SID>S-1-5-21-2433741074-3365209427-128144405</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>P35-DS3L</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F9</Version><SMBIOSVersion major="2" minor="4"/><Date>20090619000000.000000+000</Date></BIOS><HWID>2A0E3B07018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00170-293-066404-00-1033-7601.0000-1012012
Installation ID: 006546620186403354879452251236919572278612462110795863
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: GWGBB
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 4/10/2012 10:19:00 PM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000000080
Event Time Stamp: 4:10:2012 21:15
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppwinob.dll
HWID Data-->
HWID Hash Current: PAAAAAEABgABAAEAAAADAAAAAwABAAEA6GHA1o49GJ9a2XTmiP3iX5iyEvKQKkw2vqSjoJ8WcCdK4yqF
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC GBT GBTUACPI
FACP GBT GBTUACPI
HPET GBT GBTUACPI
MCFG GBT GBTUACPI
SSDT PmRef CpuPm
Wednesday, April 11, 2012 5:41 AM
Answers
-
"sjd200" wrote in message news:50de77e8-2a9c-41e1-a2d3-1239ca9d91e0...
I have no signs of malware infection--nothing showing up on the virus scans, no suspect software--toolbars, popups, etc.
Here's the output from your suggested commands:
C:\Windows\System32>SFC /scanfile=C:\Windows\System32\sppwinob.dll
Windows Resource Protection found corrupt files but was unable to fix some of th
em.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.logOK we have a sensible result, finally! If you have another machine with SP1 installed, you could try copying the file across from there, while in WinRE using the command prompt there (you won't be able to do it from normal mode, and I don't think it's possible in Safe Mode, either)If y
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth- Proposed as answer by Darin Smith MS Wednesday, April 18, 2012 9:41 PM
- Marked as answer by Darin Smith MS Monday, April 23, 2012 8:44 PM
Tuesday, April 17, 2012 8:16 PMModerator
All replies
-
"sjd200" wrote in message news:4291a527-e0c8-4cb6-a664-eea2131e5d2d...
I purchased a windows 7 ultimate upgrade license through my academic institution some 18 months ago. It installed and activated fine. Even now, Windows activation claims that I've been successfully activated, but the message still comes up "this copy of Windows is not genuine"
I have not recently changed any hardware or installed any programs that would have done this.
Here's is my diagnostic report:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-PXDKY-4PXXP-GWGBB
Windows Product Key Hash: ywASlhuYhPcUwuQLSWCsuEUdvLE=
Windows Product ID: 00426-293-0664041-85993
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
File Scan Data-->
File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003
Other data-->
SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>P35-DS3L</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F9</Version><SMBIOSVersion major="2" minor="4"/><Date>20090619000000.000000+000</Date></BIOS
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Partial Product Key: GWGBB
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 4/10/2012 10:19:00 PM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
You have an unusual File Mismatch present - have you had a malware infection of any kind?
The best thing to start with is probably a basic chkdsk and sfc.....running CHKDSK and SFCtype in the Search box
CMD.EXE
right-click on the only file that is found
Select Run as Administrator
- the Elevated Command Prompt window should pop up
At the Command prompt, type
CHKDSK C: /R
and hit the Enter key
You will be told that the drive is locked, and the CHKDSK will run at he next boot - hit the Y key, and then reboot. The chkdsk will take a few hours depending on the size of the drive, so be patient!
After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) - then run the SFC
SFC -System File Checker - Instructions
Click on the Start button
type in the Search box
CMD.EXE
right-click on the only file that is found
Select Run as Administrator
- the Elevated Command Prompt window should pop up
At the Command prompt, type
SFC /SCANNOW
and hit the Enter key
Wait for the scan to finish - make a note of any error messages - and then reboot.
run another MGADiag report, and post the results.
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothWednesday, April 11, 2012 7:51 AMModerator -
chkdsk found and corrected some errors, but SFC "did not find any integrity violations"--even though the GA diagnostic tool still thinks sppwinob.dll is corrupt/tampered.
I have run Security Essentials since the OS was installed and it hasn't found any malware or virus/worms. Nor do I engage in behavior that would lead to infection.
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-PXDKY-4PXXP-GWGBB
Windows Product Key Hash: ywASlhuYhPcUwuQLSWCsuEUdvLE=
Windows Product ID: 00426-293-0664041-85993
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {E2BCAD64-6DDA-4129-B014-0385BF83E9BC}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.111118-2330
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{E2BCAD64-6DDA-4129-B014-0385BF83E9BC}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-GWGBB</PKey><PID>00426-293-0664041-85993</PID><PIDType>5</PIDType><SID>S-1-5-21-2433741074-3365209427-128144405</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>P35-DS3L</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F9</Version><SMBIOSVersion major="2" minor="4"/><Date>20090619000000.000000+000</Date></BIOS><HWID>2A0E3B07018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00170-293-066404-00-1033-7601.0000-1012012
Installation ID: 006546620186403354879452251236919572278612462110795863
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: GWGBB
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 4/11/2012 9:28:10 AM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000000080
Event Time Stamp: 4:10:2012 21:15
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppwinob.dll
HWID Data-->
HWID Hash Current: PAAAAAEABgABAAEAAAADAAAAAwABAAEA6GHA1o49GJ9a2XTmiP3iX5iyEvKQKkw2vqSjoJ8WcCdK4yqF
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC GBT GBTUACPI
FACP GBT GBTUACPI
HPET GBT GBTUACPI
MCFG GBT GBTUACPI
SSDT PmRef CpuPm
- Edited by sjd200 Wednesday, April 11, 2012 4:44 PM
Wednesday, April 11, 2012 4:41 PM -
No replies?Thursday, April 12, 2012 2:36 PM
-
"sjd200" wrote in message news:b996d471-6350-4b2f-81da-293baff22705...
chkdsk found and corrected some errors, but SFC "did not find any integrity violations"--even though the GA diagnostic tool still thinks sppwinob.dll is corrupt/tampered.
I have run Security Essentials since the OS was installed and it hasn't found any malware or virus/worms. Nor do I engage in behavior that would lead to infection.
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-PXDKY-4PXXP-GWGBB
Windows Product Key Hash: ywASlhuYhPcUwuQLSWCsuEUdvLE=
Windows Product ID: 00426-293-0664041-85993
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
File Scan Data-->
File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003
Other data-->
SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>P35-DS3L</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F9</Version><SMBIOSVersion major="2" minor="4"/><Date>20090619000000.000000+000</Date></BIOS
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Partial Product Key: GWGBB
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 4/11/2012 9:28:10 AM
Tampered File: %systemroot%\system32\sppwinob.dll
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Sorry - must have missed it last night.As you say - no change in the report.Please run the following commands in an elevated command prompt window...ICACLS C:\Windows\System32\sppwinob.dllDIR C:\Windows\System32\sppwinob.dll /sREG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Modules\179b8a65-b0f6-41d9-acea-12006ef9b32a"Post the results.Here are some instructions to make life easier :)1) To open an Elevated Command Prompt Window (the CP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Windows, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothThursday, April 12, 2012 3:53 PMModerator -
Thanks Noel,
Here are the results your instructions:
C:\Windows\system32>ICACLS C:\Windows\System32\sppwinob.dll
C:\Windows\System32\sppwinob.dll NT SERVICE\TrustedInstaller:(F)
BUILTIN\Administrators:(RX)
NT AUTHORITY\SYSTEM:(RX)
BUILTIN\Users:(RX)
Successfully processed 1 files; Failed processing 0 files
C:\Windows\system32>DIR C:\Windows\System32\sppwinob.dll /s
Volume in drive C has no label.
Volume Serial Number is 5A93-BA33
Directory of C:\Windows\System32
11/20/2010 06:27 AM 418,816 sppwinob.dll
1 File(s) 418,816 bytes
Total Files Listed:
1 File(s) 418,816 bytes
0 Dir(s) 8,132,231,168 bytes free
C:\Windows\system32>REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
\SoftwareProtectionPlatform\Plugins\Modules\179b8a65-b0f6-41d9-acea-12006ef9b32a
"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtecti
onPlatform\Plugins\Modules\179b8a65-b0f6-41d9-acea-12006ef9b32a
ManifestFile REG_SZ %windir%\system32\spp\plugin-manifests-signed\sppw
inob-spp-plugin-manifest-signed.xrm-ms
PluginFile REG_SZ %windir%\system32\sppwinob.dll
C:\Windows\system32>and just in case, another diagnostic report (run after the commands above):
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-PXDKY-4PXXP-GWGBB
Windows Product Key Hash: ywASlhuYhPcUwuQLSWCsuEUdvLE=
Windows Product ID: 00426-293-0664041-85993
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {B4E1F8F3-B820-4429-AC26-EF2505B0889B}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.111118-2330
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{B4E1F8F3-B820-4429-AC26-EF2505B0889B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-GWGBB</PKey><PID>00426-293-0664041-85993</PID><PIDType>5</PIDType><SID>S-1-5-21-2433741074-3365209427-128144405</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>P35-DS3L</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F9</Version><SMBIOSVersion major="2" minor="4"/><Date>20090619000000.000000+000</Date></BIOS><HWID>2A0E3B07018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00170-293-066404-00-1033-7601.0000-1012012
Installation ID: 006546620186403354879452251236919572278612462110795863
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: GWGBB
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 4/12/2012 10:50:41 AM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000000080
Event Time Stamp: 4:11:2012 11:33
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppwinob.dll
HWID Data-->
HWID Hash Current: PAAAAAEABgABAAEAAAADAAAAAwABAAEA6GHA1o49GJ9a2XTmiP3iX5iyEvKQKkw2vqSjoJ8WcCdK4yqF
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC GBT GBTUACPI
FACP GBT GBTUACPI
HPET GBT GBTUACPI
MCFG GBT GBTUACPI
SSDT PmRef CpuPm
Thursday, April 12, 2012 6:02 PM -
Those commands were for information-gathering purposes, rather than an attempt to fix anything - unfortunately, everything there is as normal.
Have you tried a System Restore back to before the notification showed up? - or do I read your inital post to be saying that it has always shown as non-genuine?
If that fails for any reason, or you don't want to try it, please try recreating the Licensing Store - it will force a re-evaluationof the license, and may fix he problem.
Recreate the Licensing Store
1)
Click Start button.
2) Type: CMD.exe into the 'Search programs and files'
field
3) Right-Click on CMD.exe and select Run as Administrator
4) Type:
net stop sppsvc (It may ask you if you are sure, select yes)
Note: the
Software Protection service may not be running, this is ok.
5) Type: cd
%windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform
6)
Type: rename tokens.dat tokens.bar
7) Type: cd %windir%\system32
8) Type:
net start sppsvc
9) Type: slui.exe
10) After a couple of seconds Windows
Activation dialog will appear. You may be asked to re-activate and/or re-enter
your product key or Activation may occur automatically.You may have to use telephone
activation.
Reboot and Post back with a new MGADiag
reportNoel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
- Proposed as answer by Darin Smith MS Friday, April 13, 2012 5:56 PM
- Marked as answer by Darin Smith MS Monday, April 16, 2012 7:11 PM
- Unmarked as answer by sjd200 Tuesday, April 17, 2012 2:56 AM
- Unproposed as answer by Darin Smith MS Tuesday, April 17, 2012 7:40 PM
Thursday, April 12, 2012 6:20 PMModerator -
The genuine advantage warning first manifested itself on Monday. Unfortunately, I don't see any system restore from before today's patches were applied, so I'm stuck in that regard.
Is there any downside to recreating the licensing store--i.e. reduce the number of remaining activations or similar?
Thursday, April 12, 2012 8:17 PM -
"sjd200" wrote in message news:a85292d3-ccc1-4a26-9fa4-d85a4c82bccd...
The genuine advantage warning first manifested itself on Monday. Unfortunately, I don't see any system restore from before today's patches were applied, so I'm stuck in that regard.
Is there any downside to recreating the licensing store--i.e. reduce the number of remaining activations or similar?
You can't get any worse off than you are now - activation will be back to normal when we get it working again.
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothThursday, April 12, 2012 8:25 PMModerator -
No further reply from the original Poster.
Issue is assumed to be resolved.
Darin MS
That's a shameless assumption, considering its a defect in your product that is giving me this issue to start with... I paid money for this software; I have proof of purchase; I have a license key that passes activation. And yet somehow your OS managed to corrupt one of it's own files, and you assume I'm the criminal--or at least that I got my software from one.
From where I stand it is Microsoft who has stolen a valid license from me. That, and about 10 hours of my valuable time trying to run down all these potential solutions--none of which have worked.
So what do you have for me now, Microsoft? You have wrongfully seized my license and provided nothing in return. As you can see from below, the OS is still broken, and I'm betting your next (and only) solution will be a reinstall.
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-PXDKY-4PXXP-GWGBB
Windows Product Key Hash: ywASlhuYhPcUwuQLSWCsuEUdvLE=
Windows Product ID: 00426-293-0664041-85993
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {B4E1F8F3-B820-4429-AC26-EF2505B0889B}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.111118-2330
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{B4E1F8F3-B820-4429-AC26-EF2505B0889B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-GWGBB</PKey><PID>00426-293-0664041-85993</PID><PIDType>5</PIDType><SID>S-1-5-21-2433741074-3365209427-128144405</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>P35-DS3L</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F9</Version><SMBIOSVersion major="2" minor="4"/><Date>20090619000000.000000+000</Date></BIOS><HWID>2A0E3B07018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00170-293-066404-00-1033-7601.0000-1012012
Installation ID: 006546620186403354879452251236919572278612462110795863
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: GWGBB
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 4/16/2012 7:51:42 PM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000000080
Event Time Stamp: 4:16:2012 06:54
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppwinob.dll
HWID Data-->
HWID Hash Current: PAAAAAEABgABAAEAAAADAAAAAwABAAEA6GHA1o49GJ9a2XTmiP3iX5iyEvKQKkw2vqSjoJ8WcCdK4yqF
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC GBT GBTUACPI
FACP GBT GBTUACPI
HPET GBT GBTUACPI
MCFG GBT GBTUACPI
SSDT PmRef CpuPm
Tuesday, April 17, 2012 3:06 AM -
"sjd200" wrote in message news:c1944fc4-2511-4dd1-9064-95d8aeb1bae0...
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-PXDKY-4PXXP-GWGBB
Windows Product Key Hash: ywASlhuYhPcUwuQLSWCsuEUdvLE=
Windows Product ID: 00426-293-0664041-85993
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
File Scan Data-->
File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000000080
Event Time Stamp: 4:16:2012 06:54
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppwinob.dll
Just as a point of fact - MS did nothing.Something happened to your installation to invalidate the activation - either because of the action of software, or user error.The actual error you have is a rare one - sppwinob.dll on its own being tampered - and doesn't seem to be amenable to an easy solution.You are perfectly at liberty to Unmark the answer - and I suggest that you do - until such time as the problem is actually solved. Darin has a set of guidelines to work to in respect of tagging questions as 'answered', one of which is if there has been no response from the original poster for a few days.Have you actually attempted the recreation of teh Licensing Store? If you got error messages, at what point did you get them? What happened when you re-entered the Key?
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothTuesday, April 17, 2012 7:08 AMModerator -
Noel,
I did run your set of instructions to re-create the licensing store. It seemed to work fine--except that it was ineffective in solving the corruption with sppwinob.dll as indicated by the diagnostic report above.
And while I appreciate your help, I can't agree with you that is it good (or honest) practice--published or not--to mark questions as 'Answered' when they are not. The whole purpose of the Answered marking is to help people search out effective solutions to their problems. If there is no solution/workaround/explanation of how to avoid the problem, then the issue should not be marked as solved.
Nor would I agree that MS did nothing. They created the licensing scheme which breaks without apparent cause and are now proclaiming my legal version of Windows as counterfeit. And once they have proclaimed my legal version as counterfeit, the only 'solution' they guide me to is to buy another copy--I had to search of this forum on my own.
So what else could they do? Well--why not make the Activation (SLUI) tool useful by giving it the ability to repair these files once my license key is validated? As it is, I have a bi-polar OS that simultaneously tells me my genuine Windows has been activated, while another window pops up and says I need to go buy a legal copy of my OS before they start disabling functionality. As far as I'm concerned that's the only theft going on here; and who designed and programmed this contradiction? --Microsoft.
Tuesday, April 17, 2012 4:23 PM -
"sjd200" wrote in message news:f709dd41-a4bc-4c47-a47f-e13e233ec25d...
Noel,
I did run your set of instructions to re-create the licensing store. It seemed to work fine--except that it was ineffective in solving the corruption with sppwinob.dll as indicated by the diagnostic report above.
So what else could they do? Well--why not make the Activation (SLUI) tool useful by giving it the ability to repair these files once my license key is validated? As it is, I have a bi-polar OS that simultaneously tells me my genuine Windows has been activated, while another window pops up and says I need to go buy a legal copy of my OS before they start disabling functionality. As far as I'm concerned that's the only theft going on here; and who designed and programmed this contradiction? --Microsoft.
Can't argue with the last paragraph! :)Hopefully Windows 8 will be less schizoid, since it's been built with both activation and validation well in hand.Meanwhile - back at t'mill, as they used to say.....let's doublecheck the status of spwinob.dll...please run the following in an Elevated Command PromptSFC /scanfile=C:\Windows\System32\sppwinob.dllDIR C:\sppwinob.dll /SDIR C:\sppwinob.dll /S /ahDIR C:\sppwinob.dll /S /asDIR C:\sppwinob.dll /S /ar( I expect the last three to be 'Not Found', unless there is malware present)
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed SlothTuesday, April 17, 2012 4:44 PMModerator -
I've just had reports from another forum where a poster had what appears to bean identical problem.
Their system was becoming more and more unstable, assuming they had malware problems they elected to reformat/reinstall. I have asked for clarification/confirmation if possible.
How certain are you that you system is clear of malware?
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
Tuesday, April 17, 2012 4:51 PMModerator -
I have no signs of malware infection--nothing showing up on the virus scans, no suspect software--toolbars, popups, etc.
Here's the output from your suggested commands:
C:\Windows\System32>SFC /scanfile=C:\Windows\System32\sppwinob.dll
Windows Resource Protection found corrupt files but was unable to fix some of th
em.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.logC:\Windows\System32>DIR C:\sppwinob.dll /S
Volume in drive C has no label.
Volume Serial Number is 5A93-BA33
Directory of C:\Windows\System32
11/20/2010 06:27 AM 418,816 sppwinob.dll
1 File(s) 418,816 bytes
Directory of C:\Windows\winsxs\amd64_microsoft-windows-s..-spp-plugin-windows_3
1bf3856ad364e35_6.1.7600.16385_none_6daf1bf0165f608f
07/13/2009 06:41 PM 418,816 sppwinob.dll
1 File(s) 418,816 bytes
Directory of C:\Windows\winsxs\amd64_microsoft-windows-s..-spp-plugin-windows_3
1bf3856ad364e35_6.1.7601.17514_none_6fe02fb8134de429
11/20/2010 06:27 AM 418,816 sppwinob.dll
1 File(s) 418,816 bytes
Total Files Listed:
3 File(s) 1,256,448 bytes
0 Dir(s) 6,558,633,984 bytes free
C:\Windows\System32>DIR C:\sppwinob.dll /S /ah
Volume in drive C has no label.
Volume Serial Number is 5A93-BA33
File Not Found
C:\Windows\System32>DIR C:\sppwinob.dll /S /as
Volume in drive C has no label.
Volume Serial Number is 5A93-BA33
File Not Found
C:\Windows\System32>DIR C:\sppwinob.dll /S /ar
Volume in drive C has no label.
Volume Serial Number is 5A93-BA33
File Not Found
C:\Windows\System32>Tuesday, April 17, 2012 7:29 PM -
"sjd200" wrote in message news:50de77e8-2a9c-41e1-a2d3-1239ca9d91e0...
I have no signs of malware infection--nothing showing up on the virus scans, no suspect software--toolbars, popups, etc.
Here's the output from your suggested commands:
C:\Windows\System32>SFC /scanfile=C:\Windows\System32\sppwinob.dll
Windows Resource Protection found corrupt files but was unable to fix some of th
em.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.logOK we have a sensible result, finally! If you have another machine with SP1 installed, you could try copying the file across from there, while in WinRE using the command prompt there (you won't be able to do it from normal mode, and I don't think it's possible in Safe Mode, either)If y
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth- Proposed as answer by Darin Smith MS Wednesday, April 18, 2012 9:41 PM
- Marked as answer by Darin Smith MS Monday, April 23, 2012 8:44 PM
Tuesday, April 17, 2012 8:16 PMModerator -
No reply from the Original Poster.
Issue is assumed to be resolved.
Darin MS
Monday, April 23, 2012 8:44 PM