none
I'm getting the windows genuine notice for unknown reason... RRS feed

  • Question

  • I purchased a windows 7 ultimate upgrade license through my academic institution some 18 months ago. It installed and activated fine. Even now, Windows activation claims that I've been successfully activated, but the message still comes up "this copy of Windows is not genuine"

    I have not recently changed any hardware or installed any programs that would have done this.

    Here's is my diagnostic report:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-PXDKY-4PXXP-GWGBB
    Windows Product Key Hash: ywASlhuYhPcUwuQLSWCsuEUdvLE=
    Windows Product ID: 00426-293-0664041-85993
    Windows Product ID Type: 5
    Windows License Type: Retail
    Windows OS version: 6.1.7601.2.00010100.1.0.001
    ID: {F1B32D89-E2F6-4225-8131-40903AA57DF2}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Ultimate
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.111118-2330
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->
    File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{F1B32D89-E2F6-4225-8131-40903AA57DF2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-GWGBB</PKey><PID>00426-293-0664041-85993</PID><PIDType>5</PIDType><SID>S-1-5-21-2433741074-3365209427-128144405</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>P35-DS3L</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F9</Version><SMBIOSVersion major="2" minor="4"/><Date>20090619000000.000000+000</Date></BIOS><HWID>2A0E3B07018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, Ultimate edition
    Description: Windows Operating System - Windows(R) 7, RETAIL channel
    Activation ID: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00426-00170-293-066404-00-1033-7601.0000-1012012
    Installation ID: 006546620186403354879452251236919572278612462110795863
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: GWGBB
    License Status: Licensed
    Remaining Windows rearm count: 4
    Trusted time: 4/10/2012 10:19:00 PM

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0000000000000080
    Event Time Stamp: 4:10:2012 21:15
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\sppwinob.dll


    HWID Data-->
    HWID Hash Current: PAAAAAEABgABAAEAAAADAAAAAwABAAEA6GHA1o49GJ9a2XTmiP3iX5iyEvKQKkw2vqSjoJ8WcCdK4yqF

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes, but no SLIC table
    Windows marker version: N/A
    OEMID and OEMTableID Consistent: N/A
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            GBT           GBTUACPI
      FACP            GBT           GBTUACPI
      HPET            GBT           GBTUACPI
      MCFG            GBT           GBTUACPI
      SSDT            PmRef        CpuPm

    Wednesday, April 11, 2012 5:41 AM

Answers

  • "sjd200" wrote in message news:50de77e8-2a9c-41e1-a2d3-1239ca9d91e0...

    I have no signs of malware infection--nothing showing up on the virus scans, no suspect software--toolbars, popups, etc.

    Here's the output from your suggested commands:

    C:\Windows\System32>SFC /scanfile=C:\Windows\System32\sppwinob.dll

    Windows Resource Protection found corrupt files but was unable to fix some of th
    em.
    Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
    C:\Windows\Logs\CBS\CBS.log
     
     
    OK we have a sensible result, finally! If you have another machine with SP1 installed, you could try copying the file across from there, while in WinRE using the command prompt there (you won't be able to do it from  normal mode, and I don't think it's possible in Safe Mode, either)
     
    If y

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Tuesday, April 17, 2012 8:16 PM
    Moderator

All replies

  • "sjd200" wrote in message news:4291a527-e0c8-4cb6-a664-eea2131e5d2d...

    I purchased a windows 7 ultimate upgrade license through my academic institution some 18 months ago. It installed and activated fine. Even now, Windows activation claims that I've been successfully activated, but the message still comes up "this copy of Windows is not genuine"

    I have not recently changed any hardware or installed any programs that would have done this.

    Here's is my diagnostic report:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-PXDKY-4PXXP-GWGBB
    Windows Product Key Hash: ywASlhuYhPcUwuQLSWCsuEUdvLE=
    Windows Product ID: 00426-293-0664041-85993
    Windows Product ID Type: 5
    Windows License Type: Retail
    Windows OS version: 6.1.7601.2.00010100.1.0.001

    File Scan Data-->
    File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003

    Other data-->
    SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>P35-DS3L</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F9</Version><SMBIOSVersion major="2" minor="4"/><Date>20090619000000.000000+000</Date></BIOS



    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, Ultimate edition
    Description: Windows Operating System - Windows(R) 7, RETAIL channel
    Partial Product Key: GWGBB
    License Status: Licensed
    Remaining Windows rearm count: 4
    Trusted time: 4/10/2012 10:19:00 PM

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21


    You have an unusual File Mismatch present - have you had a malware infection of any kind?
    The best thing to start with is probably a basic chkdsk and sfc.....
    running CHKDSK and SFC
    type in the Search box
    CMD.EXE
    right-click on the only file that is found
    Select Run as Administrator
    - the Elevated Command Prompt window should pop up
    At the Command prompt, type
    CHKDSK C: /R
    and hit the Enter key
    You will be told that the drive is locked, and the CHKDSK will run at he next boot - hit the Y key, and then reboot. The chkdsk will take a few hours depending on the size of the drive, so be patient!

    After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) - then run the SFC

    SFC -System File Checker - Instructions
    Click on the Start button
    type in the Search box
    CMD.EXE
    right-click on the only file that is found
    Select Run as Administrator
    - the Elevated Command Prompt window should pop up
    At the Command prompt, type

    SFC /SCANNOW

    and hit the Enter key
    Wait for the scan to finish - make a note of any error messages - and then reboot.

    run another MGADiag report, and post the results.

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Wednesday, April 11, 2012 7:51 AM
    Moderator
  • chkdsk found and corrected some errors, but SFC "did not find any integrity violations"--even though the GA diagnostic tool still thinks sppwinob.dll is corrupt/tampered.

    I have run Security Essentials since the OS was installed and it hasn't found any malware or virus/worms. Nor do I engage in behavior that would lead to infection. 

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-PXDKY-4PXXP-GWGBB
    Windows Product Key Hash: ywASlhuYhPcUwuQLSWCsuEUdvLE=
    Windows Product ID: 00426-293-0664041-85993
    Windows Product ID Type: 5
    Windows License Type: Retail
    Windows OS version: 6.1.7601.2.00010100.1.0.001
    ID: {E2BCAD64-6DDA-4129-B014-0385BF83E9BC}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Ultimate
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.111118-2330
    TTS Error: 
    Validation Diagnostic: 
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->
    File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{E2BCAD64-6DDA-4129-B014-0385BF83E9BC}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-GWGBB</PKey><PID>00426-293-0664041-85993</PID><PIDType>5</PIDType><SID>S-1-5-21-2433741074-3365209427-128144405</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>P35-DS3L</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F9</Version><SMBIOSVersion major="2" minor="4"/><Date>20090619000000.000000+000</Date></BIOS><HWID>2A0E3B07018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, Ultimate edition
    Description: Windows Operating System - Windows(R) 7, RETAIL channel
    Activation ID: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00426-00170-293-066404-00-1033-7601.0000-1012012
    Installation ID: 006546620186403354879452251236919572278612462110795863
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: GWGBB
    License Status: Licensed
    Remaining Windows rearm count: 4
    Trusted time: 4/11/2012 9:28:10 AM

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0000000000000080
    Event Time Stamp: 4:10:2012 21:15
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\sppwinob.dll


    HWID Data-->
    HWID Hash Current: PAAAAAEABgABAAEAAAADAAAAAwABAAEA6GHA1o49GJ9a2XTmiP3iX5iyEvKQKkw2vqSjoJ8WcCdK4yqF

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes, but no SLIC table
    Windows marker version: N/A
    OEMID and OEMTableID Consistent: N/A
    BIOS Information: 
      ACPI Table Name OEMID Value OEMTableID Value
      APIC GBT   GBTUACPI
      FACP GBT   GBTUACPI
      HPET GBT   GBTUACPI
      MCFG GBT   GBTUACPI
      SSDT PmRef CpuPm


    • Edited by sjd200 Wednesday, April 11, 2012 4:44 PM
    Wednesday, April 11, 2012 4:41 PM
  • No replies?
    Thursday, April 12, 2012 2:36 PM
  • "sjd200" wrote in message news:b996d471-6350-4b2f-81da-293baff22705...

    chkdsk found and corrected some errors, but SFC "did not find any integrity violations"--even though the GA diagnostic tool still thinks sppwinob.dll is corrupt/tampered.

    I have run Security Essentials since the OS was installed and it hasn't found any malware or virus/worms. Nor do I engage in behavior that would lead to infection. 

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-PXDKY-4PXXP-GWGBB
    Windows Product Key Hash: ywASlhuYhPcUwuQLSWCsuEUdvLE=
    Windows Product ID: 00426-293-0664041-85993
    Windows Product ID Type: 5
    Windows License Type: Retail
    Windows OS version: 6.1.7601.2.00010100.1.0.001


    File Scan Data-->
    File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003

    Other data-->
    SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>P35-DS3L</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F9</Version><SMBIOSVersion major="2" minor="4"/><Date>20090619000000.000000+000</Date></BIOS


    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, Ultimate edition
    Description: Windows Operating System - Windows(R) 7, RETAIL channel
    Partial Product Key: GWGBB
    License Status: Licensed
    Remaining Windows rearm count: 4
    Trusted time: 4/11/2012 9:28:10 AM


    Tampered File: %systemroot%\system32\sppwinob.dll

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes, but no SLIC table

     
     
    Sorry - must have missed it last night.
    As you say - no change in the report.
    Please run the following commands in an elevated command prompt window...
     
    ICACLS C:\Windows\System32\sppwinob.dll
    DIR C:\Windows\System32\sppwinob.dll /s
    REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Modules\179b8a65-b0f6-41d9-acea-12006ef9b32a"
     
    Post the results.
    Here are some instructions to make life easier :)
    1) To open an Elevated Command Prompt Window (the CP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
    2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Windows, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
    3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Thursday, April 12, 2012 3:53 PM
    Moderator
  • Thanks Noel,

    Here are the results your instructions:

    C:\Windows\system32>ICACLS C:\Windows\System32\sppwinob.dll
    C:\Windows\System32\sppwinob.dll NT SERVICE\TrustedInstaller:(F)
                                     BUILTIN\Administrators:(RX)
                                     NT AUTHORITY\SYSTEM:(RX)
                                     BUILTIN\Users:(RX)

    Successfully processed 1 files; Failed processing 0 files

    C:\Windows\system32>DIR C:\Windows\System32\sppwinob.dll /s
     Volume in drive C has no label.
     Volume Serial Number is 5A93-BA33

     Directory of C:\Windows\System32

    11/20/2010  06:27 AM           418,816 sppwinob.dll
                   1 File(s)        418,816 bytes

         Total Files Listed:
                   1 File(s)        418,816 bytes
                   0 Dir(s)   8,132,231,168 bytes free

    C:\Windows\system32>REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
    \SoftwareProtectionPlatform\Plugins\Modules\179b8a65-b0f6-41d9-acea-12006ef9b32a
    "

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtecti
    onPlatform\Plugins\Modules\179b8a65-b0f6-41d9-acea-12006ef9b32a
        ManifestFile    REG_SZ    %windir%\system32\spp\plugin-manifests-signed\sppw
    inob-spp-plugin-manifest-signed.xrm-ms
        PluginFile    REG_SZ    %windir%\system32\sppwinob.dll


    C:\Windows\system32>

    and just in case, another diagnostic report (run after the commands above):

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-PXDKY-4PXXP-GWGBB
    Windows Product Key Hash: ywASlhuYhPcUwuQLSWCsuEUdvLE=
    Windows Product ID: 00426-293-0664041-85993
    Windows Product ID Type: 5
    Windows License Type: Retail
    Windows OS version: 6.1.7601.2.00010100.1.0.001
    ID: {B4E1F8F3-B820-4429-AC26-EF2505B0889B}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Ultimate
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.111118-2330
    TTS Error: 
    Validation Diagnostic: 
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->
    File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{B4E1F8F3-B820-4429-AC26-EF2505B0889B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-GWGBB</PKey><PID>00426-293-0664041-85993</PID><PIDType>5</PIDType><SID>S-1-5-21-2433741074-3365209427-128144405</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>P35-DS3L</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F9</Version><SMBIOSVersion major="2" minor="4"/><Date>20090619000000.000000+000</Date></BIOS><HWID>2A0E3B07018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, Ultimate edition
    Description: Windows Operating System - Windows(R) 7, RETAIL channel
    Activation ID: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00426-00170-293-066404-00-1033-7601.0000-1012012
    Installation ID: 006546620186403354879452251236919572278612462110795863
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: GWGBB
    License Status: Licensed
    Remaining Windows rearm count: 4
    Trusted time: 4/12/2012 10:50:41 AM

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0000000000000080
    Event Time Stamp: 4:11:2012 11:33
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\sppwinob.dll


    HWID Data-->
    HWID Hash Current: PAAAAAEABgABAAEAAAADAAAAAwABAAEA6GHA1o49GJ9a2XTmiP3iX5iyEvKQKkw2vqSjoJ8WcCdK4yqF

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes, but no SLIC table
    Windows marker version: N/A
    OEMID and OEMTableID Consistent: N/A
    BIOS Information: 
      ACPI Table Name OEMID Value OEMTableID Value
      APIC GBT   GBTUACPI
      FACP GBT   GBTUACPI
      HPET GBT   GBTUACPI
      MCFG GBT   GBTUACPI
      SSDT PmRef CpuPm


    Thursday, April 12, 2012 6:02 PM
  • Those commands were for information-gathering purposes, rather than an attempt to fix anything - unfortunately, everything there is as normal.

    Have you tried a System Restore back to before the notification showed up? - or do I read your inital post to be saying that it has always shown as non-genuine?

    If that fails for any reason, or you don't want to try it, please try recreating the Licensing Store - it will force a re-evaluationof the license, and may fix he problem.

    Recreate the Licensing Store
    1)
    Click Start button.
    2) Type: CMD.exe into the 'Search programs and files'
    field
    3) Right-Click on CMD.exe and select Run as Administrator
    4) Type:
    net stop sppsvc (It may ask you if you are sure, select yes)
    Note: the
    Software Protection service may not be running, this is ok.
    5) Type: cd
    %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform
    6)
    Type: rename tokens.dat tokens.bar
    7) Type: cd %windir%\system32
    8) Type:
    net start sppsvc
    9) Type: slui.exe
    10) After a couple of seconds Windows
    Activation dialog will appear. You may be asked to re-activate and/or re-enter
    your product key or Activation may occur automatically.
    You may have to use telephone
    activation.


    Reboot and Post back with a new MGADiag
    report


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    • Proposed as answer by Darin Smith MS Friday, April 13, 2012 5:56 PM
    • Marked as answer by Darin Smith MS Monday, April 16, 2012 7:11 PM
    • Unmarked as answer by sjd200 Tuesday, April 17, 2012 2:56 AM
    • Unproposed as answer by Darin Smith MS Tuesday, April 17, 2012 7:40 PM
    Thursday, April 12, 2012 6:20 PM
    Moderator
  • The genuine advantage warning first manifested itself on Monday. Unfortunately, I don't see any system restore from before today's patches were applied, so I'm stuck in that regard. 

    Is there any downside to recreating the licensing store--i.e. reduce the number of remaining activations or similar?

    Thursday, April 12, 2012 8:17 PM
  • "sjd200" wrote in message news:a85292d3-ccc1-4a26-9fa4-d85a4c82bccd...

    The genuine advantage warning first manifested itself on Monday. Unfortunately, I don't see any system restore from before today's patches were applied, so I'm stuck in that regard.

    Is there any downside to recreating the licensing store--i.e. reduce the number of remaining activations or similar?

    You can't get any worse off than you are now  - activation will be back to normal when we get it working again.

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Thursday, April 12, 2012 8:25 PM
    Moderator
  • No further reply from the original Poster.

    Issue is assumed to be resolved.


    Darin MS

    That's a shameless assumption, considering its a defect in your product that is giving me this issue to start with... I paid money for this software; I have proof of purchase; I have a license key that passes activation. And yet somehow your OS managed to corrupt one of it's own files, and you assume I'm the criminal--or at least that I got my software from one.

    From where I stand it is Microsoft who has stolen a valid license from me. That, and about 10 hours of my valuable time trying to run down all these potential solutions--none of which have worked.

    So what do you have for me now, Microsoft? You have wrongfully seized my license and provided nothing in return. As you can see from below, the OS is still broken, and I'm betting your next (and only) solution will be a reinstall.

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-PXDKY-4PXXP-GWGBB
    Windows Product Key Hash: ywASlhuYhPcUwuQLSWCsuEUdvLE=
    Windows Product ID: 00426-293-0664041-85993
    Windows Product ID Type: 5
    Windows License Type: Retail
    Windows OS version: 6.1.7601.2.00010100.1.0.001
    ID: {B4E1F8F3-B820-4429-AC26-EF2505B0889B}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Ultimate
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.111118-2330
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->
    File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{B4E1F8F3-B820-4429-AC26-EF2505B0889B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-GWGBB</PKey><PID>00426-293-0664041-85993</PID><PIDType>5</PIDType><SID>S-1-5-21-2433741074-3365209427-128144405</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>P35-DS3L</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F9</Version><SMBIOSVersion major="2" minor="4"/><Date>20090619000000.000000+000</Date></BIOS><HWID>2A0E3B07018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, Ultimate edition
    Description: Windows Operating System - Windows(R) 7, RETAIL channel
    Activation ID: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00426-00170-293-066404-00-1033-7601.0000-1012012
    Installation ID: 006546620186403354879452251236919572278612462110795863
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: GWGBB
    License Status: Licensed
    Remaining Windows rearm count: 4
    Trusted time: 4/16/2012 7:51:42 PM

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0000000000000080
    Event Time Stamp: 4:16:2012 06:54
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\sppwinob.dll


    HWID Data-->
    HWID Hash Current: PAAAAAEABgABAAEAAAADAAAAAwABAAEA6GHA1o49GJ9a2XTmiP3iX5iyEvKQKkw2vqSjoJ8WcCdK4yqF

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes, but no SLIC table
    Windows marker version: N/A
    OEMID and OEMTableID Consistent: N/A
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            GBT           GBTUACPI
      FACP            GBT           GBTUACPI
      HPET            GBT           GBTUACPI
      MCFG            GBT           GBTUACPI
      SSDT            PmRef        CpuPm

    Tuesday, April 17, 2012 3:06 AM
  • "sjd200" wrote in message news:c1944fc4-2511-4dd1-9064-95d8aeb1bae0...

     

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-PXDKY-4PXXP-GWGBB
    Windows Product Key Hash: ywASlhuYhPcUwuQLSWCsuEUdvLE=
    Windows Product ID: 00426-293-0664041-85993
    Windows Product ID Type: 5
    Windows License Type: Retail
    Windows OS version: 6.1.7601.2.00010100.1.0.001


    File Scan Data-->
    File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003


    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0000000000000080
    Event Time Stamp: 4:16:2012 06:54
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\sppwinob.dll




    Just as a point of fact - MS did nothing.
    Something happened to your installation to invalidate the activation - either because of the action of software, or user error.
    The actual error you have is a rare one - sppwinob.dll on its own being tampered - and doesn't seem to be amenable to an easy solution.
     
    You are perfectly at liberty to Unmark the answer - and I suggest that you do - until such time as the problem is actually solved. Darin has a set of guidelines to work to in respect of tagging questions as 'answered', one of which is if there has been no response from the original poster for a few days.
     
    Have you actually attempted the recreation of teh Licensing Store? If you got error messages, at what point did you get them? What happened when you re-entered the Key?
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Tuesday, April 17, 2012 7:08 AM
    Moderator
  • Noel,

    I did run your set of instructions to re-create the licensing store. It seemed to work fine--except that it was ineffective in solving the corruption with sppwinob.dll as indicated by the diagnostic report above.

    And while I appreciate your help, I can't agree with you that is it good (or honest) practice--published or not--to mark questions as 'Answered' when they are not. The whole purpose of the Answered marking is to help people search out effective solutions to their problems. If there is no solution/workaround/explanation of how to avoid the problem, then the issue should not be marked as solved.

    Nor would I agree that MS did nothing. They created the licensing scheme which breaks without apparent cause and are now proclaiming my legal version of Windows as counterfeit. And once they have proclaimed my legal version as counterfeit, the only 'solution' they guide me to is to buy another copy--I had to search of this forum on my own. 

    So what else could they do? Well--why not make the Activation (SLUI) tool useful by giving it the ability to repair these files once my license key is validated? As it is, I have a bi-polar OS that simultaneously tells me my genuine Windows has been activated, while another window pops up and says I need to go buy a legal copy of my OS before they start disabling functionality. As far as I'm concerned that's the only theft going on here; and who designed and programmed this contradiction? --Microsoft.


    Tuesday, April 17, 2012 4:23 PM
  • "sjd200" wrote in message news:f709dd41-a4bc-4c47-a47f-e13e233ec25d...

    Noel,

    I did run your set of instructions to re-create the licensing store. It seemed to work fine--except that it was ineffective in solving the corruption with sppwinob.dll as indicated by the diagnostic report above.

    So what else could they do? Well--why not make the Activation (SLUI) tool useful by giving it the ability to repair these files once my license key is validated? As it is, I have a bi-polar OS that simultaneously tells me my genuine Windows has been activated, while another window pops up and says I need to go buy a legal copy of my OS before they start disabling functionality. As far as I'm concerned that's the only theft going on here; and who designed and programmed this contradiction? --Microsoft.


     
     
     
    Can't argue with the last paragraph! :)
    Hopefully Windows 8 will be less schizoid, since it's been built with both activation and validation well in hand.
     
    Meanwhile - back  at t'mill, as they used to say.....
     
    let's doublecheck the status of spwinob.dll...
    please run the following in an Elevated Command Prompt
     
    SFC /scanfile=C:\Windows\System32\sppwinob.dll
    DIR C:\sppwinob.dll /S
    DIR C:\sppwinob.dll /S /ah
    DIR C:\sppwinob.dll /S /as
    DIR C:\sppwinob.dll /S /ar
     
    ( I expect the last three to be 'Not Found', unless there is malware present)
     
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Tuesday, April 17, 2012 4:44 PM
    Moderator
  • I've just had reports from another forum where a poster had what appears to bean identical problem.

    Their system was becoming more and more unstable, assuming they had malware problems they elected to reformat/reinstall. I have asked for clarification/confirmation if possible.

    How certain are you that you system is clear of malware?


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Tuesday, April 17, 2012 4:51 PM
    Moderator
  • I have no signs of malware infection--nothing showing up on the virus scans, no suspect software--toolbars, popups, etc. 

    Here's the output from your suggested commands:

    C:\Windows\System32>SFC /scanfile=C:\Windows\System32\sppwinob.dll

    Windows Resource Protection found corrupt files but was unable to fix some of th
    em.
    Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
    C:\Windows\Logs\CBS\CBS.log

    C:\Windows\System32>DIR C:\sppwinob.dll /S

     Volume in drive C has no label.
     Volume Serial Number is 5A93-BA33

     Directory of C:\Windows\System32

    11/20/2010  06:27 AM           418,816 sppwinob.dll
                   1 File(s)        418,816 bytes

     Directory of C:\Windows\winsxs\amd64_microsoft-windows-s..-spp-plugin-windows_3
    1bf3856ad364e35_6.1.7600.16385_none_6daf1bf0165f608f

    07/13/2009  06:41 PM           418,816 sppwinob.dll
                   1 File(s)        418,816 bytes

     Directory of C:\Windows\winsxs\amd64_microsoft-windows-s..-spp-plugin-windows_3
    1bf3856ad364e35_6.1.7601.17514_none_6fe02fb8134de429

    11/20/2010  06:27 AM           418,816 sppwinob.dll
                   1 File(s)        418,816 bytes

         Total Files Listed:
                   3 File(s)      1,256,448 bytes
                   0 Dir(s)   6,558,633,984 bytes free

    C:\Windows\System32>DIR C:\sppwinob.dll /S /ah
     Volume in drive C has no label.
     Volume Serial Number is 5A93-BA33
    File Not Found

    C:\Windows\System32>DIR C:\sppwinob.dll /S /as
     Volume in drive C has no label.
     Volume Serial Number is 5A93-BA33
    File Not Found

    C:\Windows\System32>DIR C:\sppwinob.dll /S /ar
     Volume in drive C has no label.
     Volume Serial Number is 5A93-BA33
    File Not Found

    C:\Windows\System32>

    Tuesday, April 17, 2012 7:29 PM
  • "sjd200" wrote in message news:50de77e8-2a9c-41e1-a2d3-1239ca9d91e0...

    I have no signs of malware infection--nothing showing up on the virus scans, no suspect software--toolbars, popups, etc.

    Here's the output from your suggested commands:

    C:\Windows\System32>SFC /scanfile=C:\Windows\System32\sppwinob.dll

    Windows Resource Protection found corrupt files but was unable to fix some of th
    em.
    Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
    C:\Windows\Logs\CBS\CBS.log
     
     
    OK we have a sensible result, finally! If you have another machine with SP1 installed, you could try copying the file across from there, while in WinRE using the command prompt there (you won't be able to do it from  normal mode, and I don't think it's possible in Safe Mode, either)
     
    If y

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Tuesday, April 17, 2012 8:16 PM
    Moderator
  • No reply from the Original Poster.

    Issue is assumed to be resolved.


    Darin MS

    Monday, April 23, 2012 8:44 PM