Answered by:
You may be a victim of counterfeiting started appearing on Windows 7

Question
-
I have a customer for whom we fitted a new SSD drive for in their desktop PC after the previous one failed. We re-installed Windows 7 from the original installation disc he had and it has been working fine for the past few months.
He has just recently contacted us to report that he is constantly getting a message saying his copy of Windows is not activated and that he may be a victim of software counterfeiting. I have visited him once and managed to re-activate windows online. I then performed all Windows updates and Microsoft Security Essentials update.
It is now a couple of days later and the same issue has reared its ugly head. He is also experiencing issues with IE and Chrome crashing all the time and the copy of Adobe Photoshop he just installed after I re-activated his copy of Windows has suddenly stopped working, coming up with a message about missing dll files.
Any bright ideas about where to start? I suspect some form of malware is present and causing these issues but the scans I ran using MSE and MBAM resulted in nothing at all.
Monday, December 10, 2012 11:00 AM
Answers
-
The 0x800700c1 error is a common enough one (not a valid Win32 file) - but not in the context of an MGADiag report.
Looking at the SFC log, you have major corruption, and the scan broke at an early stage without completing.
2012-12-11 10:11:05, Error CSI 000000c2 (F) STATUS_OBJECT_NAME_NOT_FOUND #982433# from Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey(flg = (AllowAccessDenied), key = {provider=NULL, handle=0}, da = (KEY_READ|KEY_WOW64_64KEY), oa = @0xd4c5a0->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[152]"\Registry\Machine\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-btpanui-mui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_43a07586eec725b""; a:(OBJ_CASE_INSENSITIVE)}, disp = Unmapped dis (0x00d4c540))[gle=0xd0000034] 2012-12-11 10:11:05, Error CSI 000000c3@2012/12/11:10:11:05.887 (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(3676): Error STATUS_OBJECT_NAME_NOT_FOUND originated in function Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey expression: (null) [gle=0x80004005] 2012-12-11 10:11:07, Error CSI 000000c4 (F) STATUS_OBJECT_NAME_NOT_FOUND #982432# from Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey(flg = 0, key = {provider=NULL, handle=0}, da = (KEY_READ|KEY_WOW64_64KEY), oa = @0xd4c5a0->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[152]"\Registry\Machine\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-btpanui-mui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_43a07586eec725b""; a:(OBJ_CASE_INSENSITIVE)}, disp = Unmapped dis (0x00d4c7f8))[gle=0xd0000034] 2012-12-11 10:11:07, Error CSI 000000c5@2012/12/11:10:11:07.385 (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(3676): Error STATUS_OBJECT_NAME_NOT_FOUND originated in function Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey expression: (null) [gle=0x80004005] 2012-12-11 10:11:07, Error CSI 000000c6 (F) STATUS_OBJECT_NAME_NOT_FOUND #982431# from Windows::Rtl::SystemImplementation::CBufferedRegistryProvider::ReopenHandleIfNecessary(...)[gle=0xd0000034] 2012-12-11 10:11:07, Error CSI 000000c7 (F) STATUS_OBJECT_NAME_NOT_FOUND #982430# from Windows::Rtl::SystemImplementation::CBufferedRegistryProvider::SysOpenKey(flg = (AllowKeyNotFound), key = {provider=NULL, handle=0}, da = (KEY_READ), oa = @0xd4cb30->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[152]"\Registry\Machine\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-btpanui-mui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_43a07586eec725bb"; a:(OBJ_CASE_INSENSITIVE)}, disp = Unmapped dis (0x00d4cef8))[gle=0xd0000034] 2012-12-11 10:11:07, Error CSI 000000c8 (F) STATUS_OBJECT_NAME_NOT_FOUND #982429# from Windows::Rtl::SystemImplementation::CKey::OpenExistingKey(f = 3, da = (KEY_READ), oa = @0xd4d0f8, key = NULL, disp = 0)[gle=0xd0000034]
I am thinking in terms of a repair install as a minimum here - but you may well have to do a clean install.
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
- Proposed as answer by Noel D PatonModerator Sunday, December 16, 2012 10:51 PM
- Marked as answer by george1009Editor Thursday, December 20, 2012 6:56 PM
Tuesday, December 11, 2012 11:31 AMModerator
All replies
-
To properly analyse and solve problems with Activation and Validation, we need to see a full copy of the report produced by the MGADiag tool
(download and save to desktop - http://go.microsoft.com/fwlink/?linkid=52012 )
Once saved, run the tool.
Click on the Continue button, which will produce the report.
To copy the report to your response, click on the Copy button in the tool (ignore any error messages at this point), and then paste (using either r-click/Paste, or Ctrl+V ) into your response.
- **in your own thread**, please
Please also state the Version and Edition of Windows quoted on your COA sticker (if you have one) on the case of your machine (or inside the battery compartment), but do NOT quote the Key on the sticker!
http://www.microsoft.com/en-us/howtotell/Hardware.aspxHaving said that, with the history stated, it's likely to be a problem with the IRST drivers.....
This may simply be caused by a bad set of Intel Rapid Storage Technology drivers -
Installing the Intel Rapid Storage Drivers
try downloading and installing them from here - http://downloadcenter.intel.com/Detail_Desc.aspx?agr=Y&ProdId=2101&DwnldID=21730
(you want the iata_enu.exe download)
Once complete, please reboot twice, then post another MGADiag report.
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
Monday, December 10, 2012 12:44 PMModerator -
Hi Noel, I was hoping to hear from you, as you seemed to be so helpful on the other threads.
The customer is using Windows Home Premium OEM 64 bit (GFC-00599) which was pre-installed on the machine when he purchased it. We used his Windows disc that was supplied to him by the manufacturer/vendor when we re-installed in on the replacement SSD drive.
I will follow this up with a copy of the MCADiag log file as soon as I get it from the customer.
Having read a few other threads relating to similar issues, it does sound as though the IRSD is what is at fault. I hope so as that will be a fairly easy fix. Is it common for this sort of issue to manifest itself after working fine for weeks after the hardware change upgrade?
Regards,
Chris.
Monday, December 10, 2012 1:43 PM -
It can happen at any time, seemingly - most common is after restoring an image or cloning to a new HD/SSD.
Thinking about the change to SSD from HD - did you (or the installation software) properly prepare the drive for use? It requires a different type of preparation to an HD (never had the money to do it myself!, so don't ask me).
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
Monday, December 10, 2012 4:39 PMModerator -
Here is a copy of the log from the MCADiag program. I had to run it in safe mode as it kept crashing when run normally.
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 50
Cached Online Validation Code: N/A, hr = 0x8007043c
Windows Product Key: *****-*****-V3QH8-3PQQJ-3GTRD
Windows Product Key Hash: DO0jIFWUNj1QoN65Al0Ec3Fw35Q=
Windows Product ID: 00359-OEM-8703386-94591
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {95724825-09B9-4906-A3DB-7F4F434C3089}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120830-0333
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Home and Student 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{95724825-09B9-4906-A3DB-7F4F434C3089}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-3GTRD</PKey><PID>00359-OEM-8703386-94591</PID><PIDType>3</PIDType><SID>S-1-5-21-220791487-1642154700-1185608686</SID><SYSTEM><Manufacturer>MSI</Manufacturer><Model>MS-7522</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>V22.1</Version><SMBIOSVersion major="2" minor="5"/><Date>20100728000000.000000+000</Date></BIOS><HWID>1B0D3707018400FE</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>48E615D8E9DF3A</Val><Hash>g+tMoyMOdqMVwROtE3R93zQd5Is=</Hash><Pid>81602-925-9470332-68023</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x8007043C' to display the error text.
Error: 0x8007043C
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0xC004F022
HealthStatus: 0x0000000000000000
Event Time Stamp: 12:2:2012 17:21
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Not Registered - 0x8007043c
HealthStatus Bitmask Output:
HWID Data-->
HWID Hash Current: NgAAAAEABgABAAEAAQAAAAAAAgABAAEAonaADigN4meK1Ua8hDQIhRIf/GQumT7bKm3aYeqC
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC 7522MS A7522900
FACP 7522MS A7522900
HPET 7522MS OEMHPET
MCFG 7522MS OEMMCFG
OEMB 7522MS A7522900
SSDT DpgPmm CpuPm
Monday, December 10, 2012 5:51 PM -
Rebooted machine and ran MCADiag again after managing to activate windows online again. Here are the second set of log results:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-V3QH8-3PQQJ-3GTRD
Windows Product Key Hash: DO0jIFWUNj1QoN65Al0Ec3Fw35Q=
Windows Product ID: 00359-OEM-8703386-94591
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {95724825-09B9-4906-A3DB-7F4F434C3089}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120830-0333
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Home and Student 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{95724825-09B9-4906-A3DB-7F4F434C3089}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-3GTRD</PKey><PID>00359-OEM-8703386-94591</PID><PIDType>3</PIDType><SID>S-1-5-21-220791487-1642154700-1185608686</SID><SYSTEM><Manufacturer>MSI</Manufacturer><Model>MS-7522</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>V22.1</Version><SMBIOSVersion major="2" minor="5"/><Date>20100728000000.000000+000</Date></BIOS><HWID>1B0D3707018400FE</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>48E615D8E9DF3A</Val><Hash>g+tMoyMOdqMVwROtE3R93zQd5Is=</Hash><Pid>81602-925-9470332-68023</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
C:\Windows\system32\slmgr.vbs(2338, 65) Microsoft VBScript compilation error: Invalid character
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 12:10:2012 18:03
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
HWID Data-->
HWID Hash Current: OgAAAAEABgABAAEAAQACAAAAAgABAAEAonaADigN4meK1Ua8hDQIhRIf/GQumT7bQn0Q+Spt2mHqgg==
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC 7522MS A7522900
FACP 7522MS A7522900
HPET 7522MS OEMHPET
MCFG 7522MS OEMMCFG
OEMB 7522MS A7522900
SSDT DpgPmm CpuPm
Monday, December 10, 2012 6:06 PM -
In three years of reading MGADiag reports, I've never seen that error....
Licensing Data-->
C:\Windows\system32\slmgr.vbs(2338, 65) Microsoft VBScript compilation error: Invalid characterI'll have to research it - but in the meantime....
Please run a full CHKDSK and SFC scan....
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.
At the Command prompt, type
CHKDSK C: /R
and hit the Enter key.
You will be told that the drive is locked,
and the CHKDSK will run at he next boot - hit the Y key, and then reboot.
The CHKDSK will take a few hours depending on the size of the drive, so be patient!
After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -
then run the SFC.
SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.
At the Command prompt, type
SFC /SCANNOW
and hit the Enter key
Wait for the scan to finish - make a note of any error messages - and then reboot.
Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your SkyDrive (http://skydrive.live.com ) and post a link to it so that I can take a look.
Post a new MGADiag report with details of any error messages encountered.
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
Monday, December 10, 2012 8:16 PMModerator -
I have run both the CHKDSK and SFC. Here is a link to the CBS.log file:
http://dl.dropbox.com/u/7808524/Error%20Reports/CBS.log
Tuesday, December 11, 2012 10:19 AM -
Here is the latest MCADiag Log run this morning afetr carrying out the above procedures.
Diagnostic Report (1.9.0027.0): ----------------------------------------- Windows Validation Data--> Validation Code: 0x8004FE21 Cached Online Validation Code: N/A, hr = 0x800700c1 Windows Product Key: *****-*****-V3QH8-3PQQJ-3GTRD Windows Product Key Hash: DO0jIFWUNj1QoN65Al0Ec3Fw35Q= Windows Product ID: 00359-OEM-8703386-94591 Windows Product ID Type: 3 Windows License Type: OEM System Builder Windows OS version: 6.1.7601.2.00010300.1.0.003 ID: {95724825-09B9-4906-A3DB-7F4F434C3089}(3) Is Admin: Yes TestCab: 0x0 LegitcheckControl ActiveX: N/A, hr = 0x80070002 Signed By: N/A, hr = 0x80070002 Product Name: Windows 7 Home Premium Architecture: 0x00000009 Build lab: 7601.win7sp1_gdr.120830-0333 TTS Error: Validation Diagnostic: Resolution Status: N/A Vista WgaER Data--> ThreatID(s): N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 Windows XP Notifications Data--> Cached Result: N/A, hr = 0x80070002 File Exists: No Version: N/A, hr = 0x80070002 WgaTray.exe Signed By: N/A, hr = 0x80070002 WgaLogon.dll Signed By: N/A, hr = 0x80070002 OGA Notifications Data--> Cached Result: N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 OGAExec.exe Signed By: N/A, hr = 0x80070002 OGAAddin.dll Signed By: N/A, hr = 0x80070002 OGA Data--> Office Status: 100 Genuine Microsoft Office Home and Student 2007 - 100 Genuine OGA Version: N/A, 0x80070002 Signed By: N/A, hr = 0x80070002 Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3 Browser Data--> Proxy settings: N/A User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32) Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe Download signed ActiveX controls: Prompt Download unsigned ActiveX controls: Disabled Run ActiveX controls and plug-ins: Allowed Initialize and script ActiveX controls not marked as safe: Disabled Allow scripting of Internet Explorer Webbrowser control: Disabled Active scripting: Allowed Script ActiveX controls marked as safe for scripting: Allowed File Scan Data--> File Mismatch: C:\Windows\system32\sppsvc.exe[Hr = 0x80004005] Other data--> Office Details: <GenuineResults><MachineData><UGUID>{95724825-09B9-4906-A3DB-7F4F434C3089}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-3GTRD</PKey><PID>00359-OEM-8703386-94591</PID><PIDType>3</PIDType><SID>S-1-5-21-220791487-1642154700-1185608686</SID><SYSTEM><Manufacturer>MSI</Manufacturer><Model>MS-7522</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>V22.1</Version><SMBIOSVersion major="2" minor="5"/><Date>20100728000000.000000+000</Date></BIOS><HWID>1B0D3707018400FE</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>48E615D8E9DF3A</Val><Hash>g+tMoyMOdqMVwROtE3R93zQd5Is=</Hash><Pid>81602-925-9470332-68023</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> Spsys.log Content: 0x80070002 Licensing Data--> On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x800700C1' to display the error text. Error: 0x800700C1 Windows Activation Technologies--> HrOffline: 0x8004FE21 HrOnline: N/A HealthStatus: 0x000000000000C000 Event Time Stamp: 12:11:2012 09:31 ActiveX: Registered, Version: 7.1.7600.16395 Admin Service: Registered, Version: 7.1.7600.16395 HealthStatus Bitmask Output: Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui HWID Data--> HWID Hash Current: OgAAAAEABgABAAEAAQACAAAAAgABAAEABvKWeeRiFDFgK0pOUFJUzYL/zCVy9VqAhkqOKiqY/iV6FQ== OEM Activation 1.0 Data--> N/A OEM Activation 2.0 Data--> BIOS valid for OA 2.0: yes, but no SLIC table Windows marker version: N/A OEMID and OEMTableID Consistent: N/A BIOS Information: ACPI Table Name OEMID Value OEMTableID Value APIC 7522MS A7522900 FACP 7522MS A7522900 HPET 7522MS OEMHPET MCFG 7522MS OEMMCFG OEMB 7522MS A7522900 SSDT DpgPmm CpuPm
Tuesday, December 11, 2012 10:29 AM -
As a further update, when I tried to install the latest IRS drivers it fails and I get the following error:
Error Code: -5009 : 0x8000ffff Error Information: >Kernel\IScriptWrapper.cpp (20) >Kernel\ObjectWrapper.cpp (162) >Kernel\ObjectWrapper.cpp (557) >Kernel\Component.cpp (1179) >Kernel\CABFile.cpp (429) >SetupNew\SetupDLL.cpp (1098) pAPP:Intel(R) Installation Framework PVENDOR:Intel PGUID:40FEF622-6E0F-46B6-824B-A40C178FD4CD $12.0.0.49974PAK @Windows XP Service Pack 1 (7601) BT_OTHER 15508.30504
http://dl.dropbox.com/u/7808524/Error%20Reports/IRSD%20Install%20Error%20Message.PNG- Edited by Crustyloafer Tuesday, December 11, 2012 10:33 AM
Tuesday, December 11, 2012 10:30 AM -
The 0x800700c1 error is a common enough one (not a valid Win32 file) - but not in the context of an MGADiag report.
Looking at the SFC log, you have major corruption, and the scan broke at an early stage without completing.
2012-12-11 10:11:05, Error CSI 000000c2 (F) STATUS_OBJECT_NAME_NOT_FOUND #982433# from Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey(flg = (AllowAccessDenied), key = {provider=NULL, handle=0}, da = (KEY_READ|KEY_WOW64_64KEY), oa = @0xd4c5a0->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[152]"\Registry\Machine\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-btpanui-mui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_43a07586eec725b""; a:(OBJ_CASE_INSENSITIVE)}, disp = Unmapped dis (0x00d4c540))[gle=0xd0000034] 2012-12-11 10:11:05, Error CSI 000000c3@2012/12/11:10:11:05.887 (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(3676): Error STATUS_OBJECT_NAME_NOT_FOUND originated in function Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey expression: (null) [gle=0x80004005] 2012-12-11 10:11:07, Error CSI 000000c4 (F) STATUS_OBJECT_NAME_NOT_FOUND #982432# from Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey(flg = 0, key = {provider=NULL, handle=0}, da = (KEY_READ|KEY_WOW64_64KEY), oa = @0xd4c5a0->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[152]"\Registry\Machine\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-btpanui-mui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_43a07586eec725b""; a:(OBJ_CASE_INSENSITIVE)}, disp = Unmapped dis (0x00d4c7f8))[gle=0xd0000034] 2012-12-11 10:11:07, Error CSI 000000c5@2012/12/11:10:11:07.385 (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(3676): Error STATUS_OBJECT_NAME_NOT_FOUND originated in function Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey expression: (null) [gle=0x80004005] 2012-12-11 10:11:07, Error CSI 000000c6 (F) STATUS_OBJECT_NAME_NOT_FOUND #982431# from Windows::Rtl::SystemImplementation::CBufferedRegistryProvider::ReopenHandleIfNecessary(...)[gle=0xd0000034] 2012-12-11 10:11:07, Error CSI 000000c7 (F) STATUS_OBJECT_NAME_NOT_FOUND #982430# from Windows::Rtl::SystemImplementation::CBufferedRegistryProvider::SysOpenKey(flg = (AllowKeyNotFound), key = {provider=NULL, handle=0}, da = (KEY_READ), oa = @0xd4cb30->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[152]"\Registry\Machine\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-btpanui-mui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_43a07586eec725bb"; a:(OBJ_CASE_INSENSITIVE)}, disp = Unmapped dis (0x00d4cef8))[gle=0xd0000034] 2012-12-11 10:11:07, Error CSI 000000c8 (F) STATUS_OBJECT_NAME_NOT_FOUND #982429# from Windows::Rtl::SystemImplementation::CKey::OpenExistingKey(f = 3, da = (KEY_READ), oa = @0xd4d0f8, key = NULL, disp = 0)[gle=0xd0000034]
I am thinking in terms of a repair install as a minimum here - but you may well have to do a clean install.
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
- Proposed as answer by Noel D PatonModerator Sunday, December 16, 2012 10:51 PM
- Marked as answer by george1009Editor Thursday, December 20, 2012 6:56 PM
Tuesday, December 11, 2012 11:31 AMModerator -
I thought that might be the case. I will go back to the customer and see what they say.
Do you have any idea of what the likely cause of such a major corruption would be? It only started misbehaving in the last two weeks or so.
- Edited by Crustyloafer Tuesday, December 11, 2012 12:07 PM
Tuesday, December 11, 2012 11:57 AM -
Not rteally - have a look at the CHKDSK result in Event Viewer (Wininit event in the Windows Applications logs) - it may show if there are bad 'sectors' on the SSD.
Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
Tuesday, December 11, 2012 12:15 PMModerator -
It looks like the Kingston corruption bug.
Do a secure erase and update the firmware before reinstall.
Better yet install a reliable SSD like a Toshiba Thinstate, Micron C400, or Samsung 830. There is a valid reason OEMs refuse to use OCZ and Kingston hardware.
Sometimes a reduction in speed is worth the stability.
Saturday, December 15, 2012 1:36 AM