locked
Windows 7 not genuine anymore! RRS feed

  • Question

  • Hi all,

     

    Ihave the same problem all other here have

    Acer Aspire X3900 windows 7 x64 dutch suddently tells me he is not genuin anymore
    looked in this forum and done already a few actios
    did CHKDSK C: /R
    and the SFC /SCANNOW
    none of them gave any error or problem

    here is my MGADIAG result

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: N/A, hr = 0xc0000022
    Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
    Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
    Windows Product ID: 00359-OEM-8992687-00006
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {286845A1-B3C8-491C-99C6-236685CA807D}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.110622-1506
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 102
    Microsoft Office Home and Student 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{286845A1-B3C8-491C-99C6-236685CA807D}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-589309079-1030021236-3799233346</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire X3900</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>P01-A3</Version><SMBIOSVersion major="2" minor="6"/><Date>20091216000000.000000+000</Date></BIOS><HWID>678D3307018400FC</HWID><UserLCID>0813</UserLCID><SystemLCID>0413</SystemLCID><TimeZone>Romance (standaardtijd)(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>102</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>6756F5571348342</Val><Hash>PZYAmMNgWqfQahiQBTzKj0pWmOw=</Hash><Pid>81602-417-6255897-68395</Pid><PidType>10</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Voer op een computer waarop Microsoft Windows (niet-kern) wordt uitgevoerd de opdracht 'slui.exe 0x2a 0x80070426' uit om de fouttekst weer te geven.
    Fout: 0x80070426

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0001000000000000
    Event Time Stamp: 11:12:2011 13:23
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered Service: sppsvc


    HWID Data-->
    HWID Hash Current: KgAAAAEAAQABAAEAAAABAAAAAQABAAEAonaGtISxkGJ8JnLx3EfyfVxd

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name OEMID Value OEMTableID Value
      APIC   ACRSYS  APIC1345
      FACP   ACRSYS  FACP1345
      HPET   ACRSYS  OEMHPET
      MCFG   ACRSYS  OEMMCFG
      SLIC   ACRSYS  ACRPRDCT
      OEMB   ACRSYS  OEMB1345
      GSCI   ACRSYS  GMCHSCI
      AWMI   ACRSYS  OEMB1345
      SSDT   DpgPmm  CpuPm

    Hope someone can help me to get it back to normal

     

    Greetz Frodotia

    Saturday, November 12, 2011 12:48 PM

Answers

  • "Frodotia" wrote in message news:eb8fe5b7-1da2-4255-b340-893bdaea6b2b...

    Noel,

    here the asked information


    C:\Windows\system32>reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contr
    ol\Session Manager\Environment"

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

        windir    REG_EXPAND_SZ    %SystemRoot%


    C:\Windows\system32>

    greetz Frodotia

     

    Hmm – the line I thought would be missing, isn’t :)  - everything looks normal.
     
    I really have no idea where to go from here.   :(
    Unless Darin or one of the other guys has any better ideas, I think your best option is to go to MS WGA Support.
     
    WGA Support can be found here-

    North America: http://support.microsoft.com/contactus/cu_sc_genadv_master?ws=support&ws=support#tab4

    Outside North America:
    http://support.microsoft.com/contactus/?ws=support#tab0

    Please let us know if (and how) MS manage to repair the problem - it would be useful for future reference!


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Monday, November 14, 2011 1:00 PM
    Moderator

All replies

  • Tampered Service: sppsvc


    Click the start orb & type services.msc into the search menu.

    Click it & maximize the active window. Scroll down to you see Software Protection. Right click & select properites.

    Set the startup type to: Automatic (Delayed Start) and click apply. Reboot the system & then try to validate online using IE.

     

    Saturday, November 12, 2011 2:09 PM
  • thanks for te quick response tb19

    i did what you asked me to do and it was already on automaticaly (delayed)

    so i tried to start the service and received an error that the computer could not find the file specified

    it looks for the file C:\Windows\system32\sppsvc.exe

    how can i restore that one?
    maybe that is the problem, the file is not on the pc anymore?

     

    greetz Frodotia

    Saturday, November 12, 2011 2:26 PM
  • "Frodotia" wrote in message news:62345260-23c4-4165-963e-cb6afb863e99...

    thanks for te quick response tb19

    i did what you asked me to do and it was already on automaticaly (delayed)

    so i tried to start the service and received an error that the computer could not find the file specified

    it looks for the file C:\Windows\system32\sppsvc.exe

    how can i restore that one?
    maybe that is the problem, the file is not on the pc anymore?

     

    greetz Frodotia

    Please re-check whether the file exists – but  this time, use Windows Explorer, and click on Organize in the menu bar, then Folder and Search options. In the View tab, UNcheck ‘Hide extensions for known file types’, and click on ‘Show hidden files and folders’ , and UNcheck ‘Hide protected operating system files’
     
    now look again for the C:\Windows\system32\sppsvc.exe file
     
    If it ‘s still not there, then there is something fairly major wrong with your system, as the SFC should have replaced, or complained that it couldn’t fix things.
    look in the folder
     C:\Windows\winsxs\amd64_microsoft-windows-security-spp_31bf3856ad364e35_6.1.7601.17514_none_78875ce737927d27
     
    does the file exist there? If so, try copying it to the System32 folder.

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Sunday, November 13, 2011 6:15 AM
    Moderator
  • Noel,
    Thanks for the response

    The file is in c:\windows system32

    the service tels me that the file does not exist but its there
    ALso in following directory C:\Windows\winsxs\amd64_microsoft-windows-security-spp_31bf3856ad364e35_6.1.7601.17514_none_78875ce737927d27

    So what could be than the problem that the service tells me that the file does not exsists
    should i still replace it with the file mentioned in the other directory?

     

    Greets Frodotia

    Sunday, November 13, 2011 11:52 PM
  • It probably means that there's an entry in the registry that's wrong - the question is, where?

    Please open an Elevated (Administrator) Command Prompt window and use the following commands....

    sc qc sppsvc
    sc queryex sppsvc
    sc qprivs sppsvc
    sc qsidtype sppsvc
    sc sdshow sppsvc
    (to copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.)
    Can you check in the Task Scheduler for anything related, and also in the Event Viewer?

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Monday, November 14, 2011 12:12 AM
    Moderator
  • Noel,

    here is the asked info

    Microsoft Windows [versie 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation. Alle rechten voorbehouden.

    C:\Windows\system32>sc qc sppsvc
    [SC] QueryServiceConfig VOLTOOID

    SERVICE_NAME: sppsvc
            TYPE               : 10  WIN32_OWN_PROCESS
            START_TYPE         : 2   AUTO_START  (DELAYED)
            ERROR_CONTROL      : 1   NORMAL
            BINARY_PATH_NAME   : C:\Windows\system32\sppsvc.exe
            LOAD_ORDER_GROUP   :
            TAG                : 0
            DISPLAY_NAME       : Software Protection
            DEPENDENCIES       : RpcSs
            SERVICE_START_NAME : NT AUTHORITY\NetworkService

    C:\Windows\system32> sc queryex sppsvc

    SERVICE_NAME: sppsvc
            TYPE               : 10  WIN32_OWN_PROCESS
            STATE              : 1  STOPPED
            WIN32_EXIT_CODE    : 2  (0x2)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0
            PID                : 0
            FLAGS              :

    C:\Windows\system32> sc qprivs sppsvc
    [SC] QueryServiceConfig2 VOLTOOID

    SERVICE_NAME: sppsvc
            BEVOEGDHEDEN     : SeAuditPrivilege
                             : SeChangeNotifyPrivilege
                             : SeCreateGlobalPrivilege
                             : SeImpersonatePrivilege

    C:\Windows\system32> sc qsidtype sppsvc
    [SC] QueryServiceConfig2 VOLTOOID

    SERVICE_NAME: sppsvc
    SERVICE_SID_TYPE:  UNRESTRICTED

    C:\Windows\system32> sc sdshow sppsvc

    D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO
    CRRC;;;IU)(A;;CCLCSWRPLOCRRC;;;SU)(A;;LCRP;;;AU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCW
    DWO;;;WD)

    C:\Windows\system32>

     

    Greetz Frodotia

    Monday, November 14, 2011 9:39 AM
  • "Frodotia" wrote in message news:2ad60c36-1d7d-4ea6-a4c6-9c1f92e79522...

    Noel,

    here is the asked info

    Microsoft Windows [versie 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation. Alle rechten voorbehouden.

    C:\Windows\system32>sc qc sppsvc

    C:\Windows\system32> sc queryex sppsvc

    SERVICE_NAME: sppsvc
            TYPE               : 10  WIN32_OWN_PROCESS
            STATE              : 1  STOPPED
            WIN32_EXIT_CODE    : 2  (0x2)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0
            PID                : 0
            FLAGS              :

     

    Greetz Frodotia

    (confused me for a minute – I wasn’t expecting to see Dutch in a Command Prompt response!)
     
    That all looks normal apart from the highlighted error.
    There may be something in the registry that we’re not seeing in the output.
    please open an Elevated Command Prompt window, and issue the following commands...
     
    reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sppsvc
     
    reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sppsvc\Security
     
    (it may wrap – don’t worry)
    copy and paste the results to your reponse.

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Monday, November 14, 2011 10:24 AM
    Moderator
  • Noel, thanks for the quick responce

    here is the output

    Microsoft Windows [versie 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation. Alle rechten voorbehouden.

    C:\Windows\system32>reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic
    es\sppsvc

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sppsvc
        DisplayName    REG_SZ    @%SystemRoot%\system32\sppsvc.exe,-101
        ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\sppsvc.exe
        Description    REG_SZ    @%SystemRoot%\system32\sppsvc.exe,-100
        ObjectName    REG_SZ    NT AUTHORITY\NetworkService
        ErrorControl    REG_DWORD    0x1
        Start    REG_DWORD    0x2
        DelayedAutoStart    REG_DWORD    0x1
        Type    REG_DWORD    0x10
        DependOnService    REG_MULTI_SZ    RpcSs
        ServiceSidType    REG_DWORD    0x1
        RequiredPrivileges    REG_MULTI_SZ    SeAuditPrivilege\0SeChangeNotifyPrivil
    ege\0SeCreateGlobalPrivilege\0SeImpersonatePrivilege
        FailureActions    REG_BINARY    80510100000000000000000003000000140000000100
    0000C0D4010001000000E09304000000000000000000

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sppsvc\Security

    C:\Windows\system32>reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic
    es\sppsvc\Security

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sppsvc\Security
        Security    REG_BINARY    01001480A0000000AC000000140000003000000002001C0001
    00000002801400FF010F00010100000000000100000000020070000500000000001400FD01020001
    010000000000051200000000001800FF010F0001020000000000052000000020020000000014009D
    010200010100000000000504000000000014009D0102000101000000000005060000000000140014
    00000001010000000000050B000000010100000000000512000000010100000000000512000000


    C:\Windows\system32>

    Monday, November 14, 2011 11:52 AM
  • "Frodotia" wrote in message news:6bf72a80-ca5e-428e-9a8f-726c6cf2fd84...

    Noel, thanks for the quick responce

    here is the output

    Microsoft Windows [versie 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation. Alle rechten voorbehouden.

    <snipped>


    C:\Windows\system32>

    Everything there looks OK – now I’m really groping!
    The only thing I can think of is that some of the other references to the file in the registry are missing – there are a number.
    Ah – I wonder?

    please also run the following command at an Admin Command Prompt.

    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"

    copy and paste the results back (to copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.)
     
    I suspect that your registry cleaner has removed the reference to %windir% in the registry.
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Monday, November 14, 2011 12:22 PM
    Moderator
  • Noel,

    here the asked information


    C:\Windows\system32>reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contr
    ol\Session Manager\Environment"

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
        ComSpec    REG_EXPAND_SZ    %SystemRoot%\system32\cmd.exe
        FP_NO_HOST_CHECK    REG_SZ    NO
        OS    REG_SZ    Windows_NT
        Path    REG_EXPAND_SZ    C:\Program Files\Common Files\Microsoft Shared\Wind
    ows Live;C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;C:\Pr
    ogram Files (x86)\NVIDIA Corporation\PhysX\Common;%SystemRoot%\system32;%SystemR
    oot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:
    \Program Files (x86)\EgisTec\MyWinLocker 3\x86;C:\Program Files (x86)\EgisTec\My
    WinLocker 3\x64;C:\Program Files (x86)\Windows Live\Shared
        PATHEXT    REG_SZ    .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
        PROCESSOR_ARCHITECTURE    REG_SZ    AMD64
        TEMP    REG_EXPAND_SZ    %SystemRoot%\TEMP
        TMP    REG_EXPAND_SZ    %SystemRoot%\TEMP
        USERNAME    REG_SZ    SYSTEM
        windir    REG_EXPAND_SZ    %SystemRoot%
        PSModulePath    REG_EXPAND_SZ    %SystemRoot%\system32\WindowsPowerShell\v1.
    0\Modules\
        NUMBER_OF_PROCESSORS    REG_SZ    4
        PROCESSOR_LEVEL    REG_SZ    6
        PROCESSOR_IDENTIFIER    REG_SZ    Intel64 Family 6 Model 37 Stepping 2, Genu
    ineIntel
        PROCESSOR_REVISION    REG_SZ    2502


    C:\Windows\system32>

    greetz Frodotia

     

    Monday, November 14, 2011 12:34 PM
  • "Frodotia" wrote in message news:eb8fe5b7-1da2-4255-b340-893bdaea6b2b...

    Noel,

    here the asked information


    C:\Windows\system32>reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contr
    ol\Session Manager\Environment"

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

        windir    REG_EXPAND_SZ    %SystemRoot%


    C:\Windows\system32>

    greetz Frodotia

     

    Hmm – the line I thought would be missing, isn’t :)  - everything looks normal.
     
    I really have no idea where to go from here.   :(
    Unless Darin or one of the other guys has any better ideas, I think your best option is to go to MS WGA Support.
     
    WGA Support can be found here-

    North America: http://support.microsoft.com/contactus/cu_sc_genadv_master?ws=support&ws=support#tab4

    Outside North America:
    http://support.microsoft.com/contactus/?ws=support#tab0

    Please let us know if (and how) MS manage to repair the problem - it would be useful for future reference!


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Monday, November 14, 2011 1:00 PM
    Moderator
  • Noel,

     

    The links you provided are not working here

    Greetz Frodotia

    Monday, November 14, 2011 2:01 PM
  • "Frodotia" wrote in message news:02a2f1fd-71a8-478c-a4dc-9e98e2cf643c...

    Noel,

     

    The links you provided are not working here

    Greetz Frodotia

     
    Oh heck!
    they do work, if copied and pasted – looks like the NNTP interface is broke again!
     
    I’ll amend them to something that does work properly ASAP
    (interestingly - I discovered that the US link also works for the UK now!)

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Monday, November 14, 2011 2:17 PM
    Moderator
  • Just want to let you know

    After communication with end-user of this pc
    I have re-installed the Acer preload and now it is genuine again

    I hope that this problem does not comme back after installing a certain update
    Pc has to do proximatly 128 and then 98 updates again

     

    Thanx for all responses

     

    Greets Frodotia

    Monday, November 21, 2011 1:41 PM
  • I suggest strongly that once it is updated again that you make an image backup so that you don't have to reload the hard way again.  This is good practice on any computer.  It usually takes less than an hour to make the image and about the same to reload it.  There are a number of solutions for doing this. 
    Colin Barnhorst Windows 7 Ultimate x64 on DIY with 6GB ram.
    Monday, November 21, 2011 1:46 PM
    Answerer