locked
Windows Update Failure, now WGA showing Validation Status = Invalid RRS feed

  • Question

  • I recently noticed that my Windows Update had failed and I haven't been able to figure out what the issue is.  The error code displayed for the failure is 80070426.

    After researching a fix for this, one of the recomendations was to run the WGA Diagnostic tool.  I ran it a few days ago and it showed Validation Status = Genuine.

    I ran it again just a few minutes ago and an getting the Validation Status = Invalid.

    I'm running an HP laptop from 2007.

     

    Diagnostic Report (1.9.0027.0):

    -----------------------------------------

    Windows Validation Data-->

    Validation Status: Invalid License

    Validation Code: 50

    Cached Online Validation Code: N/A, hr = 0x80070426

    Windows Product Key: *****-*****-27HYQ-XTKW2-WQD8Q

    Windows Product Key Hash: U8YEZzymoD4DMyaMb32rPrNIS90=

    Windows Product ID: 89578-OEM-7332157-00061

    Windows Product ID Type: 2

    Windows License Type: OEM SLP

    Windows OS version: 6.0.6002.2.00010300.2.0.003

    ID: {DBE65125-92C3-4379-A288-F4931D2D2D19}(3)

    Is Admin: Yes

    TestCab: 0x0

    LegitcheckControl ActiveX: Registered, 1.9.42.0

    Signed By: Microsoft

    Product Name: Windows Vista (TM) Home Premium

    Architecture: 0x00000000

    Build lab: 6002.vistasp2_gdr.100218-0019

    TTS Error:

    Validation Diagnostic:

    Resolution Status: N/A

     

    Vista WgaER Data-->

    ThreatID(s): N/A, hr = 0x80070002

    Version: 6.0.6002.16398

     

    Windows XP Notifications Data-->

    Cached Result: N/A, hr = 0x80070002

    File Exists: No

    Version: N/A, hr = 0x80070002

    WgaTray.exe Signed By: N/A, hr = 0x80070002

    WgaLogon.dll Signed By: N/A, hr = 0x80070002

     

    OGA Notifications Data-->

    Cached Result: N/A, hr = 0x80070002

    Version: N/A, hr = 0x80070002

    OGAExec.exe Signed By: N/A, hr = 0x80070002

    OGAAddin.dll Signed By: N/A, hr = 0x80070002

     

    OGA Data-->

    Office Status: 109 N/A

    OGA Version: N/A, 0x80070002

    Signed By: N/A, hr = 0x80070002

    Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

     

    Browser Data-->

    Proxy settings: N/A

    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)

    Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe

    Download signed ActiveX controls: Prompt

    Download unsigned ActiveX controls: Disabled

    Run ActiveX controls and plug-ins: Allowed

    Initialize and script ActiveX controls not marked as safe: Disabled

    Allow scripting of Internet Explorer Webbrowser control: Disabled

    Active scripting: Allowed

    Script ActiveX controls marked as safe for scripting: Allowed

     

    File Scan Data-->

     

    Other data-->

    Office Details: <GenuineResults><MachineData><UGUID>{DBE65125-92C3-4379-A288-F4931D2D2D19}</UGUID><Version>1.9.0027.0</Version><OS>6.0.6002.2.00010300.2.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-WQD8Q</PKey><PID>89578-OEM-7332157-00061</PID><PIDType>2</PIDType><SID>S-1-5-21-1478758289-3575239578-2302973165</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>HP Pavilion dv9000 (GL889UA#ABL) </Model></SYSTEM><BIOS><Manufacturer>Hewlett-Packard</Manufacturer><Version>F.42 </Version><SMBIOSVersion major="2" minor="4"/><Date>20090309000000.000000+000</Date></BIOS><HWID>78323507018400FE</HWID><UserLCID>1009</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-MPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

     

    Spsys.log Content: 0x80070002

     

    Licensing Data-->

    Software Licensing service is not running.

     

    Windows Activation Technologies-->

    N/A

     

    HWID Data-->

    HWID Hash Current: OgAAAAEABgABAAEAAQABAAAAAwABAAEAJJT05hTBWtlqWWIeCuXUVEgkmMm83/L04gz0QvBwrFZ4qg==

     

    OEM Activation 1.0 Data-->

    N/A

     

    OEM Activation 2.0 Data-->

    BIOS valid for OA 2.0: yes

    Windows marker version: 0x20000

    OEMID and OEMTableID Consistent: yes

    BIOS Information:

    ACPI Table Name OEMID Value OEMTableID Value

    APIC HP APIC

    FACP HP MCP51M

    HPET PTLTD HPETTBL

    BOOT HP $SBFTBL$

    MCFG HP MCFG

    SSDT PTLTD POWERNOW

    SLIC HPQOEM SLIC-MPC

     

     

     

     

    Saturday, September 11, 2010 5:37 AM

Answers

  • "RDPW32" wrote in message news:3fc273fd-db53-4996-a711-29ed2eefaa1f...

    I heard back from malwarebytes, their response was:

    Please switch to the default 'Quick' scan option.

    Malwarebytes does not recommend full scans to search for malware. Our quick scan is designed to find all the places malware loads in memory and hides from conventional scanners.

    There are any number of reasons a scan will hang, freeze, appear to stop or take different lengths of time to complete, including file\folder content, other security software quarantine files, amount of user accounts and more.


    I have to admit disappointment with that response - I considered MBAM better than that.
     
    My suggestion would be to run the scan while in Safe Mode - I've NEVER had such problems as you describe, even with multiple user accounts.
     
    Yes, the Quick scan works - but when the system has already had fairly extensive scanning by conventional AV's, it should not barf at the idea of a full scan by MBAM, unless it is infested.
     
     I would recommend a visit to a specialist anti=malware forum - such as those at www.bleepingcomputer.com or www.aumha.net - they will be able to give you more assistance than we either can, or are allowed to, here.
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    • Marked as answer by Darin Smith MS Tuesday, September 14, 2010 6:50 PM
    Sunday, September 12, 2010 7:47 PM
    Moderator

All replies

  • "RDPW32" wrote in message news:4bf7f131-49aa-4a61-9d7f-fad6ae165a57...

    I recently noticed that my Windows Update had failed and I haven't been able to figure out what the issue is.  The error code displayed for the failure is 80070426.

    After researching a fix for this, one of the recomendations was to run the WGA Diagnostic tool.  I ran it a few days ago and it showed Validation Status = Genuine.

    I ran it again just a few minutes ago and an getting the Validation Status = Invalid.

    I'm running an HP laptop from 2007.

     

    Diagnostic Report (1.9.0027.0):

    -----------------------------------------

    Windows Validation Data-->

    Validation Status: Invalid License

    Validation Code: 50

    Cached Online Validation Code: N/A, hr = 0x80070426

    Windows Product Key: *****-*****-27HYQ-XTKW2-WQD8Q

    Windows Product Key Hash: U8YEZzymoD4DMyaMb32rPrNIS90=

    Windows Product ID: 89578-OEM-7332157-00061

    Windows Product ID Type: 2

    Windows License Type: OEM SLP

    Windows OS version: 6.0.6002.2.00010300.2.0.003

    ID: {DBE65125-92C3-4379-A288-F4931D2D2D19}(3)

    Is Admin: Yes

    TestCab: 0x0

    LegitcheckControl ActiveX: Registered, 1.9.42.0

    Signed By: Microsoft

    Product Name: Windows Vista (TM) Home Premium

    Architecture: 0x00000000

    Build lab: 6002.vistasp2_gdr.100218-0019

    TTS Error:

    Validation Diagnostic:

    Resolution Status: N/A

     

    Vista WgaER Data-->

    ThreatID(s): N/A, hr = 0x80070002

    Version: 6.0.6002.16398

     

    Windows XP Notifications Data-->

    Cached Result: N/A, hr = 0x80070002

    File Exists: No

    Version: N/A, hr = 0x80070002

    WgaTray.exe Signed By: N/A, hr = 0x80070002

    WgaLogon.dll Signed By: N/A, hr = 0x80070002

     

    OGA Notifications Data-->

    Cached Result: N/A, hr = 0x80070002

    Version: N/A, hr = 0x80070002

    OGAExec.exe Signed By: N/A, hr = 0x80070002

    OGAAddin.dll Signed By: N/A, hr = 0x80070002

     

    OGA Data-->

    Office Status: 109 N/A

    OGA Version: N/A, 0x80070002

    Signed By: N/A, hr = 0x80070002

    Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

     

    Browser Data-->

    Proxy settings: N/A

    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)

    Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe

    Download signed ActiveX controls: Prompt

    Download unsigned ActiveX controls: Disabled

    Run ActiveX controls and plug-ins: Allowed

    Initialize and script ActiveX controls not marked as safe: Disabled

    Allow scripting of Internet Explorer Webbrowser control: Disabled

    Active scripting: Allowed

    Script ActiveX controls marked as safe for scripting: Allowed

     

    File Scan Data-->

     

    Other data-->

    Office Details: <GenuineResults><MachineData><UGUID>{DBE65125-92C3-4379-A288-F4931D2D2D19}</UGUID><Version>1.9.0027.0</Version><OS>6.0.6002.2.00010300.2.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-WQD8Q</PKey><PID>89578-OEM-7332157-00061</PID><PIDType>2</PIDType><SID>S-1-5-21-1478758289-3575239578-2302973165</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>HP Pavilion dv9000 (GL889UA#ABL) </Model></SYSTEM><BIOS><Manufacturer>Hewlett-Packard</Manufacturer><Version>F.42 </Version><SMBIOSVersion major="2" minor="4"/><Date>20090309000000.000000+000</Date></BIOS><HWID>78323507018400FE</HWID><UserLCID>1009</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-MPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

     

    Spsys.log Content: 0x80070002

     

    Licensing Data-->

    Software Licensing service is not running.

     

    Windows Activation Technologies-->

    N/A

     

    HWID Data-->

    HWID Hash Current: OgAAAAEABgABAAEAAQABAAAAAwABAAEAJJT05hTBWtlqWWIeCuXUVEgkmMm83/L04gz0QvBwrFZ4qg==

     

    OEM Activation 1.0 Data-->

    N/A

     

    OEM Activation 2.0 Data-->

    BIOS valid for OA 2.0: yes

    Windows marker version: 0x20000

    OEMID and OEMTableID Consistent: yes

    BIOS Information:

    ACPI Table Name OEMID Value OEMTableID Value

    APIC HP APIC

    FACP HP MCP51M

    HPET PTLTD HPETTBL

    BOOT HP $SBFTBL$

    MCFG HP MCFG

    SSDT PTLTD POWERNOW

    SLIC HPQOEM SLIC-MPC

     

     

     

     


    The only problem I can see is that the Software Licensing Service is not running - you need to check and make sure that it is:-
    This can happen either because you intentionally switched it off for some reason, or because some malware did so (or for other unknown reasons).
    First try switching it back on manually.....
    click on the Start  button
    In the Search box, type
    services.msc
    hit the Enter key, and accept the UAC prompt
    look for the Software Licensing Service in the list that appears - right-click on it, and select Properties from the drop-down.
    Ensure that the Startup type is set to Automatic, and attempt to start the service.
    If it starts but immediately stops, then the chances are that you have malware on your system.
    If it refuses to start, what EXACT error message do you get?
     
    Reboot
    Run MGADiag again, and post the result in your reply
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, September 11, 2010 6:49 AM
    Moderator
  • Thanks for the reply.

    I've tried this a quite a few times in the past few days, the service starts fine.  When I check again a few minutes later it's stopped again.

    I run AVG 9 Free and it hasn't found any malware.  I've also run the Trend micro free scan and the Windows malicious software removal tool and nothing found.

    Any other ideas?

     

     

    Saturday, September 11, 2010 4:17 PM
  • Sorry, I forgot I ran as an administrator in the command prompt and it stopped after a few minutes.  When I run as you described I get the following error:  0x80070005 Access is denied
    Saturday, September 11, 2010 4:41 PM
  • "RDPW32" wrote in message news:e14b089a-56f8-480d-84f4-6cbcc4954e3d...
    Sorry, I forgot I ran as an administrator in the command prompt and it stopped after a few minutes.  When I run as you described I get the following error:  0x80070005 Access is denied

    Interesting.
    All the tools you've so far used on the system would seem to be conventional anti-viruses (albeit with knobs on <g>).
    I suggest using Malwarebytes Anti-Malware (www.malwarebytes.org) and running a full system scan after install and update.
    See what it finds - I can pretty much guarantee it will find something, and it would be instructive to see what.
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, September 11, 2010 5:17 PM
    Moderator
  • Will do.  I'll reply with the results.  thanks.
    Saturday, September 11, 2010 5:42 PM
  • I ran a full scan first and it failed with the following:

     An error has occurred. Please report this error code to our support team

     

    MBAM_ERROR_FILE_SCAN (0,28)

    I clicked okay, then the scan continued for a minute until a windows message appeared stating that the program needed to close.

    I restarted the computer and tried again with the same results (scanning c:boot directory ~360000 files scanned with no infections).  I then ran a quick scan and nothing was found.

    Here's the log:

    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 4595

    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.18928

    11/09/2010 8:25:39 PM
    mbam-log-2010-09-11 (20-25-39).txt

    Scan type: Quick scan
    Objects scanned: 146016
    Time elapsed: 8 minute(s), 22 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)

    I'm going to try running the scan in safe mode and will report back.

     

    Sunday, September 12, 2010 2:34 AM
  • forgot to mention I reported the issue to the malwarebytes support team, but haven't heard back.
    Sunday, September 12, 2010 2:35 AM
  • I ran a full scan in safe mode and it found a trojan in a download file.  I removed it and restarted, but am still receiving the same errors.  Any other ideas?
    Sunday, September 12, 2010 4:59 AM
  • I heard back from malwarebytes, their response was:

    Please switch to the default 'Quick' scan option.

    Malwarebytes does not recommend full scans to search for malware. Our quick scan is designed to find all the places malware loads in memory and hides from conventional scanners.

    There are any number of reasons a scan will hang, freeze, appear to stop or take different lengths of time to complete, including file\folder content, other security software quarantine files, amount of user accounts and more.

    Sunday, September 12, 2010 3:52 PM
  • "RDPW32" wrote in message news:3fc273fd-db53-4996-a711-29ed2eefaa1f...

    I heard back from malwarebytes, their response was:

    Please switch to the default 'Quick' scan option.

    Malwarebytes does not recommend full scans to search for malware. Our quick scan is designed to find all the places malware loads in memory and hides from conventional scanners.

    There are any number of reasons a scan will hang, freeze, appear to stop or take different lengths of time to complete, including file\folder content, other security software quarantine files, amount of user accounts and more.


    I have to admit disappointment with that response - I considered MBAM better than that.
     
    My suggestion would be to run the scan while in Safe Mode - I've NEVER had such problems as you describe, even with multiple user accounts.
     
    Yes, the Quick scan works - but when the system has already had fairly extensive scanning by conventional AV's, it should not barf at the idea of a full scan by MBAM, unless it is infested.
     
     I would recommend a visit to a specialist anti=malware forum - such as those at www.bleepingcomputer.com or www.aumha.net - they will be able to give you more assistance than we either can, or are allowed to, here.
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    • Marked as answer by Darin Smith MS Tuesday, September 14, 2010 6:50 PM
    Sunday, September 12, 2010 7:47 PM
    Moderator
  • Will do, thanks for all your help!
    Monday, September 13, 2010 2:52 AM