locked
My Windows 7 recently became non genuine RRS feed

  • Question

  • Hello, please help me identify what happens.

    More than a year ago I purchased new PC with Vista Home Premium pre-installed from CyberPower. I upgraded it to Windows 7 Home Premium( got software from Newegg) in June and everything activated and worked well.

    Couple days back it yelled at me that my windows is non genuine.

    However, it still allows me to download updates, just fails to install them.

    Here is report I just run :

    Diagnostic Report (1.9.0027.0):

    -----------------------------------------

    Windows Validation Data-->

     

    Validation Code: 0x8004FE22

    Cached Online Validation Code: 0x0

    Windows Product Key: *****-*****-G2JRY-HVPTV-7BXW4

    Windows Product Key Hash: 3/v7bJSOIOU4Eve6Cua7hcxXPdU=

    Windows Product ID: 00359-033-7691264-85373

    Windows Product ID Type: 5

    Windows License Type: Retail

    Windows OS version: 6.1.7600.2.00010300.0.0.003

    ID: {4517E282-2EBD-4D99-9A72-37236077C083}(1)

    Is Admin: Yes

    TestCab: 0x0

    LegitcheckControl ActiveX: N/A, hr = 0x80070002

    Signed By: N/A, hr = 0x80070002

    Product Name: Windows 7 Home Premium

    Architecture: 0x00000009

    Build lab: 7600.win7_gdr.100618-1621

    TTS Error: 

    Validation Diagnostic: 

    Resolution Status: N/A

     

    Vista WgaER Data-->

    ThreatID(s): N/A, hr = 0x80070002

    Version: N/A, hr = 0x80070002

     

    Windows XP Notifications Data-->

    Cached Result: N/A, hr = 0x80070002

    File Exists: No

    Version: N/A, hr = 0x80070002

    WgaTray.exe Signed By: N/A, hr = 0x80070002

    WgaLogon.dll Signed By: N/A, hr = 0x80070002

     

    OGA Notifications Data-->

    Cached Result: N/A, hr = 0x80070002

    Version: N/A, hr = 0x80070002

    OGAExec.exe Signed By: N/A, hr = 0x80070002

    OGAAddin.dll Signed By: N/A, hr = 0x80070002

     

    OGA Data-->

    Office Status: 100 Genuine

    Microsoft Office Professional Plus 2007 - 100 Genuine

    OGA Version: N/A, 0x80070002

    Signed By: N/A, hr = 0x80070002

    Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005

     

    Browser Data-->

    Proxy settings: N/A

    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)

    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

    Download signed ActiveX controls: Prompt

    Download unsigned ActiveX controls: Disabled

    Run ActiveX controls and plug-ins: Allowed

    Initialize and script ActiveX controls not marked as safe: Disabled

    Allow scripting of Internet Explorer Webbrowser control: Disabled

    Active scripting: Allowed

    Script ActiveX controls marked as safe for scripting: Allowed

     

    File Scan Data-->

    File Mismatch: C:\Windows\system32\sppcomapi.dll[Hr = 0x80070002]

    File Mismatch: C:\Windows\system32\sppcommdlg.dll[Hr = 0x80070002]

     

    Other data-->

    Office Details: <GenuineResults><MachineData><UGUID>{4517E282-2EBD-4D99-9A72-37236077C083}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7600.2.00010300.0.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7BXW4</PKey><PID>00359-033-7691264-85373</PID><PIDType>5</PIDType><SID>S-1-5-21-2630371562-1275485627-1901963801</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>0202   </Version><SMBIOSVersion major="2" minor="5"/><Date>20081204000000.000000+000</Date></BIOS><HWID>23AA3107018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90120000-0011-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Professional Plus 2007</Name><Ver>12</Ver><Val>1CE57F4C85D1D86</Val><Hash>BP3gIbOqKtIQfVQ5mvHYgnZKUnk=</Hash><Pid>89409-707-0722361-65825</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  

     

    Spsys.log Content: 0x80070002

     

    Licensing Data-->

    Software licensing service version: 6.1.7600.16385

     

    Name: Windows(R) 7, HomePremium edition

    Description: Windows Operating System - Windows(R) 7, RETAIL channel

    Activation ID: 2e7d060d-4714-40f2-9896-1e4f15b612ad

    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f

    Extended PID: 00359-00170-033-769126-01-1049-7600.0000-1752010

    Installation ID: 013946768706142960414623786596024392555845007766190304

    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338

    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339

    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341

    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340

    Partial Product Key: 7BXW4

    License Status: Licensed

    Remaining Windows rearm count: 4

    Trusted time: 10/12/2010 7:00:32 PM

     

    Windows Activation Technologies-->

    HrOffline: 0x8004FE22

    HrOnline: N/A

    HealthStatus: 0x0000000000006000

    Event Time Stamp: 10:12:2010 18:54

    ActiveX: Registered, Version: 7.1.7600.16395

    Admin Service: Registered, Version: 7.1.7600.16395

    HealthStatus Bitmask Output:

    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui

    Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui

     

     

    HWID Data-->

    HWID Hash Current: NAAAAAEABAABAAEAAAACAAAAAgABAAEAonbkNFLMRryENIwmaGWk0S5wmogaza4P4kfqgg==

     

    OEM Activation 1.0 Data-->

    N/A

     

    OEM Activation 2.0 Data-->

    BIOS valid for OA 2.0: yes, but no SLIC table

    Windows marker version: N/A

    OEMID and OEMTableID Consistent: N/A

    BIOS Information: 

      ACPI Table Name OEMID Value OEMTableID Value

      APIC 120408 APIC1626

      FACP 120408 FACP1626

      HPET 120408 OEMHPET 

      MCFG 120408 OEMMCFG 

      OEMB 120408 OEMB1626

      OSFR 120408 OEMOSFR 

      SSDT DpgPmm CpuPm

     

    Could someone please tell me what happened here ?

    Both companies are legit and I haven't heard any complains about them and piracy..

    Thank you.

    Tuesday, October 12, 2010 11:27 PM

Answers

  • The following files have been tampered with.

    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui

    Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui

    Try the following steps to repair the problem.

    SFC/system restore

    type cmd in the search box of the start menu, right click on the icon that appears and type sfc /scannow without the qoutes and press enter, allow SFC to run, reboot when directed. If you get any error messages write them down exactly as they appear. After rebooting go to www.microsoft.com/genuine and attempt to validate.

     

    If that does not work then type system restore in the search box, click on the resulting program and follow the wizards prompts to restore to a previous point prior to the non-genuine status.

     

    If that does not work then start a no cost wga tech support incident at the following link http://support.microsoft.com/gp/contactwga

     

    • Marked as answer by realKGBMan Wednesday, October 13, 2010 12:57 AM
    Tuesday, October 12, 2010 11:58 PM
  • Thank you Carl !!

    what could have tampered with those files ?

    I'm fairly certain that I'm virus free, as 3 diff virus scanners didn't found anything and the only thing installed prior to this issue was a free pdf printer driver...

    • Marked as answer by realKGBMan Wednesday, October 13, 2010 12:57 AM
    Wednesday, October 13, 2010 12:36 AM

All replies

  • The following files have been tampered with.

    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui

    Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui

    Try the following steps to repair the problem.

    SFC/system restore

    type cmd in the search box of the start menu, right click on the icon that appears and type sfc /scannow without the qoutes and press enter, allow SFC to run, reboot when directed. If you get any error messages write them down exactly as they appear. After rebooting go to www.microsoft.com/genuine and attempt to validate.

     

    If that does not work then type system restore in the search box, click on the resulting program and follow the wizards prompts to restore to a previous point prior to the non-genuine status.

     

    If that does not work then start a no cost wga tech support incident at the following link http://support.microsoft.com/gp/contactwga

     

    • Marked as answer by realKGBMan Wednesday, October 13, 2010 12:57 AM
    Tuesday, October 12, 2010 11:58 PM
  • Thank you Carl !!

    what could have tampered with those files ?

    I'm fairly certain that I'm virus free, as 3 diff virus scanners didn't found anything and the only thing installed prior to this issue was a free pdf printer driver...

    • Marked as answer by realKGBMan Wednesday, October 13, 2010 12:57 AM
    Wednesday, October 13, 2010 12:36 AM
  • sfc /scannow found bunch of files not repairable, system restore can't run as srcore.dll is missing....

    openning support incident.

     

    thank you

    Wednesday, October 13, 2010 12:57 AM