locked
Windows 7 Suddenly saying it is not genuine RRS feed

  • Question

  • The computer was fine for two years and then about a month ago had to be reactivated.  Then today began saying it was not genuine again, but this time when you try reactivate it there is an error. 0x80070426.  Today Microsoft Office 2010 also says it can not verify the license and needs to be reinstalled. I tried recreating the license store but it did not work.
    Thursday, February 13, 2014 2:20 AM

Answers

  • Noel,

          I was finally able to find the computer was infected with Win64/Alureon.  I downloader windows defender offline and booted from a flash drive.  It was then able to remove the virus and the computer activate successfully.  Thank you for all your help.

    Thank you!

    • Marked as answer by silverfireiii Sunday, February 16, 2014 5:01 PM
    Sunday, February 16, 2014 5:01 PM

All replies

  • MGA Diagnostic Report is Required:

    To properly analyze and solve problems with Activation and Validation, we need to see a full copy of the diagnostic report produced by the MGADiag tool (download and save to desktop - http://go.microsoft.com/fwlink/?linkid=52012 )

    Once downloaded, run the tool.
    Click on the Continue button, after a short time, the Continue button will change to a Copy button.
    Click on the Copy button in the tool (ignore any error messages at this point), and then paste (using either r-click/Paste, or Ctrl+V ) into your post.

    Carey Frisch

    Thursday, February 13, 2014 3:45 AM
    Moderator
  • Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 50
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-K7W9M-FR9GJ-JDJ6T
    Windows Product Key Hash: NtCQ+YKc1/qZ3s3LkdJeemreWtY=
    Windows Product ID: 00371-OEM-9044963-04904
    Windows Product ID Type: 3
    Windows License Type: OEM System Builder
    Windows OS version: 6.1.7601.2.00010100.1.0.048
    ID: {43A0B115-CD18-4012-8A8F-21AF993E4FD2}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Professional
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.130828-1532
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{43A0B115-CD18-4012-8A8F-21AF993E4FD2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-JDJ6T</PKey><PID>00371-OEM-9044963-04904</PID><PIDType>3</PIDType><SID>S-1-5-21-864053033-2551422760-2520933293</SID><SYSTEM><Manufacturer>INTEL_</Manufacturer><Model>DH67CL__</Model></SYSTEM><BIOS><Manufacturer>Intel Corp.</Manufacturer><Version>BLH6710H.86A.0125.2011.0705.1517</Version><SMBIOSVersion major="2" minor="7"/><Date>20110705000000.000000+000</Date></BIOS><HWID>2E380200010000FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    C:\Windows\system32\slmgr.vbs(1333, 5) (null): The service has not been started.

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0xC004C533
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 2:12:2014 16:39
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:


    HWID Data-->
    N/A, hr = 0x8007000d

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes, but no SLIC table
    Windows marker version: N/A
    OEMID and OEMTableID Consistent: N/A
    BIOS Information:
      ACPI Table Name OEMID Value OEMTableID Value
      APIC   INTEL   DH67CL 
      FACP   INTEL   DH67CL 
      HPET   INTEL   DH67CL 
      MCFG   INTEL   DH67CL 
      SSDT   INTEL   DH67CL 

    Thursday, February 13, 2014 2:12 PM
  • Licensing Data-->
    C:\Windows\system32\slmgr.vbs(1333, 5) (null): The service has not been started.

    The error could relate to a number of services, so we need to find out which service isn't starting properly.Please open an Elevated CommandPrompt, and run the following commands.

    NET START TrustedInstaller
    NET START SPPUINOTIFY
    NET START WINMGMT
    
    .

    post the results.

      Here are some instructions to make life easier :)

    1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt. 

    2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once. 

    3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.     


    Noel Paton | Nil Carborundum Illegitemi
    CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Thursday, February 13, 2014 11:18 PM
    Moderator


  • Friday, February 14, 2014 12:01 AM
  • Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

    C:\Windows\system32>net start trustedInstaller
    The Windows Modules Installer service is starting.
    The Windows Modules Installer service was started successfully.


    C:\Windows\system32>net start sppuinotify
    The requested service has already been started.

    More help is available by typing NET HELPMSG 2182.


    C:\Windows\system32>net start winmgmt
    The requested service has already been started.

    More help is available by typing NET HELPMSG 2182.


    C:\Windows\system32>

    Friday, February 14, 2014 12:17 AM
  • Those were the most likely suspects - I'll have to trawl through my notes and find the others.

    back later.


    Noel Paton | Nil Carborundum Illegitemi
    CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Friday, February 14, 2014 8:09 AM
    Moderator
  • Duh!

    It may well be the uPnP service...

    See if this helps
    http://support.microsoft.com/kb/2230957 (Fixit50485)

     also

    http://blogs.technet.com/b/fixit4me/archive/2009/03/31/error-code-2738-when-running-a-microsoft-fix-it-solution.aspx (Fixit 50181)


    Noel Paton | Nil Carborundum Illegitemi
    CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Saturday, February 15, 2014 11:51 PM
    Moderator
  • Noel,

    I tried both of your suggestions and I still get the same error that the service has not been started.

    Sunday, February 16, 2014 1:19 AM
  • Please run the following commands in an Elevated Command Prompt and post the results.

    NET START PlugPlay

    SC QUERYEX PlugPlay

    SC SDSHOW PlugPlay

    Also please post a new MGADiag report - then

    Please run a full CHKDSK and SFC scan....

    Click on Start > All Programs > Accessories

    Right-click on the Command Prompt entry

    Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

    At the Command prompt, type

    CHKDSK C: /R

    and hit the Enter key.

    You will be told that the drive is locked,

    and the CHKDSK will run at he next boot - hit the Y key, press Enter, and then reboot.

    The CHKDSK will take a few hours depending on the size of the drive, so be patient!

    After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -

    then run the SFC.

    SFC -System File Checker - Instructions

    Click on Start > All Programs > Accessories

    Right-click on the Command Prompt entry

    Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

    At the Command prompt, type

    SFC /SCANNOW

    and hit the Enter key

    Wait for the scan to finish - make a note of any error messages - and then reboot.

    Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your SkyDrive Public folder (http://skydrive.live.com ) and post a link to it so that I can take a look.

    Post a new MGADiag report with details of any error messages encountered.


    Noel Paton | Nil Carborundum Illegitemi
    CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Sunday, February 16, 2014 7:56 AM
    Moderator
  • Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

    C:\Windows\system32>net start plugplay
    The Plug and Play service is starting.
    The Plug and Play service was started successfully.


    C:\Windows\system32>sc queryex plugplay

    SERVICE_NAME: plugplay
            TYPE               : 20  WIN32_SHARE_PROCESS
            STATE              : 4  RUNNING
                                    (NOT_STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
            WIN32_EXIT_CODE    : 0  (0x0)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0
            PID                : 752
            FLAGS              :

    C:\Windows\system32>sc sdshow plugplay

    D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
    RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

    C:\Windows\system32>

    Sunday, February 16, 2014 3:16 PM
  • I am running the chkdsk and system file checker now.  I will let you know the results.
    Sunday, February 16, 2014 3:17 PM
  • Noel,

          I was finally able to find the computer was infected with Win64/Alureon.  I downloader windows defender offline and booted from a flash drive.  It was then able to remove the virus and the computer activate successfully.  Thank you for all your help.

    Thank you!

    • Marked as answer by silverfireiii Sunday, February 16, 2014 5:01 PM
    Sunday, February 16, 2014 5:01 PM
  • Well done!

    Good luck.


    Noel Paton | Nil Carborundum Illegitemi
    CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Sunday, February 16, 2014 5:07 PM
    Moderator
  • Hi

    If you are sure, it was virus and you have removd it using the tool. Now dont forget to resotre the last good known configuration of this computer, so that impacted perrished files will be recovered and you will get healthy system.

    Kindly mark this as answere if you find this usefull.


    Regards Sushain KApoor

    Sunday, February 16, 2014 5:13 PM
  • System Restore should be AVOIDED in cases of malware/virus - it may restore the malware as well.


    Noel Paton | Nil Carborundum Illegitemi
    CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Sunday, February 16, 2014 5:27 PM
    Moderator