Windows 7 not genuine? :/

All replies

• 

  

  0

  Sign in to vote

  What I got out of the report after reading through it, is some of my files have been tampered with.

  Monday, January 17, 2011 1:48 AM
• 

  

  0

  Sign in to vote

  "WillRaley94" wrote in message news:856ece7e-d7f4-4d77-ba46-c2e72f0dc4b1...

  What I got out of the report after reading through it, is some of my files have been tampered with.

  
  

  'Some' is rather an understatement!  :)

   

  File Scan Data-->
  File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[7.1.7600.16395], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\wat\watux.exe[7.1.7600.16395], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\sppobjs.dll[6.1.7600.16385], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\sppc.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7600.16385], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\slc.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\slcext.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppuinotify.dll[6.1.7600.16385], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\slui.exe[6.1.7600.16385], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\sppcomapi.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppcommdlg.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7600.16385], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\drivers\spsys.sys[6.1.7127.0], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\drivers\spldr.sys[6.1.7127.0], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\user32.dll[6.1.7600.16385], Hr = 0x800b0100
  

  There's also an intriguing  error:_

  Software licensing service version: 6.1.7600.16385
  Error: product key not found

  I rather think we may have a chicken-and-egg situation here - so we'll try for that error fix first

  What may have happened is that the Licensing Store has become corrupted - and is looking for the wrong files.
  I would try rebuilding the Licensing Store first, -
   
  Recreate the Licensing Store
  1) Click Start button.
  2) Type: CMD.exe into the 'Search programs and files' field
  3) Right-Click on CMD.exe and select Run as Administrator
  4) Type: net stop sppsvc   (It may ask you if you are sure, select yes)
  Note: the Software Protection service may not be running, this is ok.
  5) Type: cd %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform
  6) Type: rename tokens.dat tokens.bar
  7) Type: cd %windir%\system32
  8) Type: net start sppsvc
  9) Type: slui.exe
  10) After a couple of seconds Windows Activation dialog will appear. You may be asked to re-activate and/or re-enter your product key or Activation may occur automatically.
   
  Run MGADiag again, and post the report
  
  --
  
  

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  Monday, January 17, 2011 2:05 AM

  Moderator
• 

  

  0

  Sign in to vote

  I don't know where the key would be. What is the MGADiag? I did all these steps.

  Monday, January 17, 2011 4:34 AM
• 

  

  0

  Sign in to vote

  "WillRaley94" wrote in message news:3371d394-d51c-4851-b764-67bcb5dc825e...

  I don't know where the key would be. What is the MGADiag? I did all these steps.

  
  

  The Key is on your COA sticker on the case.

  The MGADiag report is what you posted earlier -

  <canned>

  To properly analyse and solve problems with Activation and Validation, we need to see a full copy of the report produced by the MGADiag tool (download and save to desktop - http://go.microsoft.com/fwlink/?linkid=52012 )
  Once saved, run the tool.
  Click on the Continue button, which will produce the report.
  To copy the report to your response, click on the Copy button in the tool (ignore any error messages at this point), and then paste (using either r-click/Paste, or Ctrl+V ) into your response.
  </canned>

  
  --
  
  

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  Monday, January 17, 2011 5:26 AM

  Moderator
• 

  

  0

  Sign in to vote

  Diagnostic Report (1.9.0027.0):
  -----------------------------------------
  Windows Validation Data-->
  
  Validation Code: 0x8004FE21
  Cached Online Validation Code: N/A, hr = 0xc004f012
  Windows Product Key: *****-*****-73CQT-WMF7J-3Q6C9
  Windows Product Key Hash: KaFG+RmurcM3ZxzWyfEP9WtPUJw=
  Windows Product ID: 00359-OEM-8992687-00010
  Windows Product ID Type: 2
  Windows License Type: OEM SLP
  Windows OS version: 6.1.7600.2.00010300.0.0.003
  ID: {8A7B18EB-E656-4D23-8DB6-1CD0059F3A63}(3)
  Is Admin: Yes
  TestCab: 0x0
  LegitcheckControl ActiveX: N/A, hr = 0x80070002
  Signed By: N/A, hr = 0x80070002
  Product Name: Windows 7 Home Premium
  Architecture: 0x00000009
  Build lab: 7600.win7_gdr.100618-1621
  TTS Error: T:20190114075908207-
  Validation Diagnostic:
  Resolution Status: N/A
  
  Vista WgaER Data-->
  ThreatID(s): N/A, hr = 0x80070002
  Version: N/A, hr = 0x80070002
  
  Windows XP Notifications Data-->
  Cached Result: N/A, hr = 0x80070002
  File Exists: No
  Version: N/A, hr = 0x80070002
  WgaTray.exe Signed By: N/A, hr = 0x80070002
  WgaLogon.dll Signed By: N/A, hr = 0x80070002
  
  OGA Notifications Data-->
  Cached Result: N/A, hr = 0x80070002
  Version: N/A, hr = 0x80070002
  OGAExec.exe Signed By: N/A, hr = 0x80070002
  OGAAddin.dll Signed By: N/A, hr = 0x80070002
  
  OGA Data-->
  Office Status: 109 N/A
  OGA Version: N/A, 0x80070002
  Signed By: N/A, hr = 0x80070002
  Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
  
  Browser Data-->
  Proxy settings: N/A
  User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
  Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  Download signed ActiveX controls: Prompt
  Download unsigned ActiveX controls: Disabled
  Run ActiveX controls and plug-ins: Allowed
  Initialize and script ActiveX controls not marked as safe: Disabled
  Allow scripting of Internet Explorer Webbrowser control: Disabled
  Active scripting: Allowed
  Script ActiveX controls marked as safe for scripting: Allowed
  
  File Scan Data-->
  File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[7.1.7600.16395], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\wat\watux.exe[7.1.7600.16395], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\sppobjs.dll[6.1.7600.16385], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\sppc.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7600.16385], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\slc.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\slcext.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppuinotify.dll[6.1.7600.16385], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\slui.exe[6.1.7600.16385], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\sppcomapi.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppcommdlg.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7600.16385], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\drivers\spsys.sys[6.1.7127.0], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\drivers\spldr.sys[6.1.7127.0], Hr = 0x80092003
  File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7600.16385], Hr = 0x800b0100
  File Mismatch: C:\Windows\system32\user32.dll[6.1.7600.16385], Hr = 0x800b0100
  
  Other data-->
  Office Details: <GenuineResults><MachineData><UGUID>{8A7B18EB-E656-4D23-8DB6-1CD0059F3A63}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7600.2.00010300.0.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-3Q6C9</PKey><PID>00359-OEM-8992687-00010</PID><PIDType>2</PIDType><SID>S-1-5-21-910774618-1332237686-4179185709</SID><SYSTEM><Manufacturer>HP-Pavilion</Manufacturer><Model>AY627AA-ABA a4313w</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version> 5.55</Version><SMBIOSVersion major="2" minor="5"/><Date>20091208000000.000000+000</Date></BIOS><HWID>B7BB3607018400F6</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 
  
  Spsys.log Content: U1BMRwEAAAAAAQAACAAAANkkAAAAAAAAYWECAAAAAADAu3tREazUAWbXGpOihAOpMHzDmWxsjuqGjBal7sUn5OOFnStLEfY2cjDiUEKNT85XeFZKi5LfPDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAx4dZsxs/sxaQSZh6DCEuBHsSRXkIT3dAGfPLiOmU2J/AtpvV3ySWbAtOTkDT3FB7QzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM
  
  Licensing Data-->
  Software licensing service version: 6.1.7600.16385
  
  Name: Windows(R) 7, HomePremium edition
  Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
  Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
  Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
  Extended PID: 00359-00178-926-800010-02-1033-7600.0000-0472011
  Installation ID: 015503481135234913124013917063244380708001815530523866
  Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
  Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
  Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
  Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
  Partial Product Key: 3Q6C9
  License Status: Licensed
  Remaining Windows rearm count: 4
  Trusted time: 2/17/2011 1:15:18 AM
  
  Windows Activation Technologies-->
  HrOffline: 0x8004FE21
  HrOnline: N/A
  HealthStatus: 0x000000000001EFF0
  Event Time Stamp: 2:16:2011 22:36
  ActiveX: Registered, Version: 7.1.7600.16395
  Admin Service: Registered, Version: 7.1.7600.16395
  HealthStatus Bitmask Output:
  Tampered File: %systemroot%\system32\sppobjs.dll
  Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
  Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
  Tampered File: %systemroot%\system32\sppwinob.dll
  Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
  Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
  Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
  Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
  Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
  Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
  Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
  Tampered File: %systemroot%\system32\drivers\spsys.sys
  
  
  HWID Data-->
  HWID Hash Current: KgAAAAEAAQABAAEAAAABAAAAAQABAAEAeqi4A24DxNemN0qEWhETKwK0
  
  OEM Activation 1.0 Data-->
  N/A
  
  OEM Activation 2.0 Data-->
  BIOS valid for OA 2.0: yes
  Windows marker version: 0x20001
  OEMID and OEMTableID Consistent: yes
  BIOS Information:
    ACPI Table Name    OEMID Value    OEMTableID Value
    APIC            HPQOEM        SLIC-CPC
    FACP            HPQOEM        SLIC-CPC
    HPET            HPQOEM        SLIC-CPC
    MCFG            HPQOEM        SLIC-CPC
    SLIC            HPQOEM        SLIC-CPC
    SSDT            HPQOEM        SLIC-CPC
  
  
  
  
  I don't think it changed any.
  

  Monday, January 17, 2011 7:15 AM
• 

  

  0

  Sign in to vote

  Alright, everything is all fixed, thanks everyone soooo much.

  • Marked as answer by Darin Smith MS Monday, January 17, 2011 10:50 PM

  Monday, January 17, 2011 7:20 AM
• 

  

  0

  Sign in to vote

  "WillRaley94" wrote in message news:a5d5f542-d2b5-4cbc-aaa5-d21db5429d10...

  Alright, everything is all fixed, thanks everyone soooo much.

  
  

  Huh?

  What happened?

  - your report still shows a mass of file mismatches!

   

  
  --
  
  

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  Monday, January 17, 2011 7:28 AM

  Moderator