none
Windows 7 not Genuine RRS feed

  • Question

  • Hi

    I am dual booting Windows 7 Home Premium (genuine) and Linux

    After about 12 months I am now getting Windows is not genuine message, I have read some of the other questions regarding this here and have downloaded MGADiag.exe and here are the results.

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE22
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
    Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
    Windows Product ID: 00359-OEM-8992687-00006
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {FBFE2133-0BBA-4819-B4D1-32E9430F6EE2}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.130104-1431
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{FBFE2133-0BBA-4819-B4D1-32E9430F6EE2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-2963153229-3643530297-3587048456</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire 5750</Model></SYSTEM><BIOS><Manufacturer>Acer</Manufacturer><Version>V1.21</Version><SMBIOSVersion major="2" minor="7"/><Date>20120809000000.000000+000</Date></BIOS><HWID>F8873207018400FE</HWID><UserLCID>0C09</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>AUS Eastern Standard Time(GMT+10:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, HomePremium edition
    Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
    Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00359-00178-926-800006-02-1033-7601.0000-2862011
    Installation ID: 015700521211215826043453557264687483434102059866344691
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: 7QJB7
    License Status: Licensed
    Remaining Windows rearm count: 2
    Trusted time: 24/03/2013 7:34:29 AM

    Windows Activation Technologies-->
    HrOffline: 0x8004FE22
    HrOnline: N/A
    HealthStatus: 0x0000000000000800
    Event Time Stamp: 3:24:2013 07:32
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration


    HWID Data-->
    HWID Hash Current: MAAAAAEAAQABAAEAAQABAAAAAwABAAEA6GE4QVTsdgC8glyBqK3i1HrVQK1yzi5z

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            ACRSYS        ACRPRDCT
      FACP            ACRSYS        ACRPRDCT
      HPET            ACRSYS        ACRPRDCT
      BOOT            ACRSYS        ACRPRDCT
      MCFG            ACRSYS        ACRPRDCT
      ASF!            ACRSYS        ACRPRDCT
      SLIC            ACRSYS        ACRPRDCT
      SSDT            ACRSYS        ACRPRDCT
      ASPT            ACRSYS        ACRPRDCT
      SSDT            ACRSYS        ACRPRDCT
      SSDT            ACRSYS        ACRPRDCT

    Would appreciate any help

    Regards

    Ross

    Sunday, March 24, 2013 8:47 PM

Answers

  • Noel

    Sorry, no I can't find anything specific, it could po pup anytime, even if no applications are running, HMA software expires tomorrow and I'll remove it and see if it has any effect.

    Other than that I think she will put up with it, one day I might just rebuild it for her.

    Thanks for your help:)

    Rosco

    Wednesday, April 10, 2013 8:51 PM

All replies

  • Hello,

    Did you change any hardware recently (this may exacerbate the situation with your Windows not being kept genuine)?

    If there are no other obvious hardware changes I would suggest you would need a fresh install of windows, (unless someone knows now to repair windows activation system).   

    Kind regards,

    dr.d.

    Sunday, March 24, 2013 11:03 PM
  • Hi dr.d

    Thanks for responding. I have had no hardware changes... it puzzles me :(

    Rosco

    Monday, March 25, 2013 2:56 AM
  • Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration

    To confirm that the problem is what I think it is, please run the following commands in an Elevated Command Prompt window and post the results.

    REG QUERY HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5AA} /S

    REG QUERY HKLM\SOFTWARE\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5AA} /S              

    REG QUERY HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5AA} /S

      Here are some instructions to make life easier :)

    1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt. 

    2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once. 

    3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.     


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Monday, March 25, 2013 8:43 AM
    Moderator
  • Hi Noel

    Thanks for responding, I did as you requested but there was no response from the commands at all.

    I tried to attach an image to show you but was not allowed :(

    Regards

    Rosco

    Monday, March 25, 2013 9:28 PM
  • ?no response at all??

    That's impossible!

    You would at least have got an error message.

    Please try again....

    REG QUERY HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5AA} /S 
    REG QUERY HKLM\SOFTWARE\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5AA} /S               
    REG QUERY HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5AA} /S 
     
    .

      Here are some instructions to make life easier :)

    1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt. 

    2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once. 

    3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.     


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Monday, March 25, 2013 9:54 PM
    Moderator
  • Sorry Noel

    I have tried and tried, but I get no response, I am administrator as per your instructions and it just gives nothing back

    If you have an email address I can post the image of it :(

    Rosco

    Monday, March 25, 2013 11:02 PM
  • You can upload an image to your Skydrive or other favoured fileshare site, and post a link (you may have to edit the link, swapping hxxp;// in for http:// )

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Monday, March 25, 2013 11:49 PM
    Moderator
  • Sorry Noel I have tried to find a site to upload it, I don't have a Skydrive as you suggest.  I think I'll just have to ignore it.  It's my wife's laptop and she says she can bear putting up with the popup until one day I will rebuild it :)

    Many thanks for your response anyway

    Rosco

    Tuesday, March 26, 2013 10:51 PM
  • You almost certainly do have SkyDrive :) - it's part of the Windows Live package.

    https://skydrive.live.com

    DropBox - www.dropbox.com


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Wednesday, March 27, 2013 8:13 AM
    Moderator
  • Hi Noel

    sorry have been away for a while, hope this works

    https://skydrive.live.com/#cid=0085C9A93BC47E51&id=85C9A93BC47E51!104

    Rosco

    Sunday, March 31, 2013 7:17 AM
  • Close but no cigar - looks like you put it in your private folder, rather than the Public one. Move it to the Public folder then open the folder, and post the new link.

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Sunday, March 31, 2013 9:52 AM
    Moderator
  • Ouch sorry here goes

    https://skydrive.live.com/?cid=0085C9A93BC47E51&id=85C9A93BC47E51!104#cid=0085C9A93BC47E51&id=85C9A93BC47E51!105

    Rosco

    Monday, April 1, 2013 8:12 PM
  • No problem - it's always a bit of a struggle getting used to new programs.

    I have no idea what's going on there, unless the output from the CMD is being piped by default to somewhere else.

    Let's try and bypass that....

    Run the following commands

    REG QUERY HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5AA} /S >%userprofile%\Desktop\nplog.log
    REG QUERY HKLM\SOFTWARE\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5AA} /S >>%userprofile%\Desktop\nplog.log             
    REG QUERY HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5AA} /S >>%userprofile%\Desktop\nplog.log
     
    .

    That should with luck create a file on your desktop (nplog.log), and put the output into it.

    If it's worked, please open the file  in Notepad, and copy the content to your reply.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Monday, April 1, 2013 8:19 PM
    Moderator
  • Hi Noel

    Thanks for your patience...  Yes it did create the file nplog.log but it is empty

    Rosco

    Monday, April 1, 2013 8:28 PM
  • Sounds like something is hijacking the output :(

    WARNING: Mistakes in the registry can be very difficult to fix! use extra care!!

    First please make a System Restore point just in case.

    Then open Regedit

    Navigate to

    HKEY_CURRENT_USER\Environment

    and right-click on the 'Environment' - select Export, and save as npexp1.reg

    HKEY_CURRENT_USER\Volatile Environment

    and right-click on the 'Volatile Environment' - select Export, and save as npexp2.reg

    HKEY_CURRENT_USER\Console

    and right-click on the 'Console' - select Export, and save as npexp3.reg

    then compress all three files into one zip file, and upload it to your SkyDrive - post a link.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Monday, April 1, 2013 9:03 PM
    Moderator
  • Hi Noel

    Here you go  https://skydrive.live.com/#cid=0085C9A93BC47E51&id=85C9A93BC47E51!105

    Monday, April 1, 2013 9:10 PM
  • The only odd entry there is at

    HKEY_CURRENT_USER\Environment

    where the Path statement reads

    "C:\Program Files (x86)\HMA! Pro VPN\bin"

    which  presumably relates to http://www.hidemyass.com/vpn/

    I have to admit that I'm lost at this point.

    I'm going to see if I can interest someone in this problem.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Monday, April 1, 2013 9:50 PM
    Moderator
  • Noel

    Yes that's correct, it's not as dubious as it may sound, we travel a lot and it allows us to get a foreign IP address to access sites in those countries.

    The software has been on the laptop for about 6 months, messages have just started recently

    Rosco

    Monday, April 1, 2013 11:35 PM
  • Does this happen in all accounts on the machine, or only in this one?

    Try creating a new Admin user - do you still get the same problem there?


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Tuesday, April 2, 2013 9:29 AM
    Moderator
  • Noel

    Sorry a problem there, message only comes up once a day (roughly) and I have no chance of kicking my wife off her laptop for a day, she would need everything on her desktop, plus bookmarks etc, etc. :(

    Rosco

    Wednesday, April 3, 2013 12:06 AM
  • AH!

    In that case, what you almost certainly have is a race condition - probably caused by your anti-virus software interfering with the Software Protection Service.

    What AV is currently installed?

    What other AV's have EVER been installed on this machine??


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Wednesday, April 3, 2013 11:16 AM
    Moderator
  • Miscrosoft Security Essentials :)  nothing else !
    Wednesday, April 3, 2013 8:28 PM
  • Hmmm - never seen that causing race conditions.

    Does it happen at any particular time of day, or during any specific activity? (check to see if the Task Scheduler has something that fits)

    Are you using the Windows Firewall, or a third-party one?

    Any other security-type software installed/running?


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Wednesday, April 3, 2013 8:48 PM
    Moderator
  • Noel

    Microsoft firewall, and no other security software at all, will try to check it fits anything over any time of day.

    Rosco

    Thursday, April 4, 2013 8:50 AM
  • Anything new on this??

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Wednesday, April 10, 2013 12:37 PM
    Moderator
  • Noel

    Sorry, no I can't find anything specific, it could po pup anytime, even if no applications are running, HMA software expires tomorrow and I'll remove it and see if it has any effect.

    Other than that I think she will put up with it, one day I might just rebuild it for her.

    Thanks for your help:)

    Rosco

    Wednesday, April 10, 2013 8:51 PM
  • Make a nice birthday present :)

    Good luck with it.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Wednesday, April 10, 2013 9:14 PM
    Moderator