locked
WAT error is getting annoying, started about a week ago! (Old case number 1214278108) RRS feed

  • Question

  • Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE22
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-T94B7-WRGP9-MWHWK
    Windows Product Key Hash: wS+na9jRX/zlOmNF1gpOdASKbI4=
    Windows Product ID: 00359-OEM-8617607-93468
    Windows Product ID Type: 3
    Windows License Type: OEM System Builder
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {465FD5C3-7028-45F5-95AE-5F8BA9BBD87C}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000000
    Build lab: 7601.win7sp1_gdr.130708-1532
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->
    File Mismatch: C:\Windows\system32\sppcomapi.dll[Hr = 0x80070005]

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{465FD5C3-7028-45F5-95AE-5F8BA9BBD87C}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-MWHWK</PKey><PID>00359-OEM-8617607-93468</PID><PIDType>3</PIDType><SID>S-1-5-21-2174514038-467900615-2319487257</SID><SYSTEM><Manufacturer>EVGA__</Manufacturer><Model>132-YW-E178-FTW</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>6.00 PG</Version><SMBIOSVersion major="2" minor="4"/><Date>20080630000000.000000+000</Date></BIOS><HWID>643C3507018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, HomePremium edition
    Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
    Activation ID: 9ab82e0c-ffc9-4107-baa1-c65a8bd3ccc3
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00359-00172-176-093468-02-1033-7600.0000-2302010
    Installation ID: 008552733046119192312332378683463684039606943546979993
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: MWHWK
    License Status: Licensed
    Remaining Windows rearm count: 4
    Trusted time: 8/26/2013 07:11:53

    Windows Activation Technologies-->
    HrOffline: 0x8004FE22
    HrOnline: N/A
    HealthStatus: 0x0002000000002000
    Event Time Stamp: 8:19:2013 13:09
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
    Tampered Service: sppuinotify


    HWID Data-->
    HWID Hash Current: MgAAAAEAAgABAAIAAQACAAAAAQABAAEAJJRAVGxDkgDQIkDKznAMT17cmojsqGzxTFg=

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes, but no SLIC table
    Windows marker version: N/A
    OEMID and OEMTableID Consistent: N/A
    BIOS Information:
      ACPI Table Name OEMID Value OEMTableID Value
      APIC   EVGA    NVDAACPI
      FACP   EVGA    NVDAACPI
      HPET   EVGA    NVDAACPI
      MCFG   EVGA    NVDAACPI
      WDRT   EVGA    NVDAACPI



    • Edited by egl380 Monday, August 26, 2013 9:39 PM
    Monday, August 26, 2013 9:37 PM

Answers

  • Did you get a 'Success' message?

    Please run the following command (again), and post the results.

    REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\sppuinotify /S

    that should tell us what happened, if anything.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    • Marked as answer by egl380 Tuesday, September 3, 2013 11:17 AM
    Monday, September 2, 2013 10:34 AM
    Moderator

All replies

  • Please run a full CHKDSK and SFC scan....

     

    Click on Start > All Programs > Accessories

    Right-click on the Command Prompt entry

    Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

     

    At the Command prompt, type

     

    CHKDSK C: /R

     

    and hit the Enter key.

    You will be told that the drive is locked,

    and the CHKDSK will run at he next boot - hit the Y key, press Enter, and then reboot.

     

    The CHKDSK will take a few hours depending on the size of the drive, so be patient!

     

    After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -

    then run the SFC.

     

    SFC -System File Checker - Instructions

    Click on Start > All Programs > Accessories

    Right-click on the Command Prompt entry

    Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

     

    At the Command prompt, type

     

    SFC /SCANNOW

     

    and hit the Enter key

     

    Wait for the scan to finish - make a note of any error messages - and then reboot.

     

     

    Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your SkyDrive Public folder (http://skydrive.live.com ) and post a link to it so that I can take a look.

     

    Post a new MGADiag report with details of any error messages encountered.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Wednesday, August 28, 2013 11:18 AM
    Moderator
  • Neil

    Here is the link CBS.log file

    Here is the dump of the MGADiag Link as I could not get it to paste here.

    
    Thanks for your help

    Allen

    • Edited by egl380 Thursday, August 29, 2013 2:43 AM
    Thursday, August 29, 2013 2:42 AM
  • The SFC scan shows the following error...

    	Line 95880: 2013-08-28 17:34:27, Info                  CSI    000001bb [SR] Repairing 1 components
    	Line 95881: 2013-08-28 17:34:27, Info                  CSI    000001bc [SR] Beginning Verify and Repair transaction
    	Line 95882: 2013-08-28 17:34:27, Info                  CSI    000001bd [SR] Cannot repair member file [l:26{13}]"sppcomapi.dll" of Microsoft-Windows-Security-SPP-UX, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, file cannot be checked
    

    I'll post a fix protocol for it later.

    However, there appear to be other problems in the CBS results -

    Please download and save  the CheckSUR tool from http://support.microsoft.com/kb/947821

    (you'll need to look in the details for Windows 7, downloading from the Microsoft Download Center)

     

    Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.

    The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file  - and an archive …\checksur.persist.log file

     

    Then zip the CheckSUR.log and upload it to your SkyDrive Public folder so I can take a look - post a link in your reply.

     


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Thursday, August 29, 2013 6:56 AM
    Moderator
  • Tool ran fine, log in the same location http://sdrv.ms/15lmlHC

    Thanks for your assistance.

    Thursday, August 29, 2013 3:17 PM
  • That's as clear as any machine with IE10 installed...

    The 'file cannot be checked' error in your CBS.log is a bit of a strange one - it could result from a number of very different causes.

    Please run the following commands, and post the results...

    ICACLS C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.7601.17514_none_5dc908a6fd144a83 /T

    ATTRIB C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.7601.17514_none_5dc908a6fd144a83\sppcomapi.dll

    DIR C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.7601.17514_none_5dc908a6fd144a83

      Here are some instructions to make life easier :)

    1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt. 

    2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once. 

    3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.     


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Thursday, August 29, 2013 3:54 PM
    Moderator
  • C:\>ICACLS C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad364
    e35_6.1.7601.17514_none_5dc908a6fd144a83 /T
    C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.760
    1.17514_none_5dc908a6fd144a83 NT SERVICE\TrustedInstaller:(I)(OI)(CI)(F)

                                  BUILTIN\Administrators:(I)(OI)(CI)(RX)

                                  NT AUTHORITY\SYSTEM:(I)(OI)(CI)(RX)

                                  BUILTIN\Users:(I)(OI)(CI)(RX)

    C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.760
    1.17514_none_5dc908a6fd144a83\Security-SPP-UX-ppdlic.xrm-ms NT SERVICE\TrustedIn
    staller:(F)

                                                                BUILTIN\Administrato
    rs:(RX)

                                                                NT AUTHORITY\SYSTEM:
    (RX)

                                                                BUILTIN\Users:(RX)

    C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.760
    1.17514_none_5dc908a6fd144a83\slui.exe NT SERVICE\TrustedInstaller:(F)

                                           BUILTIN\Administrators:(RX)

                                           NT AUTHORITY\SYSTEM:(RX)

                                           BUILTIN\Users:(RX)

    C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.760
    1.17514_none_5dc908a6fd144a83\sppcomapi.dll Everyone:(N)

                                                NT SERVICE\TrustedInstaller:(F)

                                                BUILTIN\Administrators:(RX)

                                                NT AUTHORITY\SYSTEM:(RX)

                                                BUILTIN\Users:(RX)

    C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.760
    1.17514_none_5dc908a6fd144a83\sppcommdlg.dll NT SERVICE\TrustedInstaller:(F)

                                                 BUILTIN\Administrators:(RX)

                                                 NT AUTHORITY\SYSTEM:(RX)

                                                 BUILTIN\Users:(RX)

    C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.760
    1.17514_none_5dc908a6fd144a83\sppuinotify.dll NT SERVICE\TrustedInstaller:(F)

                                                  BUILTIN\Administrators:(RX)

                                                  NT AUTHORITY\SYSTEM:(RX)

                                                  BUILTIN\Users:(RX)

    Successfully processed 6 files; Failed processing 0 files

    Thursday, August 29, 2013 4:57 PM
  • C:\>ATTRIB C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad364
    e35_6.1.7601.17514_none_5dc908a6fd144a83\sppcomapi.dll
    A            C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad3
    64e35_6.1.7601.17514_none_5dc908a6fd144a83\sppcomapi.dll

    Thursday, August 29, 2013 4:59 PM
  • C:\>DIR C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35
    _6.1.7601.17514_none_5dc908a6fd144a83
     Volume in drive C has no label.
     Volume Serial Number is 340D-CF7C

     Directory of C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad
    364e35_6.1.7601.17514_none_5dc908a6fd144a83

    02/22/2011  17:31    <DIR>          .
    02/22/2011  17:31    <DIR>          ..
    07/13/2009  21:25             3,030 Security-SPP-UX-ppdlic.xrm-ms
    11/20/2010  08:17           325,632 slui.exe
    11/20/2010  08:21           193,536 sppcomapi.dll
    07/13/2009  21:16           345,088 sppcommdlg.dll
    11/20/2010  08:21            53,760 sppuinotify.dll
                   5 File(s)        921,046 bytes
                   2 Dir(s)  502,419,763,200 bytes free

    Thursday, August 29, 2013 4:59 PM
  • Please open an Elevated Command Prompt, and run the following command....

    ICACLS C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.7601.17514_none_5dc908a6fd144a83\sppcomapi.dll /remove Everyone

    then reboot, and run another MGADiag report.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Saturday, August 31, 2013 12:02 PM
    Moderator
  • Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

    C:\Users\Allen>ICACLS C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31
    bf3856ad364e35_6.1.7601.17514_none_5dc908a6fd144a83\sppcomapi.dll /remove Everyo
    ne
    processed file: C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux_31bf3856
    ad364e35_6.1.7601.17514_none_5dc908a6fd144a83\sppcomapi.dll
    Successfully processed 1 files; Failed processing 0 files

    Reboot and new report coming next.

    Sunday, September 1, 2013 12:59 PM
  • Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE22
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-T94B7-WRGP9-MWHWK
    Windows Product Key Hash: wS+na9jRX/zlOmNF1gpOdASKbI4=
    Windows Product ID: 00359-OEM-8617607-93468
    Windows Product ID Type: 3
    Windows License Type: OEM System Builder
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {465FD5C3-7028-45F5-95AE-5F8BA9BBD87C}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000000
    Build lab: 7601.win7sp1_gdr.130708-1532
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{465FD5C3-7028-45F5-95AE-5F8BA9BBD87C}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-MWHWK</PKey><PID>00359-OEM-8617607-93468</PID><PIDType>3</PIDType><SID>S-1-5-21-2174514038-467900615-2319487257</SID><SYSTEM><Manufacturer>EVGA__</Manufacturer><Model>132-YW-E178-FTW</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>6.00 PG</Version><SMBIOSVersion major="2" minor="4"/><Date>20080630000000.000000+000</Date></BIOS><HWID>643C3507018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, HomePremium edition
    Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
    Activation ID: 9ab82e0c-ffc9-4107-baa1-c65a8bd3ccc3
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00359-00172-176-093468-02-1033-7600.0000-2302010
    Installation ID: 008552733046119192312332378683463684039606943546979993
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: MWHWK
    License Status: Licensed
    Remaining Windows rearm count: 4
    Trusted time: 9/1/2013 09:06:41

    Windows Activation Technologies-->
    HrOffline: 0x8004FE22
    HrOnline: N/A
    HealthStatus: 0x0002000000000000
    Event Time Stamp: 8:26:2013 13:12
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered Service: sppuinotify


    HWID Data-->
    HWID Hash Current: MgAAAAEAAgABAAIAAQACAAAAAQABAAEAJJRAVGxDkgDQIkDKznAMT17cmojsqGzxTFg=

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes, but no SLIC table
    Windows marker version: N/A
    OEMID and OEMTableID Consistent: N/A
    BIOS Information:
      ACPI Table Name OEMID Value OEMTableID Value
      APIC   EVGA    NVDAACPI
      FACP   EVGA    NVDAACPI
      HPET   EVGA    NVDAACPI
      MCFG   EVGA    NVDAACPI
      WDRT   EVGA    NVDAACPI

    Sunday, September 1, 2013 1:10 PM
  • Thanks Again for your help
    Sunday, September 1, 2013 1:11 PM
  • We're getting there :)

    We now have "Tampered Service: sppuinotify" - which hopefully will be simple enough...

    Please run the following command, and post the results.

    REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\sppuinotify /S

      Here are some instructions to make life easier :)

    1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt. 

    2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once. 

    3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.     


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Sunday, September 1, 2013 1:22 PM
    Moderator
  • C:\Users\Allen>REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\sppuinotify /S
    ERROR: The system was unable to find the specified registry key or value.

    And the nag screen is still popping up.

    Sunday, September 1, 2013 8:09 PM
  • Something appears to have removed the service from the registry - have you been using any form of registry tweaker/optimiser/cleaner?

    If so - DON'T! They are all dangerous!

     

    I've uploaded a file - SPPUINOTKeyW7.zip - to my SkyDrive at https://skydrive.live.com/#cid=936736BB8FCEB92F&id=936736BB8FCEB92F%21972

    Please download and save it to your desktop.

    Right-click on the saved file and select Extract all...

    Save it to the default location

    This should create a file SPPUINOTKeyW7.reg

     

     right-click on the file, and select Merge

    Accept the warnings, - you should then get a 'Success' message.

    Close all windows, and reboot.

     

    Run another MGADiag report, and post the results.

     



    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Sunday, September 1, 2013 9:59 PM
    Moderator
  • nope, have not been in there in a long time...
    Sunday, September 1, 2013 10:46 PM
  • Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE22
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-T94B7-WRGP9-MWHWK
    Windows Product Key Hash: wS+na9jRX/zlOmNF1gpOdASKbI4=
    Windows Product ID: 00359-OEM-8617607-93468
    Windows Product ID Type: 3
    Windows License Type: OEM System Builder
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {465FD5C3-7028-45F5-95AE-5F8BA9BBD87C}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000000
    Build lab: 7601.win7sp1_gdr.130708-1532
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{465FD5C3-7028-45F5-95AE-5F8BA9BBD87C}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-MWHWK</PKey><PID>00359-OEM-8617607-93468</PID><PIDType>3</PIDType><SID>S-1-5-21-2174514038-467900615-2319487257</SID><SYSTEM><Manufacturer>EVGA__</Manufacturer><Model>132-YW-E178-FTW</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>6.00 PG</Version><SMBIOSVersion major="2" minor="4"/><Date>20080630000000.000000+000</Date></BIOS><HWID>643C3507018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, HomePremium edition
    Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
    Activation ID: 9ab82e0c-ffc9-4107-baa1-c65a8bd3ccc3
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00359-00172-176-093468-02-1033-7600.0000-2302010
    Installation ID: 008552733046119192312332378683463684039606943546979993
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: MWHWK
    License Status: Licensed
    Remaining Windows rearm count: 4
    Trusted time: 9/1/2013 19:13:35

    Windows Activation Technologies-->
    HrOffline: 0x8004FE22
    HrOnline: N/A
    HealthStatus: 0x0002000000000000
    Event Time Stamp: 8:26:2013 13:12
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered Service: sppuinotify


    HWID Data-->
    HWID Hash Current: MgAAAAEAAgABAAIAAQACAAAAAQABAAEAJJRAVGxDkgDQIkDKznAMT17cmojsqGzxTFg=

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes, but no SLIC table
    Windows marker version: N/A
    OEMID and OEMTableID Consistent: N/A
    BIOS Information:
      ACPI Table Name OEMID Value OEMTableID Value
      APIC   EVGA    NVDAACPI
      FACP   EVGA    NVDAACPI
      HPET   EVGA    NVDAACPI
      MCFG   EVGA    NVDAACPI
      WDRT   EVGA    NVDAACPI

    Sunday, September 1, 2013 11:14 PM
  • Did you get a 'Success' message?

    Please run the following command (again), and post the results.

    REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\sppuinotify /S

    that should tell us what happened, if anything.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    • Marked as answer by egl380 Tuesday, September 3, 2013 11:17 AM
    Monday, September 2, 2013 10:34 AM
    Moderator
  • C:\Users\Allen>REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\sppuinotify /S

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppuinotify
        DisplayName    REG_SZ    SPP Notification Service
        ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalServ
    ice
        Description    REG_SZ    @%SystemRoot%\system32\sppuinotify.dll,-102
        ObjectName    REG_SZ    NT AUTHORITY\LocalService
        ErrorControl    REG_DWORD    0x1
        Start    REG_DWORD    0x3
        Type    REG_DWORD    0x20
        DependOnService    REG_MULTI_SZ    EventSystem
        ServiceSidType    REG_DWORD    0x1
        RequiredPrivileges    REG_MULTI_SZ    SeChangeNotifyPrivilege\0SeImpersonate
    Privilege
        FailureActions    REG_BINARY    80510100000000000000000003000000140000000100
    0000E093040001000000E09304000000000000000000
        DelayedAutostart    REG_DWORD    0x1

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppuinotify\Parameters
        ServiceDll    REG_EXPAND_SZ    %SystemRoot%\system32\sppuinotify.dll
        ServiceDllUnloadOnStop    REG_DWORD    0x1

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppuinotify\Security
        Security    REG_BINARY    01001480C8000000D4000000140000003000000002001C0001
    00000002801400FF010F00010100000000000100000000020098000600000000001400FD01020001
    010000000000051200000000002800FD010200010600000000000550000000F05B5807C3438C9AC7
    8A72DD8F8CB4DF4447E7F800001800FF010F0001020000000000052000000020020000000014008D
    010200010100000000000504000000000014008D0102000101000000000005060000000000140000
    01000001010000000000050B000000010100000000000512000000010100000000000512000000

    Monday, September 2, 2013 1:09 PM
  • Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-T94B7-WRGP9-MWHWK
    Windows Product Key Hash: wS+na9jRX/zlOmNF1gpOdASKbI4=
    Windows Product ID: 00359-OEM-8617607-93468
    Windows Product ID Type: 3
    Windows License Type: OEM System Builder
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {465FD5C3-7028-45F5-95AE-5F8BA9BBD87C}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000000
    Build lab: 7601.win7sp1_gdr.130708-1532
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{465FD5C3-7028-45F5-95AE-5F8BA9BBD87C}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-MWHWK</PKey><PID>00359-OEM-8617607-93468</PID><PIDType>3</PIDType><SID>S-1-5-21-2174514038-467900615-2319487257</SID><SYSTEM><Manufacturer>EVGA__</Manufacturer><Model>132-YW-E178-FTW</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>6.00 PG</Version><SMBIOSVersion major="2" minor="4"/><Date>20080630000000.000000+000</Date></BIOS><HWID>643C3507018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, HomePremium edition
    Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
    Activation ID: 9ab82e0c-ffc9-4107-baa1-c65a8bd3ccc3
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00359-00172-176-093468-02-1033-7600.0000-2302010
    Installation ID: 008552733046119192312332378683463684039606943546979993
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: MWHWK
    License Status: Licensed
    Remaining Windows rearm count: 4
    Trusted time: 9/2/2013 10:34:07

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0x00000000
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 8:26:2013 13:12
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:


    HWID Data-->
    HWID Hash Current: MgAAAAEAAgABAAIAAQACAAAAAQABAAEAJJRAVGxDkgDQIkDKznAMT17cmojsqGzxTFg=

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes, but no SLIC table
    Windows marker version: N/A
    OEMID and OEMTableID Consistent: N/A
    BIOS Information:
      ACPI Table Name OEMID Value OEMTableID Value
      APIC   EVGA    NVDAACPI
      FACP   EVGA    NVDAACPI
      HPET   EVGA    NVDAACPI
      MCFG   EVGA    NVDAACPI
      WDRT   EVGA    NVDAACPI

    Monday, September 2, 2013 2:35 PM
  • That looks fine, now.

    Good Luck!


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Monday, September 2, 2013 4:18 PM
    Moderator
  • Seems to be better, no nag screen for a couple of hours. Thanks again for your assistance.

    Allen

    Monday, September 2, 2013 6:32 PM