none
Windows 7 activated, but not genuine. Windows update doesn´t work either RRS feed

  • Question

  • Hi

    I have been looking around this forum and found plenty of threads regarding problems similar to mine. I have the understanding that procedure is to create your own thread and provide the result from MsDiag.exe (see below)

    The problem is occuring on a Dell laptop bought with an OEM licens, running Windows 7. The computer is no more than 6 month old. Windows update has failed ever since medio March, and now windows tells me that it isn´t genuine. I suspect the Windows Update problem to have caused it all, but I´m not sure.

    Looking through the result from MsDiag.exe it tells me something about some tampered files, so i think the problem is them, but have no idea how to resolve it.

    I have looked for spyware / malware without any luck.

    Do you have any idea what I should do next?

     

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-M3DJT-4J3WC-733WD
    Windows Product Key Hash: xo+ajVSpae7/4VoZjS7m6JL0f3A=
    Windows Product ID: 00371-OEM-8992671-00524
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7600.2.00010100.0.0.048
    ID: {E658A7A9-A6B3-4AE2-9E9E-7CB9D0A42216}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: Registered, 1.9.42.0
    Signed By: Microsoft
    Product Name: Windows 7 Professional
    Architecture: 0x00000000
    Build lab: 7600.win7_gdr.101026-1503
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{E658A7A9-A6B3-4AE2-9E9E-7CB9D0A42216}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7600.2.00010100.0.0.048</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-733WD</PKey><PID>00371-OEM-8992671-00524</PID><PIDType>2</PIDType><SID>S-1-5-21-161661078-517224079-1932876415</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Latitude E4200                  </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A16</Version><SMBIOSVersion major="2" minor="4"/><Date>20100506000000.000000+000</Date></BIOS><HWID>9CBB0600018400F8</HWID><UserLCID>0406</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Romance Standard Time(GMT+01:00)</TimeZone><iJoin>1</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>M09    </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7600.16385

    Name: Windows(R) 7, Professional edition
    Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
    Activation ID: 50e329f7-a5fa-46b2-85fd-f224e5da7764
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00371-00178-926-700524-02-1033-7600.0000-2362010
    Installation ID: 006101530486418070104053336461980741562870660180002436
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: 733WD
    License Status: Licensed
    Remaining Windows rearm count: 3
    Trusted time: 14-06-2011 10:27:49

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x000000000003EFFF
    Event Time Stamp: 6:13:2011 15:25
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\wat\watadminsvc.exe
    Tampered File: %systemroot%\system32\wat\watweb.dll
    Tampered File: %systemroot%\system32\wat\npwatweb.dll
    Tampered File: %systemroot%\system32\wat\watux.exe
    Tampered File: %systemroot%\system32\sppobjs.dll
    Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
    Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
    Tampered File: %systemroot%\system32\sppwinob.dll
    Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
    Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
    Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
    Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
    Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
    Tampered File: %systemroot%\system32\drivers\spsys.sys
    Tampered File: %systemroot%\system32\drivers\spldr.sys


    HWID Data-->
    HWID Hash Current: MgAAAAAAAQABAAIAAQABAAAABAABAAEAeqgQduroUIBaeEKyIlvqGlzIrFZCIDLvRso=

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name OEMID Value OEMTableID Value
      APIC   DELL    M09   
      FACP   DELL    M09   
      HPET   DELL    M09   
      BOOT   DELL    M09   
      MCFG   DELL    M09   
      ____   DELL    M09   
      ASF!   DELL    M09   
      TCPA     
      SLIC   DELL    M09   
      SSDT   PmRef  CpuPm

     

    Tuesday, June 14, 2011 8:35 AM

Answers

  • "NetKoen" wrote in message news:85352393-edab-4090-9164-6b19f5adfec5...

    Hi

    I have been looking around this forum and found plenty of threads regarding problems similar to mine. I have the understanding that procedure is to create your own thread and provide the result from MsDiag.exe (see below)

    The problem is occuring on a Dell laptop bought with an OEM licens, running Windows 7. The computer is no more than 6 month old. Windows update has failed ever since medio March, and now windows tells me that it isn´t genuine. I suspect the Windows Update problem to have caused it all, but I´m not sure.

    Looking through the result from MsDiag.exe it tells me something about some tampered files, so i think the problem is them, but have no idea how to resolve it.

    I have looked for spyware / malware without any luck.

    Do you have any idea what I should do next?

     

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-M3DJT-4J3WC-733WD
    Windows Product Key Hash: xo+ajVSpae7/4VoZjS7m6JL0f3A=
    Windows Product ID: 00371-OEM-8992671-00524
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7600.2.00010100.0.0.048
    ID: {E658A7A9-A6B3-4AE2-9E9E-7CB9D0A42216}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: Registered, 1.9.42.0
    Signed By: Microsoft
    Product Name: Windows 7 Professional

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x000000000003EFFF
    Event Time Stamp: 6:13:2011 15:25
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\wat\watadminsvc.exe
    Tampered File: %systemroot%\system32\wat\watweb.dll
    Tampered File: %systemroot%\system32\wat\npwatweb.dll
    Tampered File: %systemroot%\system32\wat\watux.exe
    Tampered File: %systemroot%\system32\sppobjs.dll
    Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
    Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
    Tampered File: %systemroot%\system32\sppwinob.dll
    Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
    Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
    Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
    Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
    Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
    Tampered File: %systemroot%\system32\drivers\spsys.sys
    Tampered File: %systemroot%\system32\drivers\spldr.sys

     

     


    From the look of it, someone has installed a set of MUI's using an unauthorized patch
    Please read this thread....
    If that's not the case, then there are other problems with your PC that need to be addressed, as it's likely that the registry corruption doesn't only extend to the ones for the files listed above.
    Interestingly, I see that the WAT Update is also affected - this wasn't the case in earlier builds of the tampering program - so there may be other things at work also - all designed to circumvent the activation/validation requirements. - this leads to the thought that perhaps the computer isn't licensed to run the Pro edition of Windows.
    For what version and edition of Windows is the PC Licensed, according to the COA sticker on the case?
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Tuesday, June 14, 2011 11:19 AM
    Moderator

All replies

  • "NetKoen" wrote in message news:85352393-edab-4090-9164-6b19f5adfec5...

    Hi

    I have been looking around this forum and found plenty of threads regarding problems similar to mine. I have the understanding that procedure is to create your own thread and provide the result from MsDiag.exe (see below)

    The problem is occuring on a Dell laptop bought with an OEM licens, running Windows 7. The computer is no more than 6 month old. Windows update has failed ever since medio March, and now windows tells me that it isn´t genuine. I suspect the Windows Update problem to have caused it all, but I´m not sure.

    Looking through the result from MsDiag.exe it tells me something about some tampered files, so i think the problem is them, but have no idea how to resolve it.

    I have looked for spyware / malware without any luck.

    Do you have any idea what I should do next?

     

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-M3DJT-4J3WC-733WD
    Windows Product Key Hash: xo+ajVSpae7/4VoZjS7m6JL0f3A=
    Windows Product ID: 00371-OEM-8992671-00524
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7600.2.00010100.0.0.048
    ID: {E658A7A9-A6B3-4AE2-9E9E-7CB9D0A42216}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: Registered, 1.9.42.0
    Signed By: Microsoft
    Product Name: Windows 7 Professional

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x000000000003EFFF
    Event Time Stamp: 6:13:2011 15:25
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\wat\watadminsvc.exe
    Tampered File: %systemroot%\system32\wat\watweb.dll
    Tampered File: %systemroot%\system32\wat\npwatweb.dll
    Tampered File: %systemroot%\system32\wat\watux.exe
    Tampered File: %systemroot%\system32\sppobjs.dll
    Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
    Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
    Tampered File: %systemroot%\system32\sppwinob.dll
    Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
    Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
    Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
    Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
    Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
    Tampered File: %systemroot%\system32\drivers\spsys.sys
    Tampered File: %systemroot%\system32\drivers\spldr.sys

     

     


    From the look of it, someone has installed a set of MUI's using an unauthorized patch
    Please read this thread....
    If that's not the case, then there are other problems with your PC that need to be addressed, as it's likely that the registry corruption doesn't only extend to the ones for the files listed above.
    Interestingly, I see that the WAT Update is also affected - this wasn't the case in earlier builds of the tampering program - so there may be other things at work also - all designed to circumvent the activation/validation requirements. - this leads to the thought that perhaps the computer isn't licensed to run the Pro edition of Windows.
    For what version and edition of Windows is the PC Licensed, according to the COA sticker on the case?
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Tuesday, June 14, 2011 11:19 AM
    Moderator
  • Hiya Mate, If I was you backup all your data and re-install wndows from the system restore. Once activated download win7 sp1 standalone and install. hope this helps.

     

     

    Monday, June 20, 2011 4:03 PM
  • "nazzieuk" wrote in message news:7d985e14-1353-4907-9cb4-427552d13ed4...

    Hiya Mate, If I was you backup all your data and re-install wndows from the system restore. Once activated download win7 sp1 standalone and install. hope this helps.

     

     


    There's no hope in h3ll that this would work. :(
     - nice thought though!
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Monday, June 20, 2011 6:33 PM
    Moderator