locked
dell laptop saying my windows is not genuine RRS feed

  • Question

  • my dell laptop is now saying that windows is not genuine, i ran the diagnostic tool and these are the results:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 50
    Cached Online Validation Code: N/A, hr = 0xc004f012
    Windows Product Key: *****-*****-QCPVQ-KHRB8-RMV82
    Windows Product Key Hash: +Rj3N34NLM2JqoBO/OzgzTZXgbY=
    Windows Product ID: 00359-OEM-8992687-00095
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {7BC37957-4C4D-4F7F-BC1A-4AC85A332800}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.110408-1631
    TTS Error: T:20110512085950116-
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{7BC37957-4C4D-4F7F-BC1A-4AC85A332800}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-RMV82</PKey><PID>00359-OEM-8992687-00095</PID><PIDType>2</PIDType><SID>S-1-5-21-3864810015-2631337614-2481849542</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron 1545                   </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A14</Version><SMBIOSVersion major="2" minor="4"/><Date>20091207000000.000000+000</Date></BIOS><HWID>B7473207018400F8</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>WN09   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

    Spsys.log Content: U1BMRwEAAAAAAQAACAAAAH8tAAAAAAAAYWECAAAAAADnKpGRehDMAWbXGpOihAOpMHzDmWxsjuqQIBfcnlaktog6QbqS6dFk/E1Bfvkah6Ui6uK8Ij9dtjOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAx4dZsxs/sxaQSZh6DCEuBHhpqkTw3S0TOKcsGZLU4WAXOyvL+JlouQ4Do3fMy72oUzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514
    Error: product key not found.

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0x00000000
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 5:3:2011 20:31
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:


    HWID Data-->
    HWID Hash Current: LgAAAAEAAQABAAIAAAABAAAAAgABAAEAJJTw81iV2jPQAygfdg5UbYiYlB1WuA==

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            DELL          WN09  
      FACP            DELL          WN09  
      HPET            DELL          WN09  
      MCFG            DELL          WN09  
      SLIC            DELL          WN09  
      SSDT            PmRef        BspCst
      SSDT            PmRef        BspCst
      SSDT            PmRef        BspCst



    Friday, May 13, 2011 7:19 PM

Answers

  • An interesting error considering that the product key is listed near the beginning of the report.

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514
    Error: product key not found.

    You cannot enter the embedded product key but you can enter the product key from the COA label on the bottom or in the battery compartment.  Click Start and type 'slui.exe 3' and hit Enter.  Enter the COA key and rerun the report.


    Colin Barnhorst Windows 7 Ultimate x64 on DIY with 6GB ram.
    Friday, May 13, 2011 7:42 PM
    Answerer
  • In addition to Cbarnhorst's analysis I see something else in the Diagnostic Report:

    "TTS Error: T:20110512085950116-"

     This line in your Diagnostic Report is telling me that your Windows is suffering from a Trusted Store Tamper.   In Windows, there are files that have, what is known as, a Digital Signature. A Digital Signature is an industry standard that ensures that a file is, in fact, from the specified source. If a file is modified, in any way, the Digital Signature is broken.
     
    Example: lets say you get a Printer Driver that is Digitally Signed from HP. Since the Digital Signature was created by a Trusted Source (HP) a Certificate is created within Window's Trusted Store. The Digital Signature is dependent on the file's Hash (think fingerprint) so if the file is changed in any way, it's Digital Signature is broken and becomes invalid.  So lets say that the HP Driver got modified by some sort of Malware. The File's Hash would no longer match the hash listed in the Digitally Signature (or the Signature may not even be readable at that point). The Digital Signature become invalid because windows now don't know what has been done to that file, so the file can no longer be trusted. This in turn invalidates the corresponding Certificate within the Trusted Store.
     
      What I have described in the above example is basically what is happening with your Windows.  Some Digitally Signed file has been modified in some way and the Certificate within Windows's Trusted Store has become invalid (i.e. no longer trusted) which invalidates the Certificate in the Trusted Store and that is what has triggered the Non-Genuine messaging.
     
     
      Unfortunately, none of my tools are able to pinpoint which file/signature/certificate is causing the problem. However there are a few thing you can try that may correct the issue. It is also possible that this Tamper is also causing the that Cbarnhorst mentioned in his post.
     
     
      1) First off not all Digitally Signed files are Drivers, but from experience we have found that this issue seems to occur the most with Drivers.  So my first suggestion is to confirm that all your hardware drivers are up to date. Note: Figuring out if a Driver is up to date and/or replacing a driver with a more current one can sometimes take semi-advanced computer knowledge and me explaining the process is outside the scope of this forum. If you do not know how to work with Drivers seek assistance or skip down to #2 or #3 below
     
      2) Restore Windows back to a past System Restore Point.
     
    1) Boot into Windows
    2) Click the Start button
    3) In the Start Search field, type: System Restore and hit the Enter key
    4) Select "Choose Different Restore Point", Put a check in the box that says "Show restore points older than 5 days", select the restore point that corresponds to a date Before you first noticed the issue (which hopefully was today).
    5) Click the "Next" button.
    6) Reboot
     
      3) Repair Windows using the 'sfc /scannow' command
     
    The Scan Now will look for any bad Windows files and attempt to repair them, if possible (it isn't always able to)
     
    1) Login to Windows
    2) Click the Start button
    3) Type: cmd.exe in the search field
    4) Right-click the cmd.exe file and select Run as Administrator
    5) In the CMD window, type: sfc /scannow
    6) Reboot and see if that resolves the issue.
     
    If none of my suggestions resolves the issue, please try Cbarnhorst's suggestion. 

    If that doesn't resolve the issue, then the only other thing I can suggest is to either contacting Microsoft Assisted support at one of the below URLs or reinstall Windows.

    North America: http://support.microsoft.com/contactus/cu_sc_genadv_master?ws=support&ws=support#tab4

    Outside North America:
    http://support.microsoft.com/contactus/?ws=support#tab0

     

    Thank you,


    Darin MS
    Friday, May 13, 2011 10:09 PM

All replies

  • An interesting error considering that the product key is listed near the beginning of the report.

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514
    Error: product key not found.

    You cannot enter the embedded product key but you can enter the product key from the COA label on the bottom or in the battery compartment.  Click Start and type 'slui.exe 3' and hit Enter.  Enter the COA key and rerun the report.


    Colin Barnhorst Windows 7 Ultimate x64 on DIY with 6GB ram.
    Friday, May 13, 2011 7:42 PM
    Answerer
  • In addition to Cbarnhorst's analysis I see something else in the Diagnostic Report:

    "TTS Error: T:20110512085950116-"

     This line in your Diagnostic Report is telling me that your Windows is suffering from a Trusted Store Tamper.   In Windows, there are files that have, what is known as, a Digital Signature. A Digital Signature is an industry standard that ensures that a file is, in fact, from the specified source. If a file is modified, in any way, the Digital Signature is broken.
     
    Example: lets say you get a Printer Driver that is Digitally Signed from HP. Since the Digital Signature was created by a Trusted Source (HP) a Certificate is created within Window's Trusted Store. The Digital Signature is dependent on the file's Hash (think fingerprint) so if the file is changed in any way, it's Digital Signature is broken and becomes invalid.  So lets say that the HP Driver got modified by some sort of Malware. The File's Hash would no longer match the hash listed in the Digitally Signature (or the Signature may not even be readable at that point). The Digital Signature become invalid because windows now don't know what has been done to that file, so the file can no longer be trusted. This in turn invalidates the corresponding Certificate within the Trusted Store.
     
      What I have described in the above example is basically what is happening with your Windows.  Some Digitally Signed file has been modified in some way and the Certificate within Windows's Trusted Store has become invalid (i.e. no longer trusted) which invalidates the Certificate in the Trusted Store and that is what has triggered the Non-Genuine messaging.
     
     
      Unfortunately, none of my tools are able to pinpoint which file/signature/certificate is causing the problem. However there are a few thing you can try that may correct the issue. It is also possible that this Tamper is also causing the that Cbarnhorst mentioned in his post.
     
     
      1) First off not all Digitally Signed files are Drivers, but from experience we have found that this issue seems to occur the most with Drivers.  So my first suggestion is to confirm that all your hardware drivers are up to date. Note: Figuring out if a Driver is up to date and/or replacing a driver with a more current one can sometimes take semi-advanced computer knowledge and me explaining the process is outside the scope of this forum. If you do not know how to work with Drivers seek assistance or skip down to #2 or #3 below
     
      2) Restore Windows back to a past System Restore Point.
     
    1) Boot into Windows
    2) Click the Start button
    3) In the Start Search field, type: System Restore and hit the Enter key
    4) Select "Choose Different Restore Point", Put a check in the box that says "Show restore points older than 5 days", select the restore point that corresponds to a date Before you first noticed the issue (which hopefully was today).
    5) Click the "Next" button.
    6) Reboot
     
      3) Repair Windows using the 'sfc /scannow' command
     
    The Scan Now will look for any bad Windows files and attempt to repair them, if possible (it isn't always able to)
     
    1) Login to Windows
    2) Click the Start button
    3) Type: cmd.exe in the search field
    4) Right-click the cmd.exe file and select Run as Administrator
    5) In the CMD window, type: sfc /scannow
    6) Reboot and see if that resolves the issue.
     
    If none of my suggestions resolves the issue, please try Cbarnhorst's suggestion. 

    If that doesn't resolve the issue, then the only other thing I can suggest is to either contacting Microsoft Assisted support at one of the below URLs or reinstall Windows.

    North America: http://support.microsoft.com/contactus/cu_sc_genadv_master?ws=support&ws=support#tab4

    Outside North America:
    http://support.microsoft.com/contactus/?ws=support#tab0

     

    Thank you,


    Darin MS
    Friday, May 13, 2011 10:09 PM
  • Hi, done what cbarnhorst told me to, re booted and the message hasn't come back yet so i'm guessing it has done the trick. I have run the diagnostics again, the results are below:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0
    Cached Online Validation Code: N/A, hr = 0xc004f012
    Windows Product Key: *****-*****-9HYRQ-4WHQF-M6G3W
    Windows Product Key Hash: Kfi4YhRg/VFrD1xFr+lNHKYYbC0=
    Windows Product ID: 00359-OEM-9811315-54984
    Windows Product ID Type: 8
    Windows License Type: COA SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {7BC37957-4C4D-4F7F-BC1A-4AC85A332800}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.110408-1631
    TTS Error: T:20110512085950116-
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{7BC37957-4C4D-4F7F-BC1A-4AC85A332800}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-M6G3W</PKey><PID>00359-OEM-9811315-54984</PID><PIDType>8</PIDType><SID>S-1-5-21-3864810015-2631337614-2481849542</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Inspiron 1545                   </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A14</Version><SMBIOSVersion major="2" minor="4"/><Date>20091207000000.000000+000</Date></BIOS><HWID>B7473207018400F8</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>WN09   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

    Spsys.log Content: U1BMRwEAAAAAAQAACAAAAH8tAAAAAAAAYWECAAAAAADnKpGRehDMAWbXGpOihAOpMHzDmWxsjuqQIBfcnlaktog6QbqS6dFk/E1Bfvkah6Ui6uK8Ij9dtjOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAx4dZsxs/sxaQSZh6DCEuBHhpqkTw3S0TOKcsGZLU4WAXOyvL+JlouQ4Do3fMy72oUzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgMM5DWJ9vWy3OurH7DdY1oDDOQ1ifb1stzrqx+w3WNaAwzkNYn29bLc66sfsN1jWgM

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows(R) 7, HomePremium edition
    Description: Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
    Activation ID: 5e017a8a-f3f9-4167-b1bd-ba3e236a4d8f
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00359-00196-113-154984-02-2057-7601.0000-1332011
    Installation ID: 000066333961011864881774089245672136205770061583470165
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: M6G3W
    License Status: Licensed
    Remaining Windows rearm count: 5
    Trusted time: 13/05/2011 23:23:39

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0x00000000
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 5:3:2011 20:31
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:


    HWID Data-->
    HWID Hash Current: LgAAAAEAAQABAAIAAAABAAAAAgABAAEAJJTw81iV2jPQAygfdg5UbYiYlB1WuA==

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            DELL          WN09  
      FACP            DELL          WN09  
      HPET            DELL          WN09  
      MCFG            DELL          WN09  
      SLIC            DELL          WN09  
      SSDT            PmRef        BspCst
      SSDT            PmRef        BspCst
      SSDT            PmRef        BspCst



    Friday, May 13, 2011 10:27 PM
  • "stinkybeetle" wrote in message news:53e55a35-1258-45c8-b09e-7167bf0cf4dc...

    Hi, done what cbarnhorst told me to, re booted and the message hasn't come back yet so i'm guessing it has done the trick. I have run the diagnostics again, the results are below:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0
    Cached Online Validation Code: N/A, hr = 0xc004f012
    Windows Product Key: *****-*****-9HYRQ-4WHQF-M6G3W
    Windows Product Key Hash: Kfi4YhRg/VFrD1xFr+lNHKYYbC0=
    Windows Product ID: 00359-OEM-9811315-54984
    Windows Product ID Type: 8
    Windows License Type: COA SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {7BC37957-4C4D-4F7F-BC1A-4AC85A332800}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.110408-1631
    TTS Error: T:20110512085950116-


    The Tamper that  Darin talked about doesn't appear to be still active - but it may come back.
    You need to validate the system to remove the 'Cached Online Validation' error
     
    If it fails, post back with a new MGADiag report.
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, May 14, 2011 10:46 AM
    Moderator