Remove From My Forums

"Not Genuine" problem...

Question
0

Sign in to vote

We just received a system (from a reliable OEM), and we get this "not genuine" message every few hours.

Note: The OEM sent us a system that ran only for a couple of days, before suffering a disk failure. We returned that system, and received a completely different one as replacement. We were instructed to use the same key for Windows 7 on the new system - hence, our key has been used twice, on different systems.

Here is the diagnostic output:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE21
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-MXQFP-WGGHX-QYKYP
Windows Product Key Hash: TrLtDOGzFBRfdN2SOhBiZyMqWzY=
Windows Product ID: 00371-OEM-9102117-45748
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {F2DED055-D218-410F-A471-60E6DCF6ED0F}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120330-1504
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\Windows\system32\en-US\sppc.dll.mui[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\en-US\sppcext.dll.mui[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\en-US\slc.dll.mui[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\en-US\slcext.dll.mui[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\en-US\sppuinotify.dll.mui[6.1.7600.16385], Hr = 0x80092003
File Mismatch: C:\Windows\system32\en-US\slui.exe.mui[6.1.7600.16385], Hr = 0x80092003
File Mismatch: C:\Windows\system32\en-US\sppcomapi.dll.mui[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\en-US\sppcommdlg.dll.mui[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\en-US\sppsvc.exe.mui[6.1.7600.16385], Hr = 0x80092003
File Mismatch: C:\Windows\system32\en-US\user32.dll.mui[6.1.7601.17514], Hr = 0x800b0100

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{F2DED055-D218-410F-A471-60E6DCF6ED0F}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-QYKYP</PKey><PID>00371-OEM-9102117-45748</PID><PIDType>3</PIDType><SID>S-1-5-21-3139569628-1744987753-1535828554</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>1904</Version><SMBIOSVersion major="2" minor="6"/><Date>20110809000000.000000+000</Date></BIOS><HWID>F0F63B07018400FE</HWID><UserLCID>0807</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>W. Europe Standard Time(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: d8e04254-f9a5-4729-ae86-886de6aa907c
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00182-021-145748-02-2055-7601.0000-1392012
Installation ID: 021432973122813076550712645716388706167535898546028005
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: QYKYP
License Status: Licensed
Remaining Windows rearm count: 2
Trusted time: 21.05.2012 07:07:00

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x000000000000EF60
Event Time Stamp: 5:18:2012 13:32
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui

HWID Data-->
HWID Hash Current: MgAAAAIAAQABAAEAAgABAAAAAgABAAEAln1+UsIFUGoaXSSPWMOsiw6nysRIzohALnM=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC ALASKA A M I
FACP ALASKA A M I
HPET ALASKA A M I
MCFG ALASKA A M I
SSDT AMICPU PROC

Monday, May 21, 2012 5:16 AM

Answers

0

Sign in to vote
Looks like vistalizator to me:

http://social.microsoft.com/Forums/en-US/genuinewindows7/thread/6f6b1cb8-e84e-4c1f-a2ac-181a77d2f772
- Proposed as answer by Noel D PatonModerator Monday, May 21, 2012 12:08 PM
- Marked as answer by Darin Smith MS Monday, May 21, 2012 10:33 PM
Monday, May 21, 2012 11:07 AM

Answerer

All replies

0

Sign in to vote

"Brad Richards" wrote in message news:9bbdbec0-5616-4cf7-b8a5-e5e8a3261eb7...

We just received a system (from a reliable OEM), and we get this "not genuine" message every few hours.

Note: The OEM sent us a system that ran only for a couple of days, before suffering a disk failure. We returned that system, and received a completely different one as replacement. We were instructed to use the same key for Windows 7 on the new system - hence, our key has been used twice, on different systems.

Here is the diagnostic output:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE21
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-MXQFP-WGGHX-QYKYP
Windows Product Key Hash: TrLtDOGzFBRfdN2SOhBiZyMqWzY=
Windows Product ID: 00371-OEM-9102117-45748
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.048

File Scan Data-->
File Mismatch: C:\Windows\system32\en-US\sppc.dll.mui[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\en-US\sppcext.dll.mui[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\en-US\slc.dll.mui[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\en-US\slcext.dll.mui[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\en-US\sppuinotify.dll.mui[6.1.7600.16385], Hr = 0x80092003
File Mismatch: C:\Windows\system32\en-US\slui.exe.mui[6.1.7600.16385], Hr = 0x80092003
File Mismatch: C:\Windows\system32\en-US\sppcomapi.dll.mui[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\en-US\sppcommdlg.dll.mui[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\en-US\sppsvc.exe.mui[6.1.7600.16385], Hr = 0x80092003
File Mismatch: C:\Windows\system32\en-US\user32.dll.mui[6.1.7601.17514], Hr = 0x800b0100

Other data-->
SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>1904</Version><SMBIOSVersion major="2" minor="6"/><Date>20110809000000.000000+000</Date></BIOS

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Partial Product Key: QYKYP
License Status: Licensed
Remaining Windows rearm count: 2
Trusted time: 21.05.2012 07:07:00

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x000000000000EF60
Event Time Stamp: 5:18:2012 13:32
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui
Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui
Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui
Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table

You have a problem.

Is there a COA Sticker on the case of this machine? If so, for what version and edition of WIndows is it valid?

If there is no COA sticker, then the installation is not genuine, and you will have to take that issue up with the vendor.

That said, your current problem appears to be fairly easy to solve (usually!) .

The problem lies with the file integrity.

This may simply be caused by a bad set of Intel Rapid Storage Technology drivers -

Installing the Intel Rapid Storage Drivers

try downloading and installing them from here -

http://downloadcenter.intel.com/Detail_Desc.aspx?ProductID=2101&DwnldID=20624

Once complete, please reboot twice, then post another MGADiag report.

Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

Monday, May 21, 2012 8:25 AM

Moderator
0

Sign in to vote

"You have a problem."

Well, yes, I noticed that...

"Is there a COA Sticker"

By "COA" do you mean the sticker with the Windows license key? If so, yes, we have a sticker with a license key for "Windows 7 Pro".Note: the OEM instructed us to retain and re-use the sticker from the "dead" machine that we returned. See my original post for more details.

"Intel Rapid Storage Technology drivers"

I'm not sure that these drivers were on the system at all, however, it's harmless to try. After installation (and two reboots), the diagnostics remain identical to the ones I originally posted.

Monday, May 21, 2012 9:33 AM
0

Sign in to vote
The OEM is in breach of the terms of their license agreement with MS by asking you to keep the OEM Sticker - it should have been irremovably affixed to the original machine prior to leaving their premises, and cannot be used on another machine later.

If the IrST drivers didn't fix the issue woth the file mismatches/tampers, there's only one other known problem (apart from massive corruption problems) that can cause them

please run the following commands in an Elevated command prompt and post the results - they may identify the problem.

NET START CRYTPSVC

SC QC CRYPTSVC

ICACLS C:\Windows\slcext.* /T

DIR C:\Windows\slcext.* /s

Here are some instructions to make life easier :)
1) To open an Elevated Command Prompt Window (the CP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Windows, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

Once that's done please run the standard disk checks - CHKDSK C: /R and SFC
/SCANNOW in that order - from an elevated command prompt. Please upload (a copy
of) the CBS.log file to your public SkyDrive and post the link in another
response.

Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
- Edited by Noel D PatonModerator Monday, May 21, 2012 9:55 AM formatting
Monday, May 21, 2012 9:52 AM

Moderator
0

Sign in to vote
Looks like vistalizator to me:

http://social.microsoft.com/Forums/en-US/genuinewindows7/thread/6f6b1cb8-e84e-4c1f-a2ac-181a77d2f772
- Proposed as answer by Noel D PatonModerator Monday, May 21, 2012 12:08 PM
- Marked as answer by Darin Smith MS Monday, May 21, 2012 10:33 PM
Monday, May 21, 2012 11:07 AM

Answerer
0

Sign in to vote

Many thanks for your reply. I don't know about the OEM terms - I just assumed this was a "practical" solution, since the originally delivered machine was defective. In any case:

- - - - -

NET START CRYPTSVC

The requested service has already been started.

- - - - -

SC QC CRYPTSVC

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: cryptsvc
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k NetworkService
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Cryptographic Services
DEPENDENCIES : RpcSs
SERVICE_START_NAME : NT Authority\NetworkService

- - - - -

ICACLS C:\Windows\slcext.* /T

c:\Windows\CSC\sclext.*: Access is denied.
Successfully processed 0 files; Failed processing 1 files

NOTE: Unexpected result? Yes, the terminal-window really is running as administrator.

- - - - -

DIR C:\Windows\slcext.* /s

Volume in drive C has no label.
Volume Serial Number is 7A82-6F07

Directory of c:\Windows\System32

14.07.2009 03:41 18'432 slcext.dll
1 File(s) 18'432 bytes

Directory of c:\Windows\System32\en-US

05.12.2011 14:18 17'408 slcext.dll.mui
1 File(s) 17'408 bytes

Directory of c:\Windows\SysWOW64

14.07.2009 03:16 16'384 slcext.dll
1 File(s) 16'384 bytes

Directory of c:\Windows\SysWOW64\en-US

05.12.2011 14:18 17'408 slcext.dll.mui
1 File(s) 17'408 bytes

Directory of c:\Windows\winsxs\amd64_microsoft-windows-s..clientext.resources_3
1bf3856ad364e35_6.1.7600.16385_en-us_c2382769078e1059

05.12.2011 14:18 17'408 slcext.dll.mui
1 File(s) 17'408 bytes

Directory of c:\Windows\winsxs\amd64_microsoft-windows-security-spp-clientext_3
1bf3856ad364e35_6.1.7600.16385_none_28bbe77bcacffbe4

14.07.2009 03:41 18'432 slcext.dll
1 File(s) 18'432 bytes

Directory of c:\Windows\winsxs\x86_microsoft-windows-s..clientext.resources_31b
f3856ad364e35_6.1.7600.16385_en-us_66198be54f309f23

05.12.2011 14:18 17'408 slcext.dll.mui
1 File(s) 17'408 bytes

Directory of c:\Windows\winsxs\x86_microsoft-windows-security-spp-clientext_31b
f3856ad364e35_6.1.7600.16385_none_cc9d4bf812728aae

14.07.2009 03:16 16'384 slcext.dll
1 File(s) 16'384 bytes

Total Files Listed:
8 File(s) 139'264 bytes
0 Dir(s) 66'494'959'616 bytes free

- - - - -

Chkdsk C: /R

NOTE: Nothing obviously wrong - no errors reported on the screen.

- - - - -

SFC /SCANNOW

Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

NOTE: Log file at the following link
https://skydrive.live.com/redir?resid=72E109351A49C579!105&authkey=!AEcsTCmCn9BYo5c

- - - - -

Hope you can make something of all that!

Monday, May 21, 2012 11:14 AM
0

Sign in to vote

@George1009. While I've never heard of Vistalizator, something to do with language packs is entirely plausible. I am in Switzerland, where languages go every which way. This is supposed to be a pre-install of a multilingual Windows; at first start, the setup asked for what language we wanted, and then what locale to use. I told it to be "English", but with Swiss locale settings.

I think it unlikely that Vistalizator is installed - at least, I can find no traces of any files/programs resembling that name. However, I note this sentence in the link you provided: "Another possibility is that the language pack was manually changed". Possibly this is some consequence of the language-selection at startup? Or the mixed settings (English/Swiss) that I chose?

Looking at the article you reference, I see that Microsoft offers a tool to fix this sort of problem. Do I need to open a support incident, or how should I best proceed?

@Noel: What do you think - is this likely the problem? The description does seem to match what I am seeing.

Monday, May 21, 2012 11:33 AM
0

Sign in to vote
Looking at the article you reference, I see that Microsoft offers a tool to fix this sort of problem. Do I need to open a support incident, or how should I best proceed?

@Noel: What do you think - is this likely the problem? The description does seem to match what I am seeing.

Sorry - yes, George is quite right.

I can only blame lack of caffeine for my oversight!

Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
- Edited by Noel D PatonModerator Monday, May 21, 2012 12:07 PM fumble-fingers
Monday, May 21, 2012 12:06 PM

Moderator
0

Sign in to vote

You should be able to do the necessary simply by ininstalling any language packs currently installed (using Vistalizator), and then uninstalling Visalizator.

(It may depend on exactly which version is installed as to the exact procedure)

A simple phone call may be enough - this problem is a lot rarer than it used to be, and I see that Vistalizator has had at least one new version released since I last played.

Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

Monday, May 21, 2012 12:19 PM

Moderator
0

Sign in to vote

Noel, thanks for your help. I think I am being stupid, but I don't quite understand how I should proceed. As nearly as I can tell, "Vistalizator" is not installed on this machine. At least, I cannot find anything that looks like that. If it is not installed on the machine, I kind of assume that actually installing it is not a good idea?

I thought I might follow the advice on the linked article, and start a "no cost support incident" to get the tool that is supposed to reset the language. However, clicking through the options any way I try lands me at a page at Microsoft Switzerland that asks which credit card I want to pay $449 with.

I'd be happy to try to phone-call route, or file a support incident, or whatever, but I'm not quite sure where/how to do this. Can you give me the appropriate link or phone-number?

Monday, May 21, 2012 12:30 PM
0

Sign in to vote

"Brad Richards" wrote in message news:fccd2ac6-cc2c-4688-a34e-8ea4cd3d4a41...

Noel, thanks for your help. I think I am being stupid, but I don't quite understand how I should proceed. As nearly as I can tell, "Vistalizator" is not installed on this machine. At least, I cannot find anything that looks like that. If it is not installed on the machine, I kind of assume that actually installing it is not a good idea?

I thought I might follow the advice on the linked article, and start a "no cost support incident" to get the tool that is supposed to reset the language. However, clicking through the options any way I try lands me at a page at Microsoft Switzerland that asks which credit card I want to pay $449 with.

I'd be happy to try to phone-call route, or file a support incident, or whatever, but I'm not quite sure where/how to do this. Can you give me the appropriate link or phone-number?

I haven't tested the newest version yet, so I can't really say - but the way I'd approach it would be to first establish which the 'host' language is, then run the Vistalizator download, and choose the option to Remove all other languages, then exit Vistalizator.

Reboot, and run an MGADiag report.

From what I've seen, the problem lies not with the basic OS files, but with the installed languages.

Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

Monday, May 21, 2012 12:38 PM

Moderator

Answered by:

"Not Genuine" problem...

Question

Answers

All replies