locked
Autoupdates not completing (were working) - now added "not genuine" message RRS feed

  • Question

  • Autoupdate identifies updates, but when running stops at "0 KB total, 0% complete"

    Any MS tools tried (eg WindowsUpdateAgent30-x64) fail when trying to download files during install.

    Log error 80070002 relates to connection failure or corrupt download; have tried removing all old download and re-setting auto-update.

     

    NEW message on screen today: "Windows 7 Build 7601 This copy of Windows is not genuine"

    Output from MGADiag:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    
    Validation Code: 0x8004FE21
    Cached Online Validation Code: N/A, hr = 0x8007041d
    Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
    Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
    Windows Product ID: 00359-OEM-8992687-00006
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {9A81D316-5FFC-4E15-B45F-482280D46C6B}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_rtm.101119-1850
    TTS Error: 
    Validation Diagnostic: 
    Resolution Status: N/A
    
    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    
    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002
    
    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002
    
    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Home and Student 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005
    
    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed
    
    File Scan Data-->
    File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7601.17514], Hr = 0x80092003
    
    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{9A81D316-5FFC-4E15-B45F-482280D46C6B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-1224988271-2596631285-3465386728</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire X1301</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>P01-A0</Version><SMBIOSVersion major="2" minor="5"/><Date>20090828000000.000000+000</Date></BIOS><HWID>950E3107018400F4</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>A42E8A07DB8B73C</Val><Hash>CPDpu47H4Twch6oj+xCw1TPXado=</Hash><Pid>81602-926-1582192-68769</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 
    
    Spsys.log Content: 0x80070002
    
    Licensing Data-->
    C:\Windows\system32\slmgr.vbs(22, 1) Microsoft VBScript runtime error: ActiveX component can't create object: 'Scripting.Dictionary'
    
    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0000000000008000
    Event Time Stamp: 2:21:2011 17:55
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
    
    
    HWID Data-->
    HWID Hash Current: MAAAAAEAAwABAAEAAAACAAAAAQABAAEAeqi237oelpIAdcQtuBkMvoIyhhwaMBh5
    
    OEM Activation 1.0 Data-->
    N/A
    
    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information: 
     ACPI Table Name	OEMID Value	OEMTableID Value
     APIC			ACRSYS		ACRPRDCT
     FACP			ACRSYS		ACRPRDCT
     HPET			ACRSYS		ACRPRDCT
     MCFG			ACRSYS		ACRPRDCT
     SSDT			PTLTD 		POWERNOW
     SLIC			ACRSYS		ACRPRDCT
    
    
    

    Note this also includes the 80070002 error

    Saturday, August 13, 2011 8:52 AM

Answers

  • "BeyondBeige" wrote in message news:907b7d5e-5e0f-4a51-8356-8fe5fdf5e202...

    cl get the following reply:

    C:\Users\Administrator>net start sppsvc
    The service is not responding to the control function.

    I'll be honest not sure which service (name) SPPSVC is.

    In Services control panel:
    Software Protection   is set to   Automatic (delayed start)    not started
    SPP Notification Service    is set to    Manual    started

    It’s the Software Protection Service (see the sc qc sppsvc result)
     
    There’s obviously something interfering with it – but I have no idea what, at the moment.
    See if the guys in Windows Updates have any suggestions for you – my next suggestion would be a repair install, if not.
     
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, August 13, 2011 5:23 PM
    Moderator

All replies

  • "BeyondBeige" wrote in message news:9c0eeff3-83d3-4cf1-8d6d-09d409451636...

    Autoupdate identifies updates, but when running stops at "0 KB total, 0% complete"

    Any MS tools tried (eg WindowsUpdateAgent30-x64) fail when trying to download files during install.

    Log error 80070002 relates to connection failure or corrupt download; have tried removing all old download and re-setting auto-update.

     

    NEW message on screen today: "Windows 7 Build 7601 This copy of Windows is not genuine"

    Output from MGADiag:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    
    Validation Code: 0x8004FE21
    Cached Online Validation Code: N/A, hr = 0x8007041d
    Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
    Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
    Windows Product ID: 00359-OEM-8992687-00006
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    
    File Scan Data-->
    File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7601.17514], Hr = 0x80092003
    
    Spsys.log Content: 0x80070002
    
    Licensing Data-->
    C:\Windows\system32\slmgr.vbs(22, 1) Microsoft VBScript runtime error: ActiveX component can't create object: 'Scripting.Dictionary'
    

    Note this also includes the 80070002 error
     
    You have a couple of problems here which may or may not be related.
     
    1) the scripting error appears to result from an improperly registered SXH ..dll
    2) You have a Tampered sppsvc.exe file – which is the Software Protection Service.
     
    I hope that fixing the scripting problem will also fix the Service problem.
     
    try the following
    Open an Elevated Command Prompt window
    at the prompt, type
     
    regsvr32 scrrun.dll
    regsvr32 wshcon.dll
     
    (hit the Enter key at the end of each line) – you should get ‘success’ messages after each line.
    reboot.
    then run another MGADiag report and post the result.
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, August 13, 2011 11:06 AM
    Moderator
  • Hi Noel,

    Re-registering the dll's (both completed successfully) and re-booting has cleared the "Windows...not genuine" message.

    New MGADiag result:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    
    Validation Code: 0x8004FE21
    Cached Online Validation Code: N/A, hr = 0x8007041d
    Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
    Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
    Windows Product ID: 00359-OEM-8992687-00006
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {9A81D316-5FFC-4E15-B45F-482280D46C6B}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_rtm.101119-1850
    TTS Error: 
    Validation Diagnostic: 
    Resolution Status: N/A
    
    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    
    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002
    
    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002
    
    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Home and Student 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
    
    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed
    
    File Scan Data-->
    File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7601.17514], Hr = 0x80092003
    
    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{9A81D316-5FFC-4E15-B45F-482280D46C6B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-1224988271-2596631285-3465386728</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire X1301</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>P01-A0</Version><SMBIOSVersion major="2" minor="5"/><Date>20090828000000.000000+000</Date></BIOS><HWID>950E3107018400F4</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>A42E8A07DB8B73C</Val><Hash>CPDpu47H4Twch6oj+xCw1TPXado=</Hash><Pid>81602-926-1582192-68769</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 
    
    Spsys.log Content: 0x80070002
    
    Licensing Data-->
    C:\Windows\system32\slmgr.vbs(22, 1) Microsoft VBScript runtime error: ActiveX component can't create object: 'Scripting.Dictionary'
    
    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0000000000008000
    Event Time Stamp: 2:21:2011 17:55
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
    
    
    HWID Data-->
    HWID Hash Current: MAAAAAEAAwABAAEAAAACAAAAAQABAAEAeqi237oelpIAdcQtuBkMvoIyhhwaMBh5
    
    OEM Activation 1.0 Data-->
    N/A
    
    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information: 
     ACPI Table Name	OEMID Value	OEMTableID Value
     APIC			ACRSYS		ACRPRDCT
     FACP			ACRSYS		ACRPRDCT
     HPET			ACRSYS		ACRPRDCT
     MCFG			ACRSYS		ACRPRDCT
     SSDT			PTLTD 		POWERNOW
     SLIC			ACRSYS		ACRPRDCT
    
    
    

     

     

    Saturday, August 13, 2011 1:33 PM
  • "BeyondBeige" wrote in message news:7ff7e25b-eae7-4f55-ac39-d27cab959aa6...
     

    Hi Noel,

    Re-registering the dll's (both completed successfully) and re-booting has cleared the "Windows...not genuine" message.

    New MGADiag result:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    
    Validation Code: 0x8004FE21
    Cached Online Validation Code: N/A, hr = 0x8007041d
    Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
    Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
    Windows Product ID: 00359-OEM-8992687-00006
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    
    File Scan Data-->
    File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7601.17514], Hr = 0x80092003
    
    Licensing Data-->
    C:\Windows\system32\slmgr.vbs(22, 1) Microsoft VBScript runtime error: ActiveX component can't create object: 'Scripting.Dictionary'
    
    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0000000000008000
    Event Time Stamp: 2:21:2011 17:55
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
    
     
     
    It shouldn’t have done – not with that report! :)
    What security software are you running?
    What happens if you do a ‘Clean Boot’? – try that, and run another MGADiag report.
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, August 13, 2011 2:04 PM
    Moderator
  • Got a nasty feeling, you're not going to like this... ;-)


    System is running in "clean boot" state.  Only non-MS services running were security/diag related, now cut these back to McAfee only (see below).

    Security: McAfee Internet Security Suite

    Active security services: McShield; McAfee Validation Trust Protection Service

    No (software) firewall active on pc {ADSL router has built-in firewall, but this should not be effecting MS updates - my Win7 laptop is running update without an issue}.

     

    MGADiag report:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    
    Validation Code: 0x8004FE21
    Cached Online Validation Code: N/A, hr = 0x8007041d
    Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
    Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
    Windows Product ID: 00359-OEM-8992687-00006
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7601.2.00010300.1.0.003
    ID: {9A81D316-5FFC-4E15-B45F-482280D46C6B}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_rtm.101119-1850
    TTS Error: 
    Validation Diagnostic: 
    Resolution Status: N/A
    
    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    
    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002
    
    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002
    
    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Home and Student 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
    
    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed
    
    File Scan Data-->
    File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7601.17514], Hr = 0x80092003
    
    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{9A81D316-5FFC-4E15-B45F-482280D46C6B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-1224988271-2596631285-3465386728</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire X1301</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>P01-A0</Version><SMBIOSVersion major="2" minor="5"/><Date>20090828000000.000000+000</Date></BIOS><HWID>950E3107018400F4</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>A42E8A07DB8B73C</Val><Hash>CPDpu47H4Twch6oj+xCw1TPXado=</Hash><Pid>81602-926-1582192-68769</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 
    
    Spsys.log Content: 0x80070002
    
    Licensing Data-->
    C:\Windows\system32\slmgr.vbs(22, 1) Microsoft VBScript runtime error: ActiveX component can't create object: 'Scripting.Dictionary'
    
    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0000000000008000
    Event Time Stamp: 2:21:2011 17:55
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui
    
    
    HWID Data-->
    HWID Hash Current: MAAAAAEAAwABAAEAAAACAAAAAQABAAEAeqi237oelpIAdcQtuBkMvoIyhhwaMBh5
    
    OEM Activation 1.0 Data-->
    N/A
    
    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information: 
     ACPI Table Name	OEMID Value	OEMTableID Value
     APIC			ACRSYS		ACRPRDCT
     FACP			ACRSYS		ACRPRDCT
     HPET			ACRSYS		ACRPRDCT
     MCFG			ACRSYS		ACRPRDCT
     SSDT			PTLTD 		POWERNOW
     SLIC			ACRSYS		ACRPRDCT
    
    
    

    Saturday, August 13, 2011 2:38 PM
  • "BeyondBeige" wrote in message news:8b287710-740f-4081-bbc1-33a60de62eff...

    Got a nasty feeling, you're not going to like this... ;-)


    System is running in "clean boot" state.  Only non-MS services running were security/diag related, now cut these back to McAfee only (see below).

    Security: McAfee Internet Security Suite

    Active security services: McShield; McAfee Validation Trust Protection Service

    No (software) firewall active on pc {ADSL router has built-in firewall, but this should not be effecting MS updates - my Win7 laptop is running update without an issue}.

     

    I must admit I’m not a fan of either McAfee or Norton (please tell me that Norton has never ben installed on that machine?) but I don’t think it should cause this type of problem.
     
    McAfee ISS contains its own firewall – are you saying that it’s been switched off?
     
    Just in case there /is/ a malware problem, install Malwarebytes Anti-malware and run a quick scan  (do NOT enable the real-time scanner when installing the free version) www.malwarebytes.org – delete everything it finds.
     
    Having said that, I’m pretty much convinced that the problem lies with the windows script host – and we have very little knowledge of that in this forum.
    I would suggest that you might want to try posting to the Windows Updates forum on Answers, where others are much more likely to be able to give some sensible answers :)
     
    That may or may not also solve the other problem of the tampered file/service
     
    before you disappear that way, though – please post the results of the following commands in an Elevated Command Prompt window....
    sc qc sppsvc
    sc queryex sppsvc
    sc qprivs sppsvc
    sc qsidtype sppsvc
    sc sdshow sppsvc

     
    as that may also give some pointers to the problem with the service/file
     

     
     
     
     
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, August 13, 2011 3:45 PM
    Moderator
  • Snap I'm not an M&N fan either (friend's pc, I've been "asked" to look at). No sign of N having been on here, I think M waas only registered as it came OEM "free starter trial" style. 

    Yes M firewall turned off when update problem first spotted.  Other sites can be connected to easily and downloaded from, but any MS updates/download which aren't directly user selected from a web page, don't complete (or, I suspect, even start).

    I suspected something nasty initally; Malwarebytes is the first scanning tool I use, so this has been done and comes up clean (including full scan).

    Results from your cl queries:

    C:\Users\Administrator>sc qc sppsvc
    [SC] QueryServiceConfig SUCCESS
    
    SERVICE_NAME: sppsvc
        TYPE        : 10 WIN32_OWN_PROCESS
        START_TYPE     : 2  AUTO_START (DELAYED)
        ERROR_CONTROL   : 1  NORMAL
        BINARY_PATH_NAME  : C:\Windows\system32\sppsvc.exe
        LOAD_ORDER_GROUP  :
        TAG        : 0
        DISPLAY_NAME    : Software Protection
        DEPENDENCIES    : RpcSs
        SERVICE_START_NAME : NT AUTHORITY\NetworkService
    
    C:\Users\Administrator>sc queryex sppsvc
    
    SERVICE_NAME: sppsvc
        TYPE        : 10 WIN32_OWN_PROCESS
        STATE       : 1 STOPPED
        WIN32_EXIT_CODE  : 0 (0x0)
        SERVICE_EXIT_CODE : 0 (0x0)
        CHECKPOINT     : 0x0
        WAIT_HINT     : 0x0
        PID        : 0
        FLAGS       :
    
    C:\Users\Administrator>sc qprivs sppsvc
    [SC] QueryServiceConfig2 SUCCESS
    
    SERVICE_NAME: sppsvc
        PRIVILEGES    : SeAuditPrivilege
                 : SeChangeNotifyPrivilege
                 : SeCreateGlobalPrivilege
                 : SeImpersonatePrivilege
    
    C:\Users\Administrator>sc qsidtype sppsvc
    [SC] QueryServiceConfig2 SUCCESS
    
    SERVICE_NAME: sppsvc
    SERVICE_SID_TYPE: UNRESTRICTED
    
    C:\Users\Administrator>sc sdshow sppsvc
    
    D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO
    CRRC;;;IU)(A;;CCLCSWRPLOCRRC;;;SU)(A;;LCRP;;;AU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCW
    DWO;;;WD)
    
    C:\Users\Administrator>

     

     

     

     

    Saturday, August 13, 2011 4:43 PM
  • "BeyondBeige" wrote in message news:b292d03a-cb45-4d40-8632-07a1de1858c9...

    Snap I'm not an M&N fan either (friend's pc, I've been "asked" to look at). No sign of N having been on here, I think M waas only registered as it came OEM "free starter trial" style.

    Yes M firewall turned off when update problem first spotted.  Other sites can be connected to easily and downloaded from, but any MS updates/download which aren't directly user selected from a web page, don't complete (or, I suspect, even start).

    I suspected something nasty initally; Malwarebytes is the first scanning tool I use, so this has been done and comes up clean (including full scan).

    Results from your cl queries:

    SERVICE_NAME: sppsvc
      TYPE    : 10 WIN32_OWN_PROCESS
      STATE    : 1 STOPPED
      WIN32_EXIT_CODE : 0 (0x0)
      SERVICE_EXIT_CODE : 0 (0x0)
      CHECKPOINT   : 0x0
      WAIT_HINT   : 0x0
      PID    : 0
      FLAGS    :
    
    
    That all looks normal – except for the fact that the service is STOPPED (not too surprising if the file is tampered)
    what happens if you attempt to start it? – either using NET START SPPSVC or the Services Control panel?
     
     
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, August 13, 2011 4:56 PM
    Moderator
  • cl get the following reply:

    C:\Users\Administrator>net start sppsvc
    The service is not responding to the control function.

    I'll be honest not sure which service (name) SPPSVC is.

    In Services control panel:
    Software Protection   is set to   Automatic (delayed start)    not started
    SPP Notification Service    is set to    Manual    started

    Saturday, August 13, 2011 5:15 PM
  • "BeyondBeige" wrote in message news:907b7d5e-5e0f-4a51-8356-8fe5fdf5e202...

    cl get the following reply:

    C:\Users\Administrator>net start sppsvc
    The service is not responding to the control function.

    I'll be honest not sure which service (name) SPPSVC is.

    In Services control panel:
    Software Protection   is set to   Automatic (delayed start)    not started
    SPP Notification Service    is set to    Manual    started

    It’s the Software Protection Service (see the sc qc sppsvc result)
     
    There’s obviously something interfering with it – but I have no idea what, at the moment.
    See if the guys in Windows Updates have any suggestions for you – my next suggestion would be a repair install, if not.
     
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, August 13, 2011 5:23 PM
    Moderator