none
Windows could not search for new updates. Update encountered unkown error code 80070426

    Question

  • Using windows Vista.

    Enclosing diagnostic tool results:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    Validation Status: Genuine
    Validation Code: 0
    Cached Online Validation Code: N/A, hr = 0x80070426
    Windows Product Key: *****-*****-27HYQ-XTKW2-WQD8Q
    Windows Product Key Hash: U8YEZzymoD4DMyaMb32rPrNIS90=
    Windows Product ID: 89583-OEM-7332157-00061
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.0.6002.2.00010300.2.0.003
    ID: {DC19163A-0D86-41BE-8C84-479AB6D22619}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows Vista (TM) Home Premium
    Architecture: 0x00000009
    Build lab: 6002.vistasp2_gdr.110617-0336
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Enterprise 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{DC19163A-0D86-41BE-8C84-479AB6D22619}</UGUID><Version>1.9.0027.0</Version><OS>6.0.6002.2.00010300.2.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-WQD8Q</PKey><PID>89583-OEM-7332157-00061</PID><PIDType>2</PIDType><SID>S-1-5-21-3392253115-3219692447-3782643376</SID><SYSTEM><Manufacturer>HP-Pavilion</Manufacturer><Model>NC829AA-ABA a6857c</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>5.37   </Version><SMBIOSVersion major="2" minor="5"/><Date>20090223000000.000000+000</Date></BIOS><HWID>33323507018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>756A8A2549D8ED0</Val><Hash>CGL2MNbhqCJTQU7L7hWu+jhRVzQ=</Hash><Pid>81599-872-4552651-65158</Pid><PidType>1</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software Licensing service is not running.

    Windows Activation Technologies-->
    N/A

    HWID Data-->
    HWID Hash Current: MAAAAAEAAAABAAEAAgABAAAAAwABAAEAln2mixi1DvY26OJs8vQIymrlkCqsVkxY

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20000
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            HPQOEM        SLIC-CPC
      FACP            HPQOEM        SLIC-CPC
      HPET            HPQOEM        SLIC-CPC
      MCFG            HPQOEM        SLIC-CPC
      OEMB            HPQOEM        SLIC-CPC
      GSCI            HPQOEM        SLIC-CPC
      SLIC            HPQOEM        SLIC-CPC
      SSDT            HPQOEM        SLIC-CPC

    Saturday, September 15, 2012 5:11 AM

Answers

  • Your problem appears to be that the Software Licensing Service is not running. and it must, if Vista is not to complain.

     Have you been using any form of Registry Cleaner??

    First check that the Service is set to start Automatically –

    Click on Start,

     in the Search box, type

    SERVICES.MSC

    and hit the Enter key.

    Accept the UAC prompt, then look in the listing for the Software Licensing Service – right-click on it and select Properties.

    Make sure that it’s set to Automatic, and click Apply

     

     Once that’s properly set, Start the service – how long before it appears to stop again? Is there anything in the Event Viewer to indicate why it stopped? – is there an error message?

     

     Please run the following commands in an Elevated (Admin) Command Prompt Window, and post the results. 

     

    net start slsvc

    sc qc slsvc

    sc queryex slsvc

    sc qprivs slsvc

    sc qsidtype slsvc

    sc sdshow slsvc

     

      Here are some instructions to make life easier :)

    1) To open an Elevated Command Prompt Window (the CP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt. 

    2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once. 

    3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.     


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Saturday, September 15, 2012 9:18 AM
    Moderator

All replies

  • Your problem appears to be that the Software Licensing Service is not running. and it must, if Vista is not to complain.

     Have you been using any form of Registry Cleaner??

    First check that the Service is set to start Automatically –

    Click on Start,

     in the Search box, type

    SERVICES.MSC

    and hit the Enter key.

    Accept the UAC prompt, then look in the listing for the Software Licensing Service – right-click on it and select Properties.

    Make sure that it’s set to Automatic, and click Apply

     

     Once that’s properly set, Start the service – how long before it appears to stop again? Is there anything in the Event Viewer to indicate why it stopped? – is there an error message?

     

     Please run the following commands in an Elevated (Admin) Command Prompt Window, and post the results. 

     

    net start slsvc

    sc qc slsvc

    sc queryex slsvc

    sc qprivs slsvc

    sc qsidtype slsvc

    sc sdshow slsvc

     

      Here are some instructions to make life easier :)

    1) To open an Elevated Command Prompt Window (the CP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt. 

    2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once. 

    3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.     


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Saturday, September 15, 2012 9:18 AM
    Moderator
  • Thanks for your help, here's the response.

    Microsoft Windows [Version 6.0.6002]
    Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

    C:\Windows\system32>net start slsvc
    The Software Licensing service is starting.
    The Software Licensing service could not be started.

    A system error has occurred.

    System error 2 has occurred.

    The system cannot find the file specified.


    C:\Windows\system32>
    C:\Windows\system32>sc qc slsvc
    [SC] QueryServiceConfig SUCCESS

    SERVICE_NAME: slsvc
            TYPE               : 10  WIN32_OWN_PROCESS
            START_TYPE         : 2   AUTO_START
            ERROR_CONTROL      : 1   NORMAL
            BINARY_PATH_NAME   : C:\Windows\system32\SLsvc.exe
            LOAD_ORDER_GROUP   : ProfSvc_Group
            TAG                : 0
            DISPLAY_NAME       : Software Licensing
            DEPENDENCIES       : RpcSs
            SERVICE_START_NAME : NT AUTHORITY\NetworkService

    C:\Windows\system32>
    C:\Windows\system32>sc queryex slsvc

    SERVICE_NAME: slsvc
            TYPE               : 10  WIN32_OWN_PROCESS
            STATE              : 1  STOPPED
            WIN32_EXIT_CODE    : -2147024894  (0x80070002)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0
            PID                : 0
            FLAGS              :

    C:\Windows\system32>
    C:\Windows\system32>sc qprivs slsvc
    [SC] QueryServiceConfig2 SUCCESS

    SERVICE_NAME: slsvc
            PRIVILEGES       : SeAuditPrivilege
                             : SeChangeNotifyPrivilege
                             : SeCreateGlobalPrivilege
                             : SeImpersonatePrivilege

    C:\Windows\system32>
    C:\Windows\system32>sc qsidtype slsvc
    [SC] QueryServiceConfig2 SUCCESS

    SERVICE_NAME: slsvc
    SERVICE_SID_TYPE:  UNRESTRICTED

    C:\Windows\system32>
    C:\Windows\system32>sc sdshow slsvc

    D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
    RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

    C:\Windows\system32>

    Sunday, September 16, 2012 12:27 AM
  • There are three reasons (that I know of) to get that error when trying to start that Service.

     

    1) The file is missing

    or

    2) The registry entry that tells Windows where to find that file is malformed (or missing altogether).

    or

    3) the system had an Activation Exploit installed prior to being updated with SP1.

     

     

    One other possibility is malware action – try using Malwarebytes Anti-Malware (www.malwarebytes.org) free version. Download it, update it, and do a full system scan (do NOT enable the real-time protection trial – it may conflict with your existing AV or malware scanners)

     

    Please check that the file C:\Windows\System32\slsvc.exe exists (indications are that it does, as otherwise it should be listed as a File Mismatch under File Scan Data)

     

    Please run a full CHKDSK and SFC scan....

    Click on Start > All Programs > Accessories

    Right-click on the Command Prompt entry

    Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

     

     At the Command prompt, type

     CHKDSK C: /R

     and hit the Enter key.

     

     You will be told that the drive is locked,

     and the CHKDSK will run at he next boot - hit the Y key, and then reboot.

     The chkdsk will take a few hours depending on the size  of the drive, so be patient!

     After the CHKDSK has run, Windows should boot normally  (possibly after a second auto-reboot) - then run the SFC.

     

     SFC -System File Checker - Instructions

    Click on Start > All Programs > Accessories

    Right-click on the Command Prompt entry

    Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

     At the Command prompt, type

     SFC /SCANNOW

     and hit the Enter key

     

     Wait for the scan to finish - make a note of any error messages - and then reboot.

     Copy the CBS.log file created to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your SkyDrive (http://skydrive.live.com ) and post a link to it so that I can take a look.

     

    Post a new MGADiag report with details of any error messages encountered.     


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, September 16, 2012 12:32 AM
    Moderator
  • No malware items detected from the scan.

    SLsvc.exe does exist.

    After CHKDSK it asked to activate windows which I tried to do, and it returned error code 80070426.

    SFC /SCANNOW returned:

    C:\Windows\system32>SFC /SCANNOW

    Beginning system scan.  This process will take some time.

    Beginning verification phase of system scan.

    Verification 100% complete.

    Windows Resource Protection found corrupt files but was unable to fix some of them.

    Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example

    C:\Windows\Logs\CBS\CBS.log

    C:\Windows\system32>

    Skydrive link is:

    https://skydrive.live.com/?cid=18E519B055EE432D&id=18E519B055EE432D!106#cid=18E519B055EE432D&id=18E519B055EE432D!105

    Sunday, September 16, 2012 6:47 PM
  • There are no unusual problems in your report p the only one relates to the universal error with the settings.ini file if the SideBar, which MS has decided is 'by design' (i.e. they can't be bothered to fix it since it has no effect on an otherwise functional system)

    1) Open Notepad

    2) Copy the below  text in the code box and paste it into Notepad

     

    Windows Registry Editor Version 5.00
     
     
     
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\slsvc]
    "DisplayName"="@%SystemRoot%\\system32\\SLsvc.exe,-101"
    "Group"="ProfSvc_Group"
    "ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
    74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,\
    00,4c,00,73,00,76,00,63,00,2e,00,65,00,78,00,65,00,00,00
    "Description"="@%SystemRoot%\\system32\\SLsvc.exe,-100"
    "ObjectName"="NT AUTHORITY\\NetworkService"
    "ErrorControl"=dword:00000001
    "Start"=dword:00000002
    "Type"=dword:00000010
    "DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00
    "ServiceSidType"=dword:00000001
    "RequiredPrivileges"=hex(7):53,00,65,00,41,00,75,00,64,00,69,00,74,00,50,00,72,\
    00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,68,00,\
    61,00,6e,00,67,00,65,00,4e,00,6f,00,74,00,69,00,66,00,79,00,50,00,72,00,69,\
    00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,00,\
    61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,00,76,\
    00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,\
    72,00,73,00,6f,00,6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,\
    00,65,00,67,00,65,00,00,00,00,00
    

     

    3) In Notepad, click ‘File’ then select ‘Save As’

    4) In the ‘Save As’ window, select ‘Desktop’ as the location to save to.

    5) Click the ‘Save as Type’ dropdown menu and select ‘All File(*.*)’

    6) In the ‘File Name:’ field, type: slsvc_reg.reg

    7) Click the ‘Save’ button

    8) The file should now be on your desktop, double-click it

    9) Reboot your computer

    post a new MGADiag report


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, September 16, 2012 9:01 PM
    Moderator
  • Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    Validation Status: Genuine
    Validation Code: 0
    Cached Online Validation Code: N/A, hr = 0x80070426
    Windows Product Key: *****-*****-27HYQ-XTKW2-WQD8Q
    Windows Product Key Hash: U8YEZzymoD4DMyaMb32rPrNIS90=
    Windows Product ID: 89583-OEM-7332157-00061
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.0.6002.2.00010300.2.0.003
    ID: {DC19163A-0D86-41BE-8C84-479AB6D22619}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows Vista (TM) Home Premium
    Architecture: 0x00000009
    Build lab: 6002.vistasp2_gdr.110617-0336
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Enterprise 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{DC19163A-0D86-41BE-8C84-479AB6D22619}</UGUID><Version>1.9.0027.0</Version><OS>6.0.6002.2.00010300.2.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-WQD8Q</PKey><PID>89583-OEM-7332157-00061</PID><PIDType>2</PIDType><SID>S-1-5-21-3392253115-3219692447-3782643376</SID><SYSTEM><Manufacturer>HP-Pavilion</Manufacturer><Model>NC829AA-ABA a6857c</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>5.37   </Version><SMBIOSVersion major="2" minor="5"/><Date>20090223000000.000000+000</Date></BIOS><HWID>33323507018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>756A8A2549D8ED0</Val><Hash>CGL2MNbhqCJTQU7L7hWu+jhRVzQ=</Hash><Pid>81599-872-4552651-65158</Pid><PidType>1</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software Licensing service is not running.

    Windows Activation Technologies-->
    N/A

    HWID Data-->
    HWID Hash Current: MAAAAAEAAAABAAEAAgABAAAAAwABAAEAln2mixi1DvY26OJs8vQIymrlkCqsVkxY

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20000
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            HPQOEM        SLIC-CPC
      FACP            HPQOEM        SLIC-CPC
      HPET            HPQOEM        SLIC-CPC
      MCFG            HPQOEM        SLIC-CPC
      OEMB            HPQOEM        SLIC-CPC
      GSCI            HPQOEM        SLIC-CPC
      SLIC            HPQOEM        SLIC-CPC
      SSDT            HPQOEM        SLIC-CPC


    Sunday, September 16, 2012 10:21 PM
  • Please run the following commands, and post the results.

    REG QUERY HKLM\SYSTEM\CurrentControlSet\services\spldr /S

    REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR /S


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, September 16, 2012 11:05 PM
    Moderator
  • Microsoft Windows [Version 6.0.6002]
    Copyright (c) 2006 Microsoft Corporation.  All rights reserved.


    C:\Windows\system32> REG QUERY HKLM\SYSTEM\CurrentControlSet\services\spldr /S
    ERROR: The system was unable to find the specified registry key or value.

    C:\Windows\system32> REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SP
    LDR /S

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR
        NextInstance    REG_DWORD    0x1

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000
        Service    REG_SZ    spldr
        Legacy    REG_DWORD    0x1
        ConfigFlags    REG_DWORD    0x400
        Class    REG_SZ    LegacyDriver
        ClassGUID    REG_SZ    {8ECC055D-047F-11D1-A537-0000F8753ED1}
        DeviceDesc    REG_SZ    Security Processor Loader Driver
        Capabilities    REG_DWORD    0x0


    C:\Windows\system32>
    Sunday, September 16, 2012 11:33 PM
  • Please Copy/Paste the content of the Code box below to a Notepad file.

    Save it to your desktop as spldr.reg

    Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\spldr] "DisplayName"="Security Processor Loader Driver" "ErrorControl"=dword:00000003 "Start"=dword:00000000 "Type"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\spldr\Enum] "0"="Root\\LEGACY_SPLDR\\0000" "Count"=dword:00000001 "NextInstance"=dword:00000001

    Once saved, close all open windows, and then right-click n the spldr.reg file and select Merge.

    You'll get a couple of warnings - accept them.

    You should then get a 'success' message.

    Reboot TWICE

    then post a new MGADiag report.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth


    Monday, September 17, 2012 8:08 AM
    Moderator
  • Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    Validation Status: Genuine
    Validation Code: 0
    Cached Online Validation Code: N/A, hr = 0x80070426
    Windows Product Key: *****-*****-27HYQ-XTKW2-WQD8Q
    Windows Product Key Hash: U8YEZzymoD4DMyaMb32rPrNIS90=
    Windows Product ID: 89583-OEM-7332157-00061
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.0.6002.2.00010300.2.0.003
    ID: {DC19163A-0D86-41BE-8C84-479AB6D22619}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows Vista (TM) Home Premium
    Architecture: 0x00000009
    Build lab: 6002.vistasp2_gdr.110617-0336
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Enterprise 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{DC19163A-0D86-41BE-8C84-479AB6D22619}</UGUID><Version>1.9.0027.0</Version><OS>6.0.6002.2.00010300.2.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-WQD8Q</PKey><PID>89583-OEM-7332157-00061</PID><PIDType>2</PIDType><SID>S-1-5-21-3392253115-3219692447-3782643376</SID><SYSTEM><Manufacturer>HP-Pavilion</Manufacturer><Model>NC829AA-ABA a6857c</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>5.37   </Version><SMBIOSVersion major="2" minor="5"/><Date>20090223000000.000000+000</Date></BIOS><HWID>33323507018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>756A8A2549D8ED0</Val><Hash>CGL2MNbhqCJTQU7L7hWu+jhRVzQ=</Hash><Pid>81599-872-4552651-65158</Pid><PidType>1</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software Licensing service is not running.

    Windows Activation Technologies-->
    N/A

    HWID Data-->
    HWID Hash Current: MAAAAAEAAAABAAEAAgABAAAAAwABAAEAln2mixi1DvY26OJs8vQIymrlkCqsVkxY

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20000
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            HPQOEM        SLIC-CPC
      FACP            HPQOEM        SLIC-CPC
      HPET            HPQOEM        SLIC-CPC
      MCFG            HPQOEM        SLIC-CPC
      OEMB            HPQOEM        SLIC-CPC
      GSCI            HPQOEM        SLIC-CPC
      SLIC            HPQOEM        SLIC-CPC
      SSDT            HPQOEM        SLIC-CPC

    Tuesday, September 18, 2012 1:17 AM
  • Hmm - that didn't seem to 'catch' - let's check the registry again....

    run the following commands and post the results

    REG QUERY HKLM\SYSTEM\CurrentControlSet\services\spldr /S

    REG QUERY HKLM\System\CurrentControlSet\services\slsvc /S


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth


    Tuesday, September 18, 2012 8:59 AM
    Moderator
  • Microsoft Windows [Version 6.0.6002]
    Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

    C:\Users\administrator2>REG QUERY HKLM\SYSTEM\CurrentControlSet\services\spldr /
    S

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\spldr
        DisplayName    REG_SZ    Security Processor Loader Driver
        ErrorControl    REG_DWORD    0x3
        Start    REG_DWORD    0x0
        Type    REG_DWORD    0x1

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\spldr\Enum
        0    REG_SZ    Root\LEGACY_SPLDR\0000
        Count    REG_DWORD    0x1
        NextInstance    REG_DWORD    0x1


    C:\Users\administrator2>REG QUERY HKLM\System\CurrentControlSet\services\slsvc /
    S

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\slsvc
        DisplayName    REG_SZ    @%SystemRoot%\system32\SLsvc.exe,-101
        Group    REG_SZ    ProfSvc_Group
        ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\SLsvc.exe
        Description    REG_SZ    @%SystemRoot%\system32\SLsvc.exe,-100
        ObjectName    REG_SZ    NT AUTHORITY\NetworkService
        ErrorControl    REG_DWORD    0x1
        Start    REG_DWORD    0x2
        Type    REG_DWORD    0x10
        DependOnService    REG_MULTI_SZ    RpcSs
        ServiceSidType    REG_DWORD    0x1
        RequiredPrivileges    REG_MULTI_SZ    SeAuditPrivilege\0SeChangeNotifyPrivil
    ege\0SeCreateGlobalPrivilege\0SeImpersonatePrivilege
        FailureActions    REG_BINARY    80510100000000000000000003000000140000000100
    0000C0D4010001000000E09304000000000000000000

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\slsvc\Enum
        0    REG_SZ    Root\LEGACY_SLSVC\0000
        Count    REG_DWORD    0x1
        NextInstance    REG_DWORD    0x1

    Tuesday, September 18, 2012 12:09 PM
  • In an Elevated command prompt window, run the following commands

    REG DELETE HKLM\System\CurrentControlSet\services\slsvc\Enum

    REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SLSVC /S

    post the results, then

    Reboot and post a new MGADiag report


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth


    Tuesday, September 18, 2012 12:26 PM
    Moderator
  • REG DELETE HKLM\System\CurrentControlSet\services\slsvc\Enum

    returns:

    ERROR: Access is denied.

    I'm not sure how to proceed.

    Wednesday, September 19, 2012 12:29 AM
  • Open Regedit and navigate to the
    HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR Key

    Export it to a reg file for safety!

    Now go to the Enum subkey and right-click on it

    Select Permissions,

    Click on Advanced, then the Owner tab

    Make sure that Administrators is the owner, and put a tick in the 'Replace
    owner...' box at the bottom

    Click OK once

    add Administrators to the Groups or Usernames list, and give them Full
    permissions

    CLICK OK

    Now right-click on the Enum wntry in the left pane, and select Delete.

    Exit Regedit, and reboot - post a new MGADiag report


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Wednesday, September 19, 2012 7:45 AM
    Moderator
  • When I click the replace owners / ok, it returns:

    Registry Editor could not set owner on the key currently selected or some of it's subkey's.

    Wednesday, September 19, 2012 12:17 PM
  • Did you put a checkmark in the 'Replace Owner' box?

    I'll need to think about a workaround, if so - it sounds as if there is/was malware present preventing access.

    This means that we'll have to use an external program to adjust permissions - and I'm reluctant to do that when I can't physically see what is happening.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Wednesday, September 19, 2012 8:00 PM
    Moderator
  • Yes, I did check the box.

    Maybe we've gone as far as possible in this form. If you agree I'll take it to the local best buy and see what they can do.

    I really appreciate your efforts concerning this problem and I thank you!

    Thursday, September 20, 2012 12:14 AM
  • It annoys me to get this close to a solution and be blocked by something like this. :)

    I would suggest that you print off this thread, and specify to whoever you get to look at the machine (preferably NOT Best Buy, as they are likely to simply reformat and reinstall) that you want the issue fixed, and that alone.

    The issue is that the Key HKLM\System\CurrentControlSet\services\slsvc\Enum should not exist in a normal inastallation - and is either being created on-the-fly by another registry key, or is locked from editing.

    One thing that may work, thinking about it, is to try the delete command again while in safe mode (or at least see if it still exists there)

    Before you go, please run the following command and post the results - it's quite possible that this entry is the one creating the unremoveable one, and I'd like to see what it contains (and then try deleting it).

    REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SLSVC /S


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Thursday, September 20, 2012 6:42 AM
    Moderator
  • In case a program has the key open do this
     
    Click this link (this is a Microsoft website for running diagnostic tools from a web address)
     
     
    Either run it directly or save it and run it from your hard drive. You don't need to be an admin.
     
    Make sure View Menu - Lower Pane View is set to Handles.
     
    Click Find menu then Find Handle or Dll. Enter the following one at a time
     
    HKLM\SYSTEM\CurrentControlSet\Services\slsvc
    HKLM\System\CurrentControlSet\services\slsvc\Enum
    HKLM\System\CurrentControlSet\services\slsvc\Enum\Root
    HKLM\System\CurrentControlSet\services\slsvc\Enum\Root\LEGACY_SLSVC
     
    Take note of the Process name and PID. The PID changes each time a program (Process) is started. Try not to reboot in case we need to do something with the PID.
     
    Tell Noel what you find.
    --
    .
    --
    "Noel D Paton" wrote in message news:10aa19e7-106c-4d2f-b485-c5a779bf0ed2...

    It annoys me to get this close to a solution and be blocked by something like this. :)

    I would suggest that you print off this thread, and specify to whoever you get to look at the machine (preferably NOT Best Buy, as they are likely to simply reformat and reinstall) that you want the issue fixed, and that alone.

    The issue is that the Key HKLM\System\CurrentControlSet\services\slsvc\Enum should not exist in a normal inastallation - and is either being created on-the-fly by another registry key, or is locked from editing.

    One thing that may work, thinking about it, is to try the delete command again while in safe mode (or at least see if it still exists there)

    Before you go, please run the following command and post the results - it's quite possible that this entry is the one creating the unremoveable one, and I'd like to see what it contains (and then try deleting it).

    REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SLSVC /S


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Thursday, September 20, 2012 8:12 AM
  • Ok, here's the return:

    Microsoft Windows [Version 6.0.6002]
    Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

    C:\Users\administrator2>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY
    _SLSVC /S

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SLSVC
        NextInstance    REG_DWORD    0x1

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SLSVC\0000
        Service    REG_SZ    slsvc
        Legacy    REG_DWORD    0x1
        ConfigFlags    REG_DWORD    0x0
        Class    REG_SZ    LegacyDriver
        ClassGUID    REG_SZ    {8ECC055D-047F-11D1-A537-0000F8753ED1}
        DeviceDesc    REG_SZ    @%SystemRoot%\system32\SLsvc.exe,-101

    Friday, September 21, 2012 1:57 AM
  • OK - let's try it this way, then

    REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\slsvc

    With any luck that one will work, and remove the excess entry.

    reboot, and run another MGADiag report.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Friday, September 21, 2012 9:01 AM
    Moderator
  • No joy.......

    Microsoft Windows [Version 6.0.6002]
    Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

    C:\Users\administrator2> REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\slsvc

    Permanently delete the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
    Services\slsvc (Yes/No)? y
    ERROR: Access is denied.

    Saturday, September 22, 2012 12:56 AM
  • OK - probably just as well - I meant to post this one instead (must have been lack of caffeine!)

    REG DELETE HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SLSVC

    If that one doesn't work, then we'll have to go in through Regedit and do it there.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Saturday, September 22, 2012 1:05 AM
    Moderator
  • REG DELETE HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SLSVC

    Nope, still no luck.

    Sunday, September 23, 2012 3:32 AM
  • OK we'll have to do it the hard way :)

    NOTE: Editing the registry is hazardous! - there are no Undo options, so be VERY careful what you do, and create a System Restore point before starting!!

    Open Regedit (the Registry Editor)

    In the left pane, navigate to

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root

    Find the LEGACY_SLSVC entry, and right-click on it

    Select Permissions

    Click on Advanced, then the Owner tab - make sure that Administrators is highlighted, and put a tick in the 'Replace owner on....' box - then click Apply.

    Click on the Permissions tab, and highlight the Adimistrators entry (If one doesn't exist, use the Add button)

    Give Administrators Full Control allow permissions

    put a tick in the 'Replace all existing...' box, and click Apply

    OK out to Regedit, then try and delete the LEGACY_SLSVC entry.

    Exit Regedit and reboot.

    run another MGADiag report. and post the results.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, September 23, 2012 10:07 AM
    Moderator
  • Unable to complete.

    I had to use the add button and manually put administrators in the permissions.

    When I tried to apply it returned:

    "Registry Editor could not set security in the key currently selected or some of it's subkey's."

    Thursday, September 27, 2012 2:26 AM
  • Did you change teh Ownership first?

    Unless the Owner is Administrators, you're going to be out of luck.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Thursday, September 27, 2012 7:11 AM
    Moderator
  • Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    Validation Status: Genuine
    Validation Code: 0
    Cached Online Validation Code: N/A, hr = 0x80070426
    Windows Product Key: *****-*****-27HYQ-XTKW2-WQD8Q
    Windows Product Key Hash: U8YEZzymoD4DMyaMb32rPrNIS90=
    Windows Product ID: 89583-OEM-7332157-00061
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.0.6002.2.00010300.2.0.003
    ID: {DC19163A-0D86-41BE-8C84-479AB6D22619}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows Vista (TM) Home Premium
    Architecture: 0x00000009
    Build lab: 6002.vistasp2_gdr.110617-0336
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Enterprise 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{DC19163A-0D86-41BE-8C84-479AB6D22619}</UGUID><Version>1.9.0027.0</Version><OS>6.0.6002.2.00010300.2.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-WQD8Q</PKey><PID>89583-OEM-7332157-00061</PID><PIDType>2</PIDType><SID>S-1-5-21-3392253115-3219692447-3782643376</SID><SYSTEM><Manufacturer>HP-Pavilion</Manufacturer><Model>NC829AA-ABA a6857c</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>5.37   </Version><SMBIOSVersion major="2" minor="5"/><Date>20090223000000.000000+000</Date></BIOS><HWID>33323507018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>756A8A2549D8ED0</Val><Hash>CGL2MNbhqCJTQU7L7hWu+jhRVzQ=</Hash><Pid>81599-872-4552651-65158</Pid><PidType>1</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software Licensing service is not running.

    Windows Activation Technologies-->
    N/A

    HWID Data-->
    HWID Hash Current: MAAAAAEAAAABAAEAAgABAAAAAwABAAEAln2mixi1DvY26OJs8vQIymrlkCqsVkxY

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20000
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            HPQOEM        SLIC-CPC
      FACP            HPQOEM        SLIC-CPC
      HPET            HPQOEM        SLIC-CPC
      MCFG            HPQOEM        SLIC-CPC
      OEMB            HPQOEM        SLIC-CPC
      GSCI            HPQOEM        SLIC-CPC
      SLIC            HPQOEM        SLIC-CPC
      SSDT            HPQOEM        SLIC-CPC

    Saturday, September 29, 2012 3:20 AM
  • OK - please run the following, and post the results.

    REG QUERY HKLM\System\CurrentControlSet\services\slsvc /S

    REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SLSVC /S

    There may be something I've missed somewhere....


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Saturday, September 29, 2012 8:04 AM
    Moderator
  • Ok, here's the return:

    Microsoft Windows [Version 6.0.6002]
    Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

    C:\Users\administrator2>REG QUERY HKLM\System\CurrentControlSet\services\slsvc /
    S

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\slsvc
        DisplayName    REG_SZ    @%SystemRoot%\system32\SLsvc.exe,-101
        Group    REG_SZ    ProfSvc_Group
        ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\SLsvc.exe
        Description    REG_SZ    @%SystemRoot%\system32\SLsvc.exe,-100
        ObjectName    REG_SZ    NT AUTHORITY\NetworkService
        ErrorControl    REG_DWORD    0x1
        Start    REG_DWORD    0x2
        Type    REG_DWORD    0x10
        DependOnService    REG_MULTI_SZ    RpcSs
        ServiceSidType    REG_DWORD    0x1
        RequiredPrivileges    REG_MULTI_SZ    SeAuditPrivilege\0SeChangeNotifyPrivil
    ege\0SeCreateGlobalPrivilege\0SeImpersonatePrivilege
        FailureActions    REG_BINARY    80510100000000000000000003000000140000000100
    0000C0D4010001000000E09304000000000000000000

    C:\Users\administrator2>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY
    _SLSVC /S
    ERROR: The system was unable to find the specified registry key or value.

    Saturday, September 29, 2012 3:03 PM
  • Good - we have actually managed to get rid of the excess entry, at least.

    All the registry entries are now as they should be, but the service is still not starting properly.

    please tun the following commands and post the results.

    net start slsvc

    sc qc slsvc

    sc queryex slsvc

    sc qprivs slsvc

    sc qsidtype slsvc

    sc sdshow slsvc

    (many of them are just to make the output more human-readable for me, and to act as a double-check)


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Saturday, September 29, 2012 7:59 PM
    Moderator
  • Hope this helps.

    C:\Users\administrator2> net start slsvc
    System error 5 has occurred.

    Access is denied.


    C:\Users\administrator2>
    C:\Users\administrator2>sc qc slsvc
    [SC] QueryServiceConfig SUCCESS

    SERVICE_NAME: slsvc
            TYPE               : 10  WIN32_OWN_PROCESS
            START_TYPE         : 2   AUTO_START
            ERROR_CONTROL      : 1   NORMAL
            BINARY_PATH_NAME   : C:\Windows\system32\SLsvc.exe
            LOAD_ORDER_GROUP   : ProfSvc_Group
            TAG                : 0
            DISPLAY_NAME       : Software Licensing
            DEPENDENCIES       : RpcSs
            SERVICE_START_NAME : NT AUTHORITY\NetworkService

    C:\Users\administrator2>
    C:\Users\administrator2>sc queryex slsvc

    SERVICE_NAME: slsvc
            TYPE               : 10  WIN32_OWN_PROCESS
            STATE              : 1  STOPPED
            WIN32_EXIT_CODE    : -1073426173  (0xc004d103)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0
            PID                : 0
            FLAGS              :

    C:\Users\administrator2>
    C:\Users\administrator2>sc qprivs slsvc
    [SC] QueryServiceConfig2 SUCCESS

    SERVICE_NAME: slsvc
            PRIVILEGES       : SeAuditPrivilege
                             : SeChangeNotifyPrivilege
                             : SeCreateGlobalPrivilege
                             : SeImpersonatePrivilege

    C:\Users\administrator2>
    C:\Users\administrator2>sc qsidtype slsvc
    [SC] QueryServiceConfig2 SUCCESS

    SERVICE_NAME: slsvc
    SERVICE_SID_TYPE:  UNRESTRICTED

    C:\Users\administrator2>
    C:\Users\administrator2>sc sdshow slsvc

    D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
    RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
    Sunday, September 30, 2012 9:03 PM
  • Sorry - my fault - the first command needs to be run as an Administrator to give the proper result.

    Please open an Elevated Command prompt, and run the following commands only.

    NET START SLSVC

    SC QUERYEX SLSVC

     - that will give the proper data

    The rest look OK


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, September 30, 2012 9:13 PM
    Moderator
  • Please also run the following commands and post the results. (the existing error may be nough for the next link in the chain :) )

    DIR C:\Windows\spldr.sys /S

    ICACLS C:\Windows\system32\spldr.sys


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, September 30, 2012 9:20 PM
    Moderator
  • The first command won't run, not sure how to change to administrator. I've enclosed the others you requested.

    Microsoft Windows [Version 6.0.6002]
    Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

    C:\Users\administrator2>NET START SLSVC
    System error 5 has occurred.

    Access is denied.


    C:\Users\administrator2>SC QUERYEX SLSVC

    SERVICE_NAME: SLSVC
            TYPE               : 10  WIN32_OWN_PROCESS
            STATE              : 1  STOPPED
            WIN32_EXIT_CODE    : -1073426173  (0xc004d103)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0
            PID                : 0
            FLAGS              :

    C:\Users\administrator2>DIR C:\Windows\spldr.sys /S
     Volume in drive C is HP
     Volume Serial Number is 1C94-D7FF

     Directory of C:\Windows\System32\drivers

    04/11/2009  12:15 AM            19,432 spldr.sys
                   1 File(s)         19,432 bytes

     Directory of C:\Windows\winsxs\amd64_microsoft-windows-s..ive-blackbox-loader_3
    1bf3856ad364e35_6.0.6001.18000_none_c751c3bd097955e8

    01/20/2008  07:48 PM            21,048 spldr.sys
                   1 File(s)         21,048 bytes

     Directory of C:\Windows\winsxs\amd64_microsoft-windows-s..ive-blackbox-loader_3
    1bf3856ad364e35_6.0.6002.18005_none_c93d3cc9069b2134

    04/11/2009  12:15 AM            19,432 spldr.sys
                   1 File(s)         19,432 bytes

         Total Files Listed:
                   3 File(s)         59,912 bytes
                   0 Dir(s)  372,452,323,328 bytes free

    C:\Users\administrator2>ICACLS C:\Windows\system32\spldr.sys
    The system cannot find the file specified.
    Successfully processed 0 files; Failed processing 1 files

    Tuesday, October 2, 2012 12:02 AM
  • Sorry - my fault on the last one.....

    please run the following command

    ICACLS C:\Windows\System32\drivers\spldr.sys

    and post the result

    I have to check a couple of things - I can't for the moment work out where the current file comes from (it's not part of SP2, and so must be from a patch)

    Please run the CheckSUR tool from http://support.microsoft.com/kb/947821

    (you'll need to look in the details for Method 2)

     

    then zip the CheckSUR.log and upload it to your public SkyDrive so I can take a look - post
    a link in your reply.

    The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for
    most of that time, but be patient.



    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Tuesday, October 2, 2012 10:52 AM
    Moderator
  • Microsoft Windows [Version 6.0.6002]
    Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

    C:\Users\administrator2>ICACLS C:\Windows\System32\drivers\spldr.sys
    C:\Windows\System32\drivers\spldr.sys NT SERVICE\TrustedInstaller:(F)
                                          BUILTIN\Administrators:(RX)
                                          NT AUTHORITY\SYSTEM:(RX)
                                          BUILTIN\Users:(RX)

    Successfully processed 1 files; Failed processing 0 files
    Wednesday, October 3, 2012 4:14 AM
  • Have you managed to run the CheckSUR tool yet?

    (I'm still trying to isolate the patch that your spldr.sys came in - I can't google it for some reason, and I'm having to build a new Vista install and update it slowly to see if I can get one to install.)


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Wednesday, October 3, 2012 9:18 AM
    Moderator
  • Well, this is all it returned:

    =================================
    Checking System Update Readiness.
    Binary Version 6.0.6002.22574
    Package Version 16.0
    2012-10-03 20:19

    Checking Windows Servicing Packages

    Checking Package Manifests and Catalogs

    Checking Package Watchlist

    Checking Component Watchlist

    Checking Packages

    Checking Component Store

    Summary:
    Seconds executed: 2248
     No errors detected

    --------------------------------------------------------

    There is something else called CBS but when I click it say's access denied.

    Thursday, October 4, 2012 4:36 AM
  • The CBS.log is permanently in use - and can't be read directly (we actually looked at that back on 16th Sept!).

    I'm still trying to track the patch down. - back later.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Thursday, October 4, 2012 7:28 AM
    Moderator
  • Ooops! - it would have helped if I'd been looking in the right version - I'd been looking at the x86 rahter than the x64 version! (DUH!)

    Let's check the filesystem again - it's been a while, and we've done a few things since....

     SFC -System File Checker - Instructions

    Click on Start > All Programs > Accessories

    Right-click on the Command Prompt entry

    Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

     At the Command prompt, type

     SFC /SCANNOW

     and hit the Enter key

     

     Wait for the scan to finish - make a note of any error messages - and then reboot.

     Copy the CBS.log file created to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your SkyDrive (http://skydrive.live.com ) and post a link to it so that I can take a look.

     

    Post a new MGADiag report with details of any error messages encountered.     


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Thursday, October 4, 2012 12:04 PM
    Moderator
  • C:\Windows\system32>SFC /SCANNOW

    Verification 100% complete.

    Windows Resource Protection found corrupt files but was unable to fix some of them.

    Details are included in the CBS.Log

    Link:

    https://skydrive.live.com/#cid=18E519B055EE432D&id=18E519B055EE432D!105

    Friday, October 5, 2012 3:36 AM
  • Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    Validation Status: Genuine
    Validation Code: 0
    Cached Online Validation Code: N/A, hr = 0x80070426
    Windows Product Key: *****-*****-27HYQ-XTKW2-WQD8Q
    Windows Product Key Hash: U8YEZzymoD4DMyaMb32rPrNIS90=
    Windows Product ID: 89583-OEM-7332157-00061
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.0.6002.2.00010300.2.0.003
    ID: {DC19163A-0D86-41BE-8C84-479AB6D22619}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows Vista (TM) Home Premium
    Architecture: 0x00000009
    Build lab: 6002.vistasp2_gdr.110617-0336
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Enterprise 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{DC19163A-0D86-41BE-8C84-479AB6D22619}</UGUID><Version>1.9.0027.0</Version><OS>6.0.6002.2.00010300.2.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-WQD8Q</PKey><PID>89583-OEM-7332157-00061</PID><PIDType>2</PIDType><SID>S-1-5-21-3392253115-3219692447-3782643376</SID><SYSTEM><Manufacturer>HP-Pavilion</Manufacturer><Model>NC829AA-ABA a6857c</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>5.37   </Version><SMBIOSVersion major="2" minor="5"/><Date>20090223000000.000000+000</Date></BIOS><HWID>33323507018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>756A8A2549D8ED0</Val><Hash>CGL2MNbhqCJTQU7L7hWu+jhRVzQ=</Hash><Pid>81599-872-4552651-65158</Pid><PidType>1</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software Licensing service is not running.

    Windows Activation Technologies-->
    N/A

    HWID Data-->
    HWID Hash Current: MAAAAAEAAAABAAEAAgABAAAAAwABAAEAln2mixi1DvY26OJs8vQIymrlkCqsVkxY

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20000
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            HPQOEM        SLIC-CPC
      FACP            HPQOEM        SLIC-CPC
      HPET            HPQOEM        SLIC-CPC
      MCFG            HPQOEM        SLIC-CPC
      OEMB            HPQOEM        SLIC-CPC
      GSCI            HPQOEM        SLIC-CPC
      SLIC            HPQOEM        SLIC-CPC
      SSDT            HPQOEM        SLIC-CPC

    Friday, October 5, 2012 3:39 AM
  • The SFC scan is still not showing any errors other than the expected one.

    I finally found the SPLDR.SYS file! - and it's apparently normal.

    We can check this using the following command in an Elevated Command Prompt

    SFC /SCANFILE=C:\Windows\System32\drivers\spldr.sys

    I'm really rather stumped by this - all the usual registry entries appear normal now, and as far as I can see, the files are OK, so things should work.

    Let's see if there's anything I've missed....

    Please run the following commands in an Elevated Command prompt, and post the results...

    NET START SPLDR

    SC QC SPLDR

    SC QUERYEX SPLDR

    SC SDSHOW SPLDR

    SC QPRIVS SPLDR

    SC SHOWSID SPLDR


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Friday, October 5, 2012 9:13 AM
    Moderator
  • C:\Windows\system32>SFC /SCANFILE=C:\Windows\System32\drivers\spldr.sys


    Windows Resource Protection did not find any integrity violations.

    C:\Windows\system32>NET START SPLDR
    The requested service has already been started.

    More help is available by typing NET HELPMSG 2182.
    C:\Windows\system32>SC QC SPLDR
    [SC] QueryServiceConfig SUCCESS

    SERVICE_NAME: SPLDR
            TYPE               : 1  KERNEL_DRIVER
            START_TYPE         : 0   BOOT_START
            ERROR_CONTROL      : 3   CRITICAL
            BINARY_PATH_NAME   :
            LOAD_ORDER_GROUP   :
            TAG                : 0
            DISPLAY_NAME       : Security Processor Loader Driver
            DEPENDENCIES       :
            SERVICE_START_NAME :
    C:\Windows\system32>SC QUERYEX SPLDR

    SERVICE_NAME: SPLDR
            TYPE               : 1  KERNEL_DRIVER
            STATE              : 4  RUNNING
                                    (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
            WIN32_EXIT_CODE    : 0  (0x0)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0
            PID                : 0
            FLAGS              :

    C:\Windows\system32>SC SDSHOW SPLDR

    D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
    RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

    C:\Windows\system32>
    C:\Windows\system32>SC QPRIVS SPLDR
    [SC] QueryServiceConfig2 SUCCESS

    SERVICE_NAME: SPLDR
            PRIVILEGES       :


    C:\Windows\system32>SC SHOWSID SPLDR

    NAME: SPLDR
    SERVICE SID: S-1-5-80-2246094146-3761615012-3991572358-959820157-1291755210

    Saturday, October 6, 2012 2:41 AM
  • That all looks fine to me - so the problem isn't there.....

    let's check the SLSVC again.

    Please run the following in an Elevated Command Prompt.

    NET START SLSVC

    SC QC SLSVC

    SC QUERYEX SLSVC

    SC SDSHOW SLSVC

    SC QPRIVS SLSVC

    SC SHOWSID SLSVC

    Post the results.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Saturday, October 6, 2012 9:06 AM
    Moderator
  • C:\Windows\system32>NET START SLSVC
    The Software Licensing service is starting.
    The Software Licensing service could not be started.

    A system error has occurred.

    System error 53507 has occurred.

    C:\Windows\system32>SC QC SLSVC
    [SC] QueryServiceConfig SUCCESS

    SERVICE_NAME: SLSVC
            TYPE               : 10  WIN32_OWN_PROCESS
            START_TYPE         : 2   AUTO_START
            ERROR_CONTROL      : 1   NORMAL
            BINARY_PATH_NAME   : C:\Windows\system32\SLsvc.exe
            LOAD_ORDER_GROUP   : ProfSvc_Group
            TAG                : 0
            DISPLAY_NAME       : Software Licensing
            DEPENDENCIES       : RpcSs
            SERVICE_START_NAME : NT AUTHORITY\NetworkService

    C:\Windows\system32>SC QUERYEX SLSVC

    SERVICE_NAME: SLSVC
            TYPE               : 10  WIN32_OWN_PROCESS
            STATE              : 1  STOPPED
            WIN32_EXIT_CODE    : -1073426173  (0xc004d103)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0
            PID                : 0
            FLAGS              :

    C:\Windows\system32>SC SDSHOW SLSVC

    D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
    RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

    C:\Windows\system32>SC QPRIVS SLSVC
    [SC] QueryServiceConfig2 SUCCESS

    SERVICE_NAME: SLSVC
            PRIVILEGES       : SeAuditPrivilege
                             : SeChangeNotifyPrivilege
                             : SeCreateGlobalPrivilege
                             : SeImpersonatePrivilege

    C:\Windows\system32>SC SHOWSID SLSVC

    NAME: SLSVC
    SERVICE SID: S-1-5-80-2119565420-4155874467-2934723793-509086461-374458824


    Saturday, October 6, 2012 5:02 PM
  • System error 53507 is conventionally caused by massive file corruption - but I suspect that it's due more to registry problems.

    Let's check a connected service or two and see what we can see.

    Please run the following commands, and post the results.

    SC QUERYEX VSS

    SC QUERYEX BITS

    SC QUERYEX WUAUSERV

    SC QUERYEX TRUSTEDINSTALLER


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Saturday, October 6, 2012 5:28 PM
    Moderator
  • C:\Windows\system32>SC QUERYEX VSS

    SERVICE_NAME: VSS
            TYPE               : 10  WIN32_OWN_PROCESS
            STATE              : 1  STOPPED
            WIN32_EXIT_CODE    : 1077  (0x435)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0
            PID                : 0
            FLAGS              :

    C:\Windows\system32>SC QUERYEX BITS

    SERVICE_NAME: BITS
            TYPE               : 20  WIN32_SHARE_PROCESS
            STATE              : 1  STOPPED
            WIN32_EXIT_CODE    : 1077  (0x435)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0
            PID                : 0
            FLAGS              :

    C:\Windows\system32>SC QUERYEX WUAUSERV

    SERVICE_NAME: WUAUSERV
            TYPE               : 20  WIN32_SHARE_PROCESS
            STATE              : 1  STOPPED
            WIN32_EXIT_CODE    : 1077  (0x435)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0
            PID                : 0
            FLAGS              :

    C:\Windows\system32>SC QUERYEX TRUSTEDINSTALLER

    SERVICE_NAME: TRUSTEDINSTALLER
            TYPE               : 10  WIN32_OWN_PROCESS
            STATE              : 1  STOPPED
            WIN32_EXIT_CODE    : 1077  (0x435)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0
            PID                : 0
            FLAGS              :


    Sunday, October 7, 2012 8:58 PM
  • Hmmm - the All the services have exited with the same error code- it's a case of whether that is as a result of the SLSVC problem, or related to the same cause.

    All those services depend on the same service to be able to start - the RPCSS service

    Please run the following commands, and post the results.

    NET START RPCSS

    SC SC RPCSS

    SC QUERYEX RPCSS


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Sunday, October 7, 2012 9:49 PM
    Moderator
  • C:\Windows\system32>NET START RPCSS
    The requested service has already been started.

    More help is available by typing NET HELPMSG 2182.


    C:\Windows\system32>SC SC RPCSS

    ERROR:  Unrecognized command

    DESCRIPTION:
            SC is a command line program used for communicating with the
            Service Control Manager and services.
    USAGE:
            sc <server> [command] [service name] <option1> <option2>...


            The option <server> has the form "\\ServerName"
            Further help on commands can be obtained by typing: "sc [command]"
            Commands:
              query-----------Queries the status for a service, or
                              enumerates the status for types of services.
              queryex---------Queries the extended status for a service, or
                              enumerates the status for types of services.
              start-----------Starts a service.
              pause-----------Sends a PAUSE control request to a service.
              interrogate-----Sends an INTERROGATE control request to a service.
              continue--------Sends a CONTINUE control request to a service.
              stop------------Sends a STOP request to a service.
              config----------Changes the configuration of a service (persistent).
              description-----Changes the description of a service.
              failure---------Changes the actions taken by a service upon failure.
              failureflag-----Changes the failure actions flag of a service.
              sidtype---------Changes the service SID type of a service.
              privs-----------Changes the required privileges of a service.
              qc--------------Queries the configuration information for a service.
              qdescription----Queries the description for a service.
              qfailure--------Queries the actions taken by a service upon failure.
              qfailureflag----Queries the failure actions flag of a service.
              qsidtype--------Queries the service SID type of a service.
              qprivs----------Queries the required privileges of a service.
              delete----------Deletes a service (from the registry).
              create----------Creates a service. (adds it to the registry).
              control---------Sends a control to a service.
              sdshow----------Displays a service's security descriptor.
              sdset-----------Sets a service's security descriptor.
              showsid---------Displays the service SID string corresponding to an ar
    bitrary name.
              GetDisplayName--Gets the DisplayName for a service.
              GetKeyName------Gets the ServiceKeyName for a service.
              EnumDepend------Enumerates Service Dependencies.

            The following commands don't require a service name:
            sc <server> <command> <option>
              boot------------(ok | bad) Indicates whether the last boot should
                              be saved as the last-known-good boot configuration
              Lock------------Locks the Service Database
              QueryLock-------Queries the LockStatus for the SCManager Database
    EXAMPLE:
            sc start MyService

    Would you like to see help for the QUERY and QUERYEX commands? [ y | n ]:


    C:\Windows\system32>SC QUERYEX RPCSS

    SERVICE_NAME: RPCSS
            TYPE               : 20  WIN32_SHARE_PROCESS
            STATE              : 4  RUNNING
                                    (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
            WIN32_EXIT_CODE    : 0  (0x0)
            SERVICE_EXIT_CODE  : 0  (0x0)
            CHECKPOINT         : 0x0
            WAIT_HINT          : 0x0
            PID                : 908
            FLAGS              :


    Monday, October 8, 2012 12:04 AM
  • (I really should go to be earlier!) that error was my fault - Sorry!.

    All that looks normal.

    I've been reminded elsewhere that the Event logging system, and WIndows Firewall also has a part to play, and can prevent a number of services from starting if it's broken -

    Please run the following commands, and post the results.

    NET START EVENTLOG

    NET START MPSSVC

    NET START WECSVC


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Monday, October 8, 2012 11:49 AM
    Moderator
  • Thanks for your effort.

    C:\Windows\system32>NET START EVENTLOG
    The requested service has already been started.

    More help is available by typing NET HELPMSG 2182.

    C:\Windows\system32>NET START MPSSVC
    The requested service has already been started.

    More help is available by typing NET HELPMSG 2182.

    C:\Windows\system32>NET START WECSVC
    The Windows Event Collector service is starting.
    The Windows Event Collector service was started successfully.

    Tuesday, October 9, 2012 1:01 AM
  • Scratch one bright idea, then ! :(

    Back later with more - I hope!


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Tuesday, October 9, 2012 7:08 AM
    Moderator
  • Thanks for your effort.
    Thursday, October 11, 2012 12:23 AM
  • Sorry - it's been mad/crazy round here this week!

    I'll try and get back to you tomorrow - it;s 01:40 now :(


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Thursday, October 11, 2012 12:39 AM
    Moderator
  • Please upload your Application and System event logs - with any luck there's be some clues in there.

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Monday, October 15, 2012 8:48 PM
    Moderator
  • Anything new?

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

    Friday, October 26, 2012 11:21 AM
    Moderator