locked
Windows 7 Build 7600 suddenly became not genuine RRS feed

  • Question

  • Hello,

    I have an Acer Aspire 4810TG laptop that came with Windows 7 Home Premium. I bought the laptop earlier this year from a local computer shop. It was activated and working fine, but it suddenly said that my copy is not genunine.

    I have tried to change the key to the one on the COA sticker, but I received error message when running the slmgr.vbs -ipk my_key command. I also tried to run slui.exe, slui.exe 2 and slui.exe 4, but also receiving error message. I tried running slui.exe 3 command, and I was able to enter the key on COA sticker. However, the process failed when it's trying to validate. I got error code 0x80070424 for all these things I tried.

    I tried enable the SPP Notification Service, but it also failed. It started and then stopped right away.

    I have been searching online for a while, but I couldn't figure out how to fix this. Thank you so much for your help!

    Here is the result from the MGA Diagnostic Tool:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: N/A, hr = 0x80070424
    Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
    Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
    Windows Product ID: 00359-OEM-8992687-00006
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7600.2.00010300.0.0.003
    ID: {FC1944FC-3261-4495-9778-0468E5E6A279}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Home Premium
    Architecture: 0x00000009
    Build lab: 7600.win7_gdr.100618-1621
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 114 Blocked VLK 2
    Microsoft Office Professional Edition 2003 - 114 Blocked VLK 2
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Internet Explorer\iexplore.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{FC1944FC-3261-4495-9778-0468E5E6A279}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7600.2.00010300.0.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-3310106110-4253597822-3047120758</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire 4810T</Model></SYSTEM><BIOS><Manufacturer>INSYDE</Manufacturer><Version>V1.31</Version><SMBIOSVersion major="2" minor="6"/><Date>20091016000000.000000+000</Date></BIOS><HWID>C8B93607018400F8</HWID><UserLCID>0404</UserLCID><SystemLCID>0404</SystemLCID><TimeZone>太平洋標準時間(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>114</Result><Products><Product GUID="{90110404-6000-11D3-8CFE-0150048383C9}"><LegitResult>114</LegitResult><Name>Microsoft Office Professional Edition 2003</Name><Ver>11</Ver><Val>59D1605114E3500</Val><Hash>vfZmaSmFPIYrLWTcZSZErUQg+Fo=</Hash><Pid>73944-640-0000106-57498</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="11" Result="114"/><App Id="16" Version="11" Result="114"/><App Id="18" Version="11" Result="114"/><App Id="19" Version="11" Result="114"/><App Id="1A" Version="11" Result="114"/><App Id="1B" Version="11" Result="114"/><App Id="44" Version="11" Result="114"/></Applications></Office></Software></GenuineResults> 

    Spsys.log Content: 0x80070002

    Licensing Data-->
    在執行 Microsoft Windows (非核心) 版本的電腦上,執行 'slui.exe 0x2a 0x80070424' 以顯示錯誤文字。
    錯誤: 0x80070424

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0001000000000000
    Event Time Stamp: 12:30:2010 11:50
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered Service: sppsvc


    HWID Data-->
    HWID Hash Current: MAAAAAEAAQABAAIAAAACAAAAAgABAAEAJJRoLmrrNCFQPuS2XKSaiFp9NJMMcEbK

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x20001
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            ACER          ACER   
      FACP            ACRSYS        ACRPRDCT
      HPET            ACER          ACER   
      BOOT            ACER          ACER   
      MCFG            ACER          ACER   
      DMAR                          
      ASF!            ACER          ACER   
      SLIC            ACRSYS        ACRPRDCT
      SSDT            ACER          ACER   
      SSDT            ACER          ACER   

    -----------------------------------------------------------

    Thanks!

    Betty

    Thursday, December 30, 2010 8:37 PM

Answers

  • Hello b803891214,

     

    Here is what I have regarding Tampered Services:

    CAVEAT: I have Not seen a large number of Tampered Services with Windows 7 so I still have a limited understanding of then.  I believe it's the same as an issue seen in Vista but just with a different name, however, I have not yet been able to confirm that. The below description of a Tampered Service is based on my experience with that similar/same issue in Vista.

    Background info: There are system files that when they are Run they spawn a Service (usually with the same name as the file that spawned it). In your case, the services sppsvc is a Services being modified in system memory, but the file sppsvc.exe is not modified since this file is not listed as a Tampered File.

      A Tampered Service is when a Service which is running is system memory is activly being shimmed or hooked into (Modified) in an unsupported way. This is an Active tamper meaning the tamper can only occure while something is making it occure. That 'something' is another program.  That program could be a legitimate program that happens to be doing something in a way that Windows 7 does not allow. Or it could be Malware.

     The resolution for this issue tends to be difficult because a) it involves you tracking down the offending program and b) there is very little I can do to help (none of my tools can tell what program is causing the tamper). 

     A few hints and suggestions I can provide: Run Anti-virus scans. Preferably multple times using different software.  Think back to when the issue first started, did you install any software within three day before the issue occured? Do you have any freeware/sharware software that may not be of the highest quality? Confirm all your software is Windows 7 compatible and/or has been upgraded to a compatible version. and so on.

     

    Lastly, I also suggest trying the below steps.  The steps have been known to resolve a Tampered File, but I am just not unsure if they will as effective for a Tampered Service. The steps will not make the issue any worse. 

    a. System Scan. The scan will look for bad Windows files and will attempt to repair them, if possible.

    1) Click the Start Button
    2) Type: cmd.exe
    3) Right-click the cmd.exe file and select 'Run as Administrator'
    4) In the CMD window, type: sfc /scannow
    5) Reboot and see if that resolves the issue.


    b. Repairing Windows using System Restore:

    1) Click the Start button
    2) In the Start Search field, type: System Restore and hit “Enter”
    3) Select "Choose Different Restore Point", Put a check in the box that says "Show restore points older than 5 days", select the restore point that corresponds to the date Before you first noticed the issue.
    4) Click the "Next" button.
    5) Reboot and see if that resolves the issue.


    If you were unable to resolve the issue using the suggestions I provided above and if neither of these sets of steps resolves the issue, my only other suggestions would be either to create a (no cost) support request at http://support.microsoft.com/gp/contactwga or reinstall Windows.

     

    Thank you,


    Darin MS
    • Marked as answer by Darin Smith MS Friday, December 31, 2010 1:22 AM
    Friday, December 31, 2010 1:21 AM

All replies

  • "b803891214" wrote in message news:9f1d0de1-8002-4d6a-b5ea-4ec8d035ddec...

    Hello,

    I have an Acer Aspire 4810TG laptop that came with Windows 7 Home Premium. I bought the laptop earlier this year from a local computer shop. It was activated and working fine, but it suddenly said that my copy is not genunine.

    I have tried to change the key to the one on the COA sticker, but I received error message when running the slmgr.vbs -ipk my_key command. I also tried to run slui.exe, slui.exe 2 and slui.exe 4, but also receiving error message. I tried running slui.exe 3 command, and I was able to enter the key on COA sticker. However, the process failed when it's trying to validate. I got error code 0x80070424 for all these things I tried.

    I tried enable the SPP Notification Service, but it also failed. It started and then stopped right away.

    I have been searching online for a while, but I couldn't figure out how to fix this. Thank you so much for your help!

    Here is the result from the MGA Diagnostic Tool:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE21
    Cached Online Validation Code: N/A, hr = 0x80070424
    Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
    Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
    Windows Product ID: 00359-OEM-8992687-00006
    Windows Product ID Type: 2
    Windows License Type: OEM SLP
    Windows OS version: 6.1.7600.2.00010300.0.0.003

    OGA Data-->
    Office Status: 114 Blocked VLK 2
    Microsoft Office Professional Edition 2003 - 114 Blocked VLK 2
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Licensing Data-->
    在執行 Microsoft Windows (非核心) 版本的電腦上,執行 'slui.exe 0x2a 0x80070424' 以顯示錯誤文字。
    錯誤: 0x80070424
    Betty


    I'm not sure what the problem is with your Windows - it's an error I've never seen before - but your installation of Office is definitely non-genuine, as the Key you are using used to be issued within MS itself until it was released to the internet and blocked.
    If this copy of Office was pre-installed, then you can assume that the copy of Windows has also been counterfeited in some fashion.
     
    If it was my machine, I'd be looking at a complete reformat/reinstall from the manufacturer's recovery disks, at the very least.

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Thursday, December 30, 2010 11:16 PM
    Moderator
  • Hi Noel,

     

      Don't let the language the error is write in throw you, the bolded section (below) tells us what the issue is:

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0001000000000000
    Event Time Stamp: 12:30:2010 11:50
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered Service: sppsvc

     

    HrOffline: 0x8004FE21 means "Selfheal failure" so we know there is a file or service that has been modified (tampered) and Windows was unable to repair it. 

    Tampered Service: sppsvc means it is a Service that was modified (tampered) and the service is the sppsvc.


    Darin MS
    Friday, December 31, 2010 1:07 AM
  • Hello b803891214,

     

    Here is what I have regarding Tampered Services:

    CAVEAT: I have Not seen a large number of Tampered Services with Windows 7 so I still have a limited understanding of then.  I believe it's the same as an issue seen in Vista but just with a different name, however, I have not yet been able to confirm that. The below description of a Tampered Service is based on my experience with that similar/same issue in Vista.

    Background info: There are system files that when they are Run they spawn a Service (usually with the same name as the file that spawned it). In your case, the services sppsvc is a Services being modified in system memory, but the file sppsvc.exe is not modified since this file is not listed as a Tampered File.

      A Tampered Service is when a Service which is running is system memory is activly being shimmed or hooked into (Modified) in an unsupported way. This is an Active tamper meaning the tamper can only occure while something is making it occure. That 'something' is another program.  That program could be a legitimate program that happens to be doing something in a way that Windows 7 does not allow. Or it could be Malware.

     The resolution for this issue tends to be difficult because a) it involves you tracking down the offending program and b) there is very little I can do to help (none of my tools can tell what program is causing the tamper). 

     A few hints and suggestions I can provide: Run Anti-virus scans. Preferably multple times using different software.  Think back to when the issue first started, did you install any software within three day before the issue occured? Do you have any freeware/sharware software that may not be of the highest quality? Confirm all your software is Windows 7 compatible and/or has been upgraded to a compatible version. and so on.

     

    Lastly, I also suggest trying the below steps.  The steps have been known to resolve a Tampered File, but I am just not unsure if they will as effective for a Tampered Service. The steps will not make the issue any worse. 

    a. System Scan. The scan will look for bad Windows files and will attempt to repair them, if possible.

    1) Click the Start Button
    2) Type: cmd.exe
    3) Right-click the cmd.exe file and select 'Run as Administrator'
    4) In the CMD window, type: sfc /scannow
    5) Reboot and see if that resolves the issue.


    b. Repairing Windows using System Restore:

    1) Click the Start button
    2) In the Start Search field, type: System Restore and hit “Enter”
    3) Select "Choose Different Restore Point", Put a check in the box that says "Show restore points older than 5 days", select the restore point that corresponds to the date Before you first noticed the issue.
    4) Click the "Next" button.
    5) Reboot and see if that resolves the issue.


    If you were unable to resolve the issue using the suggestions I provided above and if neither of these sets of steps resolves the issue, my only other suggestions would be either to create a (no cost) support request at http://support.microsoft.com/gp/contactwga or reinstall Windows.

     

    Thank you,


    Darin MS
    • Marked as answer by Darin Smith MS Friday, December 31, 2010 1:22 AM
    Friday, December 31, 2010 1:21 AM
  • "Darin Smith MS" wrote in message news:2db81e03-d211-4c09-b4a9-1578fb54906a...

    Hi Noel,

     

      Don't let the language the error is write in throw you, the bolded section (below) tells us what the issue is:

    Windows Activation Technologies-->
    HrOffline: 0x8004FE21
    HrOnline: N/A
    HealthStatus: 0x0001000000000000
    Event Time Stamp: 12:30:2010 11:50
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered Service: sppsvc

     

    HrOffline: 0x8004FE21 means "Selfheal failure" so we know there is a file or service that has been modified (tampered) and Windows was unable to repair it. 

    Tampered Service: sppsvc means it is a Service that was modified (tampered) and the service is the sppsvc.


    Darin MS

    Thanks for that Darin - it was late :)
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Friday, December 31, 2010 8:59 AM
    Moderator
  • Hello Everyone,

    Thank you so much for your help! I apologize for this late reply. I did not set up my email properly, and I kept waiting for notifications in my inbox.

    Thanks Darin! I will try the steps you suggested. :D

     

    Happy New Year~

    Betty

    Monday, January 3, 2011 4:23 PM
  • I have a similar problem and wonder whether Microsoft recently implemented some kind of buggy validation upgrade. Last year I preordered an upgrade version of Win7 Pro for my XP machine, picked it up and duly installed it (on a new HDD) when I had time. I liked it so much that it became my desktop PC and my Vista PC became relegated to my media center.

    However, the Win7 machine became cranky around Thanksgiving of this year and while scans using MSSE, Spybot and Malwarebytes, among others, showed no problems, I was getting hangs and even a BSOD or 2, so I picked up a new HDD on Black Friday. Perhaps my trying out several video cards led to the degradation of some system files, or a year's use picked up junk even though I'm diligent about my antivirus software, installing patches, etc.

    I did a clean install of the Win7 on the new HDD, but didn't have time to transfer files and programs, so I just disconnected it and continued using the somewhat buggy drive that now seemed to be behaving better. Maybe the Nov/Dec patches fixed the problem. Then after Christmas it acted up again. I noticed that the older HDD's performance index rating varied day by day. So I figured I should take the time to finish the file/program transfer. On Dec. 30 I discovered 30 days had passed since the install, so I had to retype the product key, after which everything seemed OK.

    Then on New year's Day I got the possible pirate copy notification in the bottom right hand corner after I added my Xbox360 as an extender. The pirate notice went away after I updated MSSE and ran the genuine validation tool again. And yesterday I transferred my music, pictures and documents to the new drive, as well as added on security updates to the Firefox browser I use. This morning, I got the pirate notification again. Once again updating MSSE cleared it up. Searching the Knowledge Base produced a linked article about Vista sometimes requiring annual reactivation, which is annoying but not too serious. However, I'm also worried that somehow I got some malware onto this new drive. The only nonMicrosoft programs thus far installed are Firefox, Foxit, Adobe's Shockwave and Flash, and NeatWorks (a financial and OCR program). I didn't want to use System Restore lest I restore a problem.

    I planned to finish the program installation today with Quicken, Secunia PSI, Spybot and Malwarebytes, among others, but this on-again, off-again piracy notification has me worried. Plus, today's link produced instructions seemingly on Microsoft.com (and accessible only using IE) instructing me to reset my privacy controls from high to no/low as a condition for running the validation tool. I've seen the IE requirement before and the acceptance of a specific Microsoft Active-X control for running update, but I've never seen that privacy downgrade requirement before, and it seems either crazy or scary.

    Finishing the program installs will take significant time and trouble, which will be wasted if I've already messed up the new drive somehow (in Microsoft's eyes at least) by downloading the latest versions of these common programs from what seem the company websites. I didn't see checksums there, but am I required to checksum every download? Or is Microsoft requiring me to give up my online privacy to everybody as the cost of not getting that piracy notification? Frankly, both seem crazy. Most users probably don't even know what a checksum is. [BTW, I was annoyed that Foxit installed its Ask.com toolbar despite my choosing AGAINST it both times during the installation routine, but its PDF viewer is a lot more efficient than Adobe's so I'm just uninstalling the toolbar as I did before.] And, yes, I've restored my privacy settings to HIGH.

    Jane.

    Monday, January 3, 2011 6:34 PM
  • "jweaver28" wrote in message news:64d0bd3a-2e47-4b39-808a-a9d9c99e7197...

    I have a similar problem and wonder whether Microsoft recently implemented some kind of buggy validation upgrade. Last year I preordered an upgrade version of Win7 Pro for my XP machine, picked it up and duly installed it (on a new HDD) when I had time. I liked it so much that it became my desktop PC and my Vista PC became relegated to my media center.

    However, the Win7 machine became cranky around Thanksgiving of this year and while scans using MSSE, Spybot and Malwarebytes, among others, showed no problems, I was getting hangs and even a BSOD or 2, so I picked up a new HDD on Black Friday. Perhaps my trying out several video cards led to the degradation of some system files, or a year's use picked up junk even though I'm diligent about my antivirus software, installing patches, etc.

    I did a clean install of the Win7 on the new HDD, but didn't have time to transfer files and programs, so I just disconnected it and continued using the somewhat buggy drive that now seemed to be behaving better. Maybe the Nov/Dec patches fixed the problem. Then after Christmas it acted up again. I noticed that the older HDD's performance index rating varied day by day. So I figured I should take the time to finish the file/program transfer. On Dec. 30 I discovered 30 days had passed since the install, so I had to retype the product key, after which everything seemed OK.

    Then on New year's Day I got the possible pirate copy notification in the bottom right hand corner after I added my Xbox360 as an extender. The pirate notice went away after I updated MSSE and ran the genuine validation tool again. And yesterday I transferred my music, pictures and documents to the new drive, as well as added on security updates to the Firefox browser I use. This morning, I got the pirate notification again. Once again updating MSSE cleared it up. Searching the Knowledge Base produced a linked article about Vista sometimes requiring annual reactivation, which is annoying but not too serious. However, I'm also worried that somehow I got some malware onto this new drive. The only nonMicrosoft programs thus far installed are Firefox, Foxit, Adobe's Shockwave and Flash, and NeatWorks (a financial and OCR program). I didn't want to use System Restore lest I restore a problem.

    I planned to finish the program installation today with Quicken, Secunia PSI, Spybot and Malwarebytes, among others, but this on-again, off-again piracy notification has me worried. Plus, today's link produced instructions seemingly on Microsoft.com (and accessible only using IE) instructing me to reset my privacy controls from high to no/low as a condition for running the validation tool. I've seen the IE requirement before and the acceptance of a specific Microsoft Active-X control for running update, but I've never seen that privacy downgrade requirement before, and it seems either crazy or scary.

    Finishing the program installs will take significant time and trouble, which will be wasted if I've already messed up the new drive somehow (in Microsoft's eyes at least) by downloading the latest versions of these common programs from what seem the company websites. I didn't see checksums there, but am I required to checksum every download? Or is Microsoft requiring me to give up my online privacy to everybody as the cost of not getting that piracy notification? Frankly, both seem crazy. Most users probably don't even know what a checksum is. [BTW, I was annoyed that Foxit installed its Ask.com toolbar despite my choosing AGAINST it both times during the installation routine, but its PDF viewer is a lot more efficient than Adobe's so I'm just uninstalling the toolbar as I did before.] And, yes, I've restored my privacy settings to HIGH.

    Jane.


    PLEASE repost your own problem in your OWN, NEW thread - together with an MGADiag report.
    There are many reasons for getting a non-genuine flag - not all are related to purchasing counterfeit software, and not all are related to software problems.
    Without the full report, it is impossible to differentiate between the two.
    To properly analyse and solve problems with Activation and Validation, we need to see a full copy of the report produced by the MGADiag tool (download and save to desktop - http://go.microsoft.com/fwlink/?linkid=52012 )
    Once saved, run the tool.
    Click on the Continue button, which will produce the report.
    To copy the report to your response, click on the Copy button in the tool (ignore any error messages at this point), and then paste (using either r-click/Paste, or Ctrl+V ) into your response.
     

    --


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Monday, January 3, 2011 9:51 PM
    Moderator