Answered by:
Vista Business boots to black screen. Should be valid install, but fails Genuine Advantage

Question
-
Here's the results from MS validation tool. Here it says the install is valid, but elsewhere it is flagged as invalid, and system will only boot in safe mode, where I cannot get Net Start slsvc to complete. (Terminates with error code 5)
System is HP Pavilion DV8000 2GB RAM, and belongs to Krissy, who has Multiple Sclerosis. I am trying to repair it for her.
~Teknical
Diagnostic Report (1.9.0019.0):
-----------------------------------------
WGA Data-->
Validation Status: Genuine
Validation Code: 0Cached Validation Code: N/A, hr = 0x80070426
Windows Product Key: *****-*****-QQV8R-D4B3M-B4XJD
Windows Product Key Hash: Sm+WVMygw6jfXdjLV/zSi9Jb8NA=
Windows Product ID: 89576-009-4430037-71982
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.0.6001.2.00010100.1.0.006
ID: {112323AD-E3CC-4D2C-9BA2-3ADE7687C521}(3)
Is Admin: Yes
TestCab: 0x0
WGA Version: Registered, 1.9.42.0
Signed By: Microsoft
Product Name: Windows Vista (TM) Business
Architecture: 0x00000000
Build lab: 6001.vistasp1_gdr.090805-0102
TTS Error:
Validation Diagnostic:
Resolution Status: N/AWgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: 6.0.6002.16398WGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002OGA Data-->
Office Status: 100 Genuine
Microsoft Office Home and Student 2007 - 100 Genuine
OGA Version: Registered, 1.6.28.0
Signed By: Microsoft
Office Diagnostics: 7E90FEE8-169-80004005_B4D0AA8B-587-80004005_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: AllowedFile Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{112323AD-E3CC-4D2C-9BA2-3ADE7687C521}</UGUID><Version>1.9.0019.0</Version><OS>6.0.6001.2.00010100.1.0.006</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-B4XJD</PKey><PID>89576-009-4430037-71982</PID><PIDType>5</PIDType><SID>S-1-5-21-2704658591-649223200-2153676684</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>Pavilion dv8000 (EE298AV) </Model></SYSTEM><BIOS><Manufacturer>Hewlett-Packard</Manufacturer><Version>F.22</Version><SMBIOSVersion major="2" minor="31"/><Date>20051107000000.000000+000</Date></BIOS><HWID>FE323507018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>3A7479AB449370E</Val><Hash>CkiR2jFC2rJn6J0dBZL3+pd+zbo=</Hash><Pid>81602-903-3120071-68539</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>Spsys.log Content: 0x80070002
Licensing Data-->
Software Licensing service is not running.Windows Activation Technologies-->
N/AHWID Data-->
HWID Hash Current: MAAAAAEAAgABAAEAAQAAAAAAAwABAAEAJJRcPvyNEhJePz5Djqjy9Dw+QtusVrTLOEM Activation 1.0 Data-->
N/AOEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC PTLTD APIC
FACP HP Piranha
MCFG PTLTD MCFG
SSDT PTLTD POWERNOWThursday, February 25, 2010 2:22 AM
Answers
-
Hello Teknical,
The problem is that your Vista's Software Licensing Service has stopped. Vista uses this service to check itself and confirm it is Genuine. When the service is stopped, Vista is unable to confirm it's own Genuine status and may show Genuine or Non-Genuine. The fact that the Service has stopped is also, most likely, the cause of other issues you may be experiencing (such as not having access to the Control Panel).Normally this is not a big problem, since you can just restart the Service. However, we have seen a number of users that receive an error when they attempt to restart the Service. This indicates a more serious 'root cause' to the service having stopped.
What I would like you to do is to try to restart the service using the 'Service Restart' steps, below. If the service won't restart, you will receive an error.
Service Restart steps:
(If you have access to the Start button):
1) Click the Start button
2) Type: cmd in the Start Search field
3) At the top the Start window, you will see cmd.exe
4) Right Click cmd.exe and select Run as Administrator
5) Type: net start slsvc
(If you do not have access to the Start button):
1) Click the option that launches an Internet Browser
2) A Browser will open, type: %windir%\system32 into the address field
3) Find the file cmd.exe
4) Right Click on the cmd.exe and select Run as Administrator
5) Type: net start slsvc
A) If the error message is "System Error 3, The system cannot find the path specified." or "System Error 2, The system cannot find the file specified": Go to the main Vista Validation forum page http://social.microsoft.com/Forums/en-US/genuinevista/threads/, look in the announcement section and follow the steps found in thread "Fix for ‘Software Licensing service Has Stopped’ on some Vista 64bit systems"
B) If you receive any other error (System Error 5, System Error 57346 or System Error 54273): These occur as a result of massive file corruption. We do not know what the root cause of the corruption is and this can be caused by any situation where files could be corrupted. However, from troubleshooting others that had this issue, the likeliest causes are either Malware Infection or failing Hard Drive.
It may be possible to repair the damage by trying one or both the below set of steps:
Repairing Windows using System Restore:1) Reboot Vista into Safe Mode
2) Click the ‘Start’ button
3) In the Start Search field, type: System Restore and hit “Enter” keyboard key
4) Select "Choose Different Restore Point", Put a check in the box that says "Show restore points older than 5 days", select the restore point that corresponds to the date Before you first noticed the issue.
5) Click the "Next" button.
6) Reboot back into Normal mode
7) Vista should no longer be in Reduced Functionality mode
System Scan. The scan will look for bad Vista files and will attempt to repair them, if possible.
1) Login to Vista in Normal Mode (not safe mode)
2) Launch an Internet Browser
3) Type: %windir%\system32\ in the browser's address field
4) Scroll down till you find the file cmd.exe
5) Right-click the file and select 'Run as Administrator'
6) In the CMD window, type: sfc /scannow
7) Reboot twice and see if that resolves the issue.If neither of these sets of steps resolves the issue, my only other suggestions would be either to contact Vista support at http://support.microsoft.com or reinstall Vista.
C) If you receive no System Error and the Service start but then stops almost immediately: Something is apparently activity stopping the service. Most likely caused by some other dependent Windows Service or possibly a Malware infection. While the Software Licensing Service, itself, is part of the Anti-piracy sub-system, the running (and stopping) of Windows Services is a Vista core system that I have no insight to and is supported by Vista support at http://support.microsoft.com
Thank you,
Darin MS
- Marked as answer by Darin Smith MS Thursday, February 25, 2010 8:35 PM
Thursday, February 25, 2010 8:34 PM
All replies
-
Hello Teknical,
The problem is that your Vista's Software Licensing Service has stopped. Vista uses this service to check itself and confirm it is Genuine. When the service is stopped, Vista is unable to confirm it's own Genuine status and may show Genuine or Non-Genuine. The fact that the Service has stopped is also, most likely, the cause of other issues you may be experiencing (such as not having access to the Control Panel).Normally this is not a big problem, since you can just restart the Service. However, we have seen a number of users that receive an error when they attempt to restart the Service. This indicates a more serious 'root cause' to the service having stopped.
What I would like you to do is to try to restart the service using the 'Service Restart' steps, below. If the service won't restart, you will receive an error.
Service Restart steps:
(If you have access to the Start button):
1) Click the Start button
2) Type: cmd in the Start Search field
3) At the top the Start window, you will see cmd.exe
4) Right Click cmd.exe and select Run as Administrator
5) Type: net start slsvc
(If you do not have access to the Start button):
1) Click the option that launches an Internet Browser
2) A Browser will open, type: %windir%\system32 into the address field
3) Find the file cmd.exe
4) Right Click on the cmd.exe and select Run as Administrator
5) Type: net start slsvc
A) If the error message is "System Error 3, The system cannot find the path specified." or "System Error 2, The system cannot find the file specified": Go to the main Vista Validation forum page http://social.microsoft.com/Forums/en-US/genuinevista/threads/, look in the announcement section and follow the steps found in thread "Fix for ‘Software Licensing service Has Stopped’ on some Vista 64bit systems"
B) If you receive any other error (System Error 5, System Error 57346 or System Error 54273): These occur as a result of massive file corruption. We do not know what the root cause of the corruption is and this can be caused by any situation where files could be corrupted. However, from troubleshooting others that had this issue, the likeliest causes are either Malware Infection or failing Hard Drive.
It may be possible to repair the damage by trying one or both the below set of steps:
Repairing Windows using System Restore:1) Reboot Vista into Safe Mode
2) Click the ‘Start’ button
3) In the Start Search field, type: System Restore and hit “Enter” keyboard key
4) Select "Choose Different Restore Point", Put a check in the box that says "Show restore points older than 5 days", select the restore point that corresponds to the date Before you first noticed the issue.
5) Click the "Next" button.
6) Reboot back into Normal mode
7) Vista should no longer be in Reduced Functionality mode
System Scan. The scan will look for bad Vista files and will attempt to repair them, if possible.
1) Login to Vista in Normal Mode (not safe mode)
2) Launch an Internet Browser
3) Type: %windir%\system32\ in the browser's address field
4) Scroll down till you find the file cmd.exe
5) Right-click the file and select 'Run as Administrator'
6) In the CMD window, type: sfc /scannow
7) Reboot twice and see if that resolves the issue.If neither of these sets of steps resolves the issue, my only other suggestions would be either to contact Vista support at http://support.microsoft.com or reinstall Vista.
C) If you receive no System Error and the Service start but then stops almost immediately: Something is apparently activity stopping the service. Most likely caused by some other dependent Windows Service or possibly a Malware infection. While the Software Licensing Service, itself, is part of the Anti-piracy sub-system, the running (and stopping) of Windows Services is a Vista core system that I have no insight to and is supported by Vista support at http://support.microsoft.com
Thank you,
Darin MS
- Marked as answer by Darin Smith MS Thursday, February 25, 2010 8:35 PM
Thursday, February 25, 2010 8:34 PM -
Thanks for the reply, Darin. I will try to follow your suggestions on Monday, when I next have access to the machine. I had tried net start slsvc from the command prompt in Safe Mode, and also by running cmd.exe from the Task Manager under 'reduced functionality' mode, but it failed with System Error 5. I may not have had Administrator privileges, however. I will try again. The system scan may have promise, as well.
If any malware activity was involved there doesn't appear to be any sign of it now. The user isn't very tech-savvy, but also hasn't done alot with the machine. It had Windows Defender installed. I installed and ran Malwarebytes anti-malware latest version with latest update and came up clean. Microsoft's latest mrt also found nothing. HP's BIOS HD test found no errors in two passes.
The machine hasn't worked properly for months, so the posited malware shouldn't be brand new. There are no Restore Points and I'm not sure why, as the user seems unlikely to have changed from default settings.
I'm wondering if some one of the OneClick software services that are running might have prevented updates from happening, which may have led to the OS concluding there was a security breach. I saw OneClick, OneClick Firewall, and at least one other OneClick service running.
I'll post again if I find anything out.
Regards,
TeknicalFriday, February 26, 2010 3:57 AM -
Hi Teknical,
This concerns me. Since Windows makes restore point for most update installes and some software installs (and for other events that I can't think of right now) there should be a ton of restore points available. I work down the hall from the program managers that work in the Microsoft Security Essentials and PC Safety groups and I've heard them talking about some famalies of Malware that will first attack the System Restore section of Windows and delete restore points. as I understand it, they do this as self protection from being removed or otherwise affected by a system restore.
The machine hasn't worked properly for months, so the posited malware shouldn't be brand new. There are no Restore Points and I'm not sure why, as the user seems unlikely to have changed from default settings.
Currently the security breach (i.e. Non-Genuine event) is being caused by the Software Licensing Service not running. I can't think of any Updates (or lack of an Update) that would stop the service from running. I don't know anything about the OneClick service that you refer to, but it's possible that it could be suppressing the Software Licensing Service (or something the software Licensing Service is dependent on) from running.
I'm wondering if some one of the OneClick software services that are running might have prevented updates from happening, which may have led to the OS concluding there was a security breach. I saw OneClick, OneClick Firewall, and at least one other OneClick service running.
Thank you,
Darin MSFriday, February 26, 2010 9:26 PM -
I made a mistake in a previous report. The security services that I thought might be implicated were OneCare Live services for firewall, antivirus, etc. There are a bunch of event logs of errors like this:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-2704658591-649223200-2153676684-1000:
Process 2104 (\Device\HarddiskVolume1\Program Files\Microsoft Windows OneCare Live\winss.exe) has opened key \REGISTRY\USER\S-1-5-21-2704658591-649223200-2153676684-1000\Software\Microsoft\Internet Explorer\PhishingFilter
My online reading suggested that version 5.0 and less of OneCare had an incompatibility with SP 2. I am thinking of un-installing these OneCare programs, as I am still unable to restart the software licensing service.
I was able to run sfc /scannow
It completed without error. I also ran the long test from Drive Fitness Test, and the Hard drive appears to be in good health, with no S.M.A.R.T. problems, no bad blocks, etc. I still can't find anything other than the OneCare hypothesis to explain these difficulties.
When I was running virus scans I saw a lot of restore points, but System Restore says no restore points have been created on the system disk. So far, the user and her sister (the previous owner) have been unable to find any of the install or system CDs for this machine.
If they are unable to keep running Vista from the present installation they will need another OS install CD, and I doubt they will want to purchase Vista again. I could upgrade them to XP, but am wondering if they would be better off purchasing Windows 7. Can a locked-out vista machine be upgraded to Windows 7, or would a total re-install be required? Could they use an Upgrade version, or would only the full version work? I am not trying to evade any licensing requirements, just trying to help out without it costing much.
Thanks again,
~TeknicalTuesday, March 2, 2010 2:58 AM -
Here's a better log entry:
C:\Program Files\Microsoft Windows OneCare Live\Database\WinSS_st.edb (2460) C:\Program Files\Microsoft Windows OneCare Live\Database\WinSS_st.edb: A request to write to the file "C:\Program Files\Microsoft Windows OneCare Live\Database\WinSS_st.edb" at offset 8200192 (0x00000000007d2000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (10294 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.Tuesday, March 2, 2010 3:03 AM -
Log Name: Application
Source: gusvc
Date: 10/17/2008 4:52:07 PM
Event ID: 0
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: kacmarcik
Description:
The description for Event ID 0 from source gusvc cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event:
Service stopped
______________________________________________________________________________
The COM+ Event System could not remove the EventSystem.EventSubscription object {CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. The HRESULT was 80070005.
_______________________________________________________________________________
Tuesday, March 2, 2010 3:34 AM -
The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043c from line 45 of d:\vistasp1_gdr\com\complus\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.Tuesday, March 2, 2010 3:34 AM