locked
Not real windows? RRS feed

  • Question

  • Hi!

    Few days ago, I had a BSOD happening on my computer. After that I could not open Firefox or any webbrowser. I dont know why, but what i did was downloading the installer for firefox on another computer, so i kind of fixed it. But now yesterday, I suddenly got the massage that I'm not running a real example of Windows?

    I've got my windows 7 Professional for about 2 years now, and I got the real example in my hands, so what should I do?

    - Daniel

    Wednesday, March 12, 2014 10:15 AM

Answers

  • You have a tampered file - we have to find out which file, and whether it's the only one...

    Please run a full CHKDSK and SFC scan....

    Click on Start > All Programs > Accessories

    Right-click on the Command Prompt entry

    Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

    At the Command prompt, type

    CHKDSK C: /R

    and hit the Enter key.

    You will be told that the drive is locked,

    and the CHKDSK will run at he next boot - hit the Y key, press Enter, and then reboot.

    The CHKDSK will take a few hours depending on the size of the drive, so be patient!

    After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -

    then run the SFC.

    SFC -System File Checker - Instructions

    Click on Start > All Programs > Accessories

    Right-click on the Command Prompt entry

    Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

    At the Command prompt, type

    SFC /SCANNOW

    and hit the Enter key

    Wait for the scan to finish - make a note of any error messages - and then reboot.

    Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your OneDrive Public folder (http://onedrive.live.com ) and post a link to it so that I can take a look.

    Post a new MGADiag report with details of any error messages encountered.


    Noel Paton | Nil Carborundum Illegitemi
    CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Thursday, March 13, 2014 4:25 PM
    Moderator

All replies

  • MGA Diagnostic Report:

    To properly analyze and solve problems with Activation and Validation, we need to see a full copy of the diagnostic report produced by the MGADiag tool (download and save to desktop -http://go.microsoft.com/fwlink/?linkid=52012 )

    Once downloaded, run the tool.
    Click on the Continue button, after a short time, the Continue button will change to a Copy button.
    Click on the Copy button in the tool (ignore any error messages at this point), and then paste (using either r-click/Paste, or Ctrl+V ) into your post.

    One Issue Per Thread:

    Most Activation and Validation issues look the same, on the surface, but can have many different causes and fixes. This is why we ask for a diagnostic report and this is also why we ask that you create your own thread for your issue (in other words, don't post your issue in another person's thread). 

    It just becomes too complicated to try to troubleshoot multiple different issues in the same thread.

    New to the Forums?

    Note that if you are new to these forums, you may find that you are unable to post due to a restriction on the inclusion of links and pictures.
    Simply delete the only lines that contain links -  this will allow the remainder of the report to upload (and those lines are not generally critical to the report anyhow)


    Please do not read this sentence. Please ignore the previous sentence.

    Wednesday, March 12, 2014 2:23 PM
  • Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0x8004FE22
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-2GRRV-2K3TY-TB73G
    Windows Product Key Hash: AsAanNZHusU8B6kAs4oP/d8opto=
    Windows Product ID: 00371-OEM-9044164-57495
    Windows Product ID Type: 3
    Windows License Type: OEM System Builder
    Windows OS version: 6.1.7601.2.00010100.1.0.048
    ID: {73E462C6-5842-46AD-996D-C07FBF9BBC97}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Professional
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.130828-1532
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{73E462C6-5842-46AD-996D-C07FBF9BBC97}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-TB73G</PKey><PID>00371-OEM-9044164-57495</PID><PIDType>3</PIDType><SID>S-1-5-21-1052943770-388846293-1500658631</SID><SYSTEM><Manufacturer>To be filled by O.E.M.</Manufacturer><Model>To be filled by O.E.M.</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>1301</Version><SMBIOSVersion major="2" minor="7"/><Date>20120312000000.000000+000</Date></BIOS><HWID>8BD73207018400FC</HWID><UserLCID>0414</UserLCID><SystemLCID>0414</SystemLCID><TimeZone>Vest-Europa (normaltid)(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Versjon av Software Licensing-tjeneste: 6.1.7601.17514

    Navn: Windows(R) 7, Professional edition
    Beskrivelse: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
    Aktiverings-ID: e120e868-3df2-464a-95a0-b52fa5ada4bf
    Program-ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Utvidet PID: 00371-00180-441-657495-02-1044-7600.0000-0582013
    Installasjons-ID: 009115926406548584648001847002715274190410458920333213
    URL-adresse til prosessorsertifikat: http://go.microsoft.com/fwlink/?LinkID=88338
    URL-adresse til maskinsertifikat: http://go.microsoft.com/fwlink/?LinkID=88339
    URL-adresse til brukslisens: http://go.microsoft.com/fwlink/?LinkID=88341
    URL-adresse til produktnøkkelsertifikat: http://go.microsoft.com/fwlink/?LinkID=88340
    Delvis produktnøkkel: TB73G
    Lisensstatus: Lisensiert
    Antall gjenværende Windows-rearmeringer: 4
    Klarert tid: 13.03.2014 11:12:22

    Windows Activation Technologies-->
    HrOffline: 0x8004FE22
    HrOnline: N/A
    HealthStatus: 0x0000000000000400
    Event Time Stamp: 3:12:2014 10:58
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
    Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui


    HWID Data-->
    HWID Hash Current: PAAAAAEABgABAAEAAAAEAAAAAgABAAEACrZWspBPFAHwNBAzVPJ0xGTHvmTKW6BAesMFZUXhUJLiR8hg

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes, but no SLIC table
    Windows marker version: N/A
    OEMID and OEMTableID Consistent: N/A
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            ALASKA        A M I
      FACP            ALASKA        A M I
      HPET            ALASKA        A M I
      MCFG            ALASKA        A M I
      SSDT            AMD           POWERNOW

    Thursday, March 13, 2014 10:12 AM
  • You have a tampered file - we have to find out which file, and whether it's the only one...

    Please run a full CHKDSK and SFC scan....

    Click on Start > All Programs > Accessories

    Right-click on the Command Prompt entry

    Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

    At the Command prompt, type

    CHKDSK C: /R

    and hit the Enter key.

    You will be told that the drive is locked,

    and the CHKDSK will run at he next boot - hit the Y key, press Enter, and then reboot.

    The CHKDSK will take a few hours depending on the size of the drive, so be patient!

    After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -

    then run the SFC.

    SFC -System File Checker - Instructions

    Click on Start > All Programs > Accessories

    Right-click on the Command Prompt entry

    Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

    At the Command prompt, type

    SFC /SCANNOW

    and hit the Enter key

    Wait for the scan to finish - make a note of any error messages - and then reboot.

    Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your OneDrive Public folder (http://onedrive.live.com ) and post a link to it so that I can take a look.

    Post a new MGADiag report with details of any error messages encountered.


    Noel Paton | Nil Carborundum Illegitemi
    CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Thursday, March 13, 2014 4:25 PM
    Moderator