locked
Retail bought Windows 7 is not genuine after 2 months RRS feed

  • Question

  • Hi

    I had recently upgraded from windows vista to windows 7. I had bought the Windows 7 Home Premium DVD pack in April from the same retail store ( Mediamarkt Kalmar Sweden) from where I had bought the laptop with pre installed windows vista. Since yesterday I have been receiving a message that my windows is not genuine. It had worked perfectly fine for last 2 months and suddenly this/ I am pasting my MGADiag copy. Please let me know such that I could ask the retailer.

    Diagnostic Report (1.9.0027.0):

    -----------------------------------------

    Windows Validation Data-->

     

    Validation Code: 0x8004FE21

    Cached Online Validation Code: N/A, hr = 0xc004f012

    Windows Product Key: *****-*****-TF39X-PYD9M-3BK62

    Windows Product Key Hash: BgSWrKdgoTzNwhd3pERm94BHfg8=

    Windows Product ID: 00359-032-2409992-85255

    Windows Product ID Type: 5

    Windows License Type: Retail

    Windows OS version: 6.1.7600.2.00010300.0.0.003

    ID: {0155114D-B942-4118-BD17-A687161A8499}(1)

    Is Admin: Yes

    TestCab: 0x0

    LegitcheckControl ActiveX: N/A, hr = 0x80070002

    Signed By: N/A, hr = 0x80070002

    Product Name: Windows 7 Home Premium

    Architecture: 0x00000000

    Build lab: 7600.win7_gdr.100226-1909

    TTS Error: 

    Validation Diagnostic: 

    Resolution Status: N/A

     

    Vista WgaER Data-->

    ThreatID(s): N/A, hr = 0x80070002

    Version: N/A, hr = 0x80070002

     

    Windows XP Notifications Data-->

    Cached Result: N/A, hr = 0x80070002

    File Exists: No

    Version: N/A, hr = 0x80070002

    WgaTray.exe Signed By: N/A, hr = 0x80070002

    WgaLogon.dll Signed By: N/A, hr = 0x80070002

     

    OGA Notifications Data-->

    Cached Result: N/A, hr = 0x80070002

    Version: N/A, hr = 0x80070002

    OGAExec.exe Signed By: N/A, hr = 0x80070002

    OGAAddin.dll Signed By: N/A, hr = 0x80070002

     

    OGA Data-->

    Office Status: 109 N/A

    OGA Version: N/A, 0x80070002

    Signed By: N/A, hr = 0x80070002

    Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

     

    Browser Data-->

    Proxy settings: N/A

    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)

    Default Browser: C:\Users\Saroj\AppData\Local\Google\Chrome\Application\chrome.exe

    Download signed ActiveX controls: Prompt

    Download unsigned ActiveX controls: Disabled

    Run ActiveX controls and plug-ins: Allowed

    Initialize and script ActiveX controls not marked as safe: Disabled

    Allow scripting of Internet Explorer Webbrowser control: Disabled

    Active scripting: Allowed

    Script ActiveX controls marked as safe for scripting: Allowed

     

    File Scan Data-->

    File Mismatch: C:\Windows\system32\en-US\sppc.dll.mui[6.1.7600.16385], Hr = 0x800b0100

    File Mismatch: C:\Windows\system32\en-US\sppcext.dll.mui[6.1.7600.16385], Hr = 0x800b0100

    File Mismatch: C:\Windows\system32\en-US\slc.dll.mui[6.1.7600.16385], Hr = 0x800b0100

    File Mismatch: C:\Windows\system32\en-US\slcext.dll.mui[6.1.7600.16385], Hr = 0x800b0100

    File Mismatch: C:\Windows\system32\en-US\sppuinotify.dll.mui[6.1.7600.16385], Hr = 0x800b0100

    File Mismatch: C:\Windows\system32\en-US\slui.exe.mui[6.1.7600.16385], Hr = 0x800b0100

    File Mismatch: C:\Windows\system32\en-US\sppcomapi.dll.mui[6.1.7600.16385], Hr = 0x800b0100

    File Mismatch: C:\Windows\system32\en-US\sppcommdlg.dll.mui[6.1.7600.16385], Hr = 0x800b0100

    File Mismatch: C:\Windows\system32\en-US\sppsvc.exe.mui[6.1.7600.16385], Hr = 0x800b0100

    File Mismatch: C:\Windows\system32\en-US\user32.dll.mui[6.1.7600.16385], Hr = 0x800b0100

     

    Other data-->

    Office Details: <GenuineResults><MachineData><UGUID>{0155114D-B942-4118-BD17-A687161A8499}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7600.2.00010300.0.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-3BK62</PKey><PID>00359-032-2409992-85255</PID><PIDType>5</PIDType><SID>S-1-5-21-587472696-1976573404-2951470614</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>HP Pavilion dv6700 Notebook PC    </Model></SYSTEM><BIOS><Manufacturer>Hewlett-Packard</Manufacturer><Version>F.52     </Version><SMBIOSVersion major="2" minor="4"/><Date>20080324000000.000000+000</Date></BIOS><HWID>4BBA3607018400FA</HWID><UserLCID>4009</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>W. Europe Standard Time(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-MPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

     

    Spsys.log Content: 0x80070002

     

    Licensing Data-->

    Software licensing service version: 6.1.7600.16385

     

    Name: Windows(R) 7, HomePremium edition

    Description: Windows Operating System - Windows(R) 7, RETAIL channel

    Activation ID: 2e7d060d-4714-40f2-9896-1e4f15b612ad

    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f

    Extended PID: 00359-00170-032-240999-01-1053-7600.0000-1692010

    Installation ID: 013636683683944584651105069332972303464225717280289721

    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338

    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339

    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341

    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340

    Partial Product Key: 3BK62

    License Status: Licensed

    Remaining Windows rearm count: 3

    Trusted time: 18-06-2010 20:44:54

     

    Windows Activation Technologies-->

    HrOffline: 0x8004FE21

    HrOnline: N/A

    HealthStatus: 0x000000000000EF60

    Event Time Stamp: 6:18:2010 20:31

    ActiveX: Registered, Version: 7.1.7600.16395

    Admin Service: Registered, Version: 7.1.7600.16395

    HealthStatus Bitmask Output:

    Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui

    Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui

    Tampered File: %systemroot%\system32\slc.dll|slc.dll.mui

    Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui

    Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui

    Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration

    Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui

    Tampered File: %systemroot%\system32\sppcommdlg.dll|sppcommdlg.dll.mui

    Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui

     

     

    HWID Data-->

    HWID Hash Current: OAAAAAEABwABAAEAAAABAAAAAgABAAEAeqiwE2DukiQ8XkaDBgzWdXB6LKM63qj7VCbQRzjGKoU=

     

    OEM Activation 1.0 Data-->

    N/A

     

    OEM Activation 2.0 Data-->

    BIOS valid for OA 2.0: yes

    Windows marker version: 0x0

    OEMID and OEMTableID Consistent: yes

    BIOS Information: 

      ACPI Table Name OEMID Value OEMTableID Value

      APIC HP     30D2    

      FACP HP     30CC    

      HPET HP     30D2    

      BOOT HP     30D2    

      MCFG HP     30D2    

      TMOR HP     30CC    

      SLIC HPQOEM SLIC-MPC

      SSDT HP     30D2    

      SSDT HP     30D2    

      SSDT HP     30D2    

      SSDT HP     30D2    

     

    Regards

    Saroj

    Friday, June 18, 2010 7:07 PM

Answers

  • Hello Saroj,

      I have checked the key and it is Valid and Genuine.

      However, the Diagnostic Report is showing a number of tampered files. Because the only files that are showing as tampered are .mui files (.mui are the componets of a Language Pack), it suggests that the language of that Windows has been changed using a program known as Vistalizator.

      Since Windows Ultimate and Enterprise are the only version of Windows that allows the language to be changed, to change the language on other versions of Windows, Vistalizator hacks the new language packs into Windows in a way that causes Windows 7 to go into a Non-genuine state.

      The resolution to this is to use Vistalizator to return the Windows back to it's default language.

     

    Thank you,


    Darin MS
    Friday, June 18, 2010 8:46 PM
  • "Saroj1" wrote in message news:d9c38b83-32d5-4144-8cc7-0d425b5b6ee0...

    Hello Darin,

    Thanks for your timely reply. The windows original language was Swedish and I had asked the retailer for English version. They did not say to me that Home Premium has been hacked to change the language from its default. Does changing back to the original language only fixes this issue. Is there any other way of fixing the pop-up saying the windows is not genuine. 

    Regards

    Saroj

     
     
    Your options are (apart from going back to the retailer and demanding what you paid for!):-
    1) Clean Reinstall Home Premium using an English language OEM System Builder disk, and your COA Key (I think that'll work, but no guarantees!)
    2) Upgrade to Ultimate - but that probably won't fix the immediate problem of multiple .mui file errors on its own,
    3) fix the errors, and live with Swedish as the OS language
    4) live with the notification problems
    5) see if you can talk the HP Sweden (or UK) into providing you with an English recovery disk - which you then use to reformat/reinstall everything. They may do this for a reasonable price (probably less than £50) - or they may refuse to supply anything except Swedish media.
     
    Speaking in terms of security, options 1 and 5 are the safest, because you never know what else the hack has done to your PC apart from enabling language changes.
     
    HTH - Darin should be back on Monday to correct me, if I've got it wrong :)

    --
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, June 19, 2010 11:37 AM
    Moderator

All replies

  • Hello Saroj,

      I have checked the key and it is Valid and Genuine.

      However, the Diagnostic Report is showing a number of tampered files. Because the only files that are showing as tampered are .mui files (.mui are the componets of a Language Pack), it suggests that the language of that Windows has been changed using a program known as Vistalizator.

      Since Windows Ultimate and Enterprise are the only version of Windows that allows the language to be changed, to change the language on other versions of Windows, Vistalizator hacks the new language packs into Windows in a way that causes Windows 7 to go into a Non-genuine state.

      The resolution to this is to use Vistalizator to return the Windows back to it's default language.

     

    Thank you,


    Darin MS
    Friday, June 18, 2010 8:46 PM
  • Hello Darin,

    Thanks for your timely reply. The windows original language was Swedish and I had asked the retailer for English version. They did not say to me that Home Premium has been hacked to change the language from its default. Does changing back to the original language only fixes this issue. Is there any other way of fixing the pop-up saying the windows is not genuine. 

    Regards

    Saroj

    Saturday, June 19, 2010 11:06 AM
  • "Saroj1" wrote in message news:d9c38b83-32d5-4144-8cc7-0d425b5b6ee0...

    Hello Darin,

    Thanks for your timely reply. The windows original language was Swedish and I had asked the retailer for English version. They did not say to me that Home Premium has been hacked to change the language from its default. Does changing back to the original language only fixes this issue. Is there any other way of fixing the pop-up saying the windows is not genuine. 

    Regards

    Saroj

     
     
    Your options are (apart from going back to the retailer and demanding what you paid for!):-
    1) Clean Reinstall Home Premium using an English language OEM System Builder disk, and your COA Key (I think that'll work, but no guarantees!)
    2) Upgrade to Ultimate - but that probably won't fix the immediate problem of multiple .mui file errors on its own,
    3) fix the errors, and live with Swedish as the OS language
    4) live with the notification problems
    5) see if you can talk the HP Sweden (or UK) into providing you with an English recovery disk - which you then use to reformat/reinstall everything. They may do this for a reasonable price (probably less than £50) - or they may refuse to supply anything except Swedish media.
     
    Speaking in terms of security, options 1 and 5 are the safest, because you never know what else the hack has done to your PC apart from enabling language changes.
     
    HTH - Darin should be back on Monday to correct me, if I've got it wrong :)

    --
     

    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    Saturday, June 19, 2010 11:37 AM
    Moderator