Corrupted System File SFC Can't Fix

Slartybart said:

I'm confused:
System File Checker Errors - CBS.log

Maybe you're looking at this the wrong way.

See if a quick malware scan shows up anything: herdProtect: Malware Detection
You don't need to analyze the output, please post a screen shot of the Scan results (if there are lots, just post the log in step 8.

I don't think this is a malware issue. It may be due to some hdd failures (I'm running Intel Desktop RAID 5) and a few power outages. I'm on a APC 1500 Smart-UPS now. I highly suspect that any corrupted files are due to system crashes or possibly the actions of the first MS Support tech rep when he was deleting a few keys in my registry without backing up the registry first.

I'm running ESET Smart Security 7, Windows Defender, and SuperAntiSpyWarePro. Additionally, the second MS Support tech rep ran two third party programs: HitmanPro and RogueKiller. Both indicated no malicious software.

Code:

 
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE22
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-9CBQQ-CBRDX-4VBW4
Windows Product Key Hash: 4o79yMzf+5/lHKmwIiotxng2nPc=
Windows Product ID: 00371-OEM-9045181-41077
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {88569B0E-21CB-4760-A2CC-9595DA52037D}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.9.42.0
Signed By: Microsoft
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.140303-2144
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Professional 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 77F760FE-153-80070002_7E90FEE8-175-80070002_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-b01a_E2AD56EA-766-0_E2AD56EA-148-80004005_16E0B333-89-80004005_B4D0AA8B-1029-80004005
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\slui.exe[6.1.7601.17514], Hr = 0x80092003
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{88569B0E-21CB-4760-A2CC-9595DA52037D}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-4VBW4</PKey><PID>00371-OEM-9045181-41077</PID><PIDType>3</PIDType><SID>S-1-5-21-764048772-141219837-185285450</SID><SYSTEM><Manufacturer>INTEL_</Manufacturer><Model>DX58SO__</Model></SYSTEM><BIOS><Manufacturer>Intel Corp.</Manufacturer><Version>SOX5810J.86A.5600.2013.0729.2250</Version><SMBIOSVersion major="2" minor="5"/><Date>20130729000000.000000+000</Date></BIOS><HWID>92493107018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0014-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Professional 2007</Name><Ver>12</Ver><Val>1B16FCA35E8C714</Val><Hash>Ox0izo7MjcnLKUdV4ul5G/4OhBY=</Hash><Pid>81605-906-5273533-65430</Pid><PidType>1</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: e120e868-3df2-464a-95a0-b52fa5ada4bf
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00180-451-841077-02-1033-7601.0000-2122014
Installation ID: 021892549173720063162803583281194772514004932426885526
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: 4VBW4
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 01-Aug-14 01:08:06
Windows Activation Technologies-->
HrOffline: 0x8004FE22
HrOnline: N/A
HealthStatus: 0x0000000000000800
Event Time Stamp: 7:30:2014 23:05
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
 
HWID Data-->
HWID Hash Current: MAAAAAMAAAABAAEAAQACAAAAAQABAAEACrYw0tpjQ0ZsQ7K6xFcOLJyfvSCmnuqC
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
ACPI Table Name OEMID Value OEMTableID Value
APIC INTEL DX58SO 
FACP INTEL DX58SO 
HPET INTEL DX58SO 
MCFG INTEL DX58SO 
WDDT INTEL DX58SO 
ASF! INTEL DX58SO 
SSDT INTEL SSDT PM
DMAR INTEL DX58SO 
WDTT INTEL DX58SO 
ASPT INTEL PerfTune

If the system file checker reliably checks the slui.exe file each time, then the slui.exe file was not corrupted until after MS Support tech reps reactivated my already activated Windows 7 Pro x64. Interestingly, I haven't had a activation window pop up indicating my Windows 7 is not genuine for the past 24 hours. The system was reactivated by MS Support four times. The slui.exe file was likely corrupted during these actions. I think that my issue now is only the corrupted slui.exe file.

I saw that as well. I think that is why MS Support was fixated on a malicious software issue.

I think my last clean install was about May 2013. I've upgraded some hardware that likely required a validation from Microsoft since then. I've upgraded my processor from an i7-920 to an i7-930 and I upgraded memory from 6GB to 12GB.

I had a crash a few months ago that took me multiple reboots to resolve. I can't recall what caused the crash. It was either some problems related to parity errors on my RAID 5 likely from a power failure or a power failure. I've had both and I got tired of doing a full erase on my RAID 5 one drive at a time and rebuilding to clean up damage from power failures, so I added a Smart-UPS to resolve that issue. I recall during two of those reboots seeing white text on the lower portion of a black screen that my windows wasn't genuine. But, that issue was momentary and didn't reoccur after the crash damage was resolved. I started getting the activation pop-up on Monday when one of my dual monitors failed and I switched the cable from the secondary monitor to be the new primary (only) monitor until I can recap my failed monitor. The system file checker was reporting no issues until after MS Support forced the reactivation. Perhaps the slui.exe file got corrupted when the system was reactivated when the system was reporting the system was activated, but with non-genuine Windows 7.

Thanks for the assistance.

Regards