window update history?

NoelDP · 18 Jul 2012

To expand a little on the bare comment....

The Key may be genuine - at least it's not published in the internet - bu thte install has been hacked by the installtion of RemoveWAT in an attempt to force activation.
At some point, the slmgr.vbs file has been returned to active service (possibly an SFC was run?) and the hack has partially broken down.

Brest way to fix it now (since we don't know which version of RemoveWAT was used) is to run WATFix....

Download WATFix from here (WATFix ), and use that. Post back with another MGADiag report, and we'll then see what we can do. (make sure that you click on the link, not the big shiny buttons!!)

NoelDP · 18 Jul 2012

....hm mm - re-re-checking the report, I can see the reason for the use of RemoveWAT in the first place.

The motehrboard appears to be a retail one - but the Key is an OEM_COA_SLP Key, which is only valid on Direct OEM machines - the motherboard has been replaced, invalidating the OEM License.

><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>G41M-Combo</Model></SYSTEM

GradeAbra · 18 Jul 2012

NoelDP said:

....hm mm - re-re-checking the report, I can see the reason for the use of RemoveWAT in the first place.

The motehrboard appears to be a retail one - but the Key is an OEM_COA_SLP Key, which is only valid on Direct OEM machines - the motherboard has been replaced, invalidating the OEM License.

><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>G41M-Combo</Model></SYSTEM

I had my motherboard replaced not long ago. So now should i continue to use the WATfix?

NoelDP · 18 Jul 2012

No point.
What you need is a new Full license for Windows.

GradeAbra · 18 Jul 2012

NoelDP said:

No point.
What you need is a new Full license for Windows.

Anyway thanks bro everything is fixed now. Thanks for telling me about WatFIX.
Do i still need to Post back with another MGADiag report?

NoelDP · 18 Jul 2012

Yes please.

GradeAbra · 18 Jul 2012

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-6DGCT-K86QQ-G2FB2
Windows Product Key Hash: xbl7Lt7ZbEnmHmd7FbSvJn7ZT9Y=
Windows Product ID: 00359-OEM-9813644-49116
Windows Product ID Type: 8
Windows License Type: COA SLP
Windows OS version: 6.1.7600.2.00010300.0.0.003
ID: {E904E9F5-4341-4EAE-A682-45B1BFAF1616}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7600.win7_gdr.120503-2030
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 100 Genuine
Microsoft Office Enterprise 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-8009_E2AD56EA-766-2efd_E2AD56EA-148-80004005_16E0B333-89-80004005_B4D0AA8B-1029-80004005

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Opera\Opera.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{E904E9F5-4341-4EAE-A682-45B1BFAF1616}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7600.2.00010300.0.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-G2FB2</PKey><PID>00359-OEM-9813644-49116</PID><PIDType>8</PIDType><SID>S-1-5-21-3514224317-2285765790-428270974</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>G41M-Combo</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>FA</Version><SMBIOSVersion major="2" minor="4"/><Date>20120229000000.000000+000</Date></BIOS><HWID>C3BA3607018400F8</HWID><UserLCID>4809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Malay Peninsula Standard Time(GMT+08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>1960F5EDBD8ED86</Val><Hash>UqNnJH1Zy1Lo+zxU+a2CPGn6vZA=</Hash><Pid>89388-707-0253756-65113</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7600.16385

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
Activation ID: 5e017a8a-f3f9-4167-b1bd-ba3e236a4d8f
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00196-136-449116-02-18441-7600.0000-2002012
Installation ID: 002505039082013523409583871863503205769274345345973705
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: G2FB2
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 19/7/2012 12:40:12 AM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 7:18:2012 13:58
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: LAAAAAEAAgABAAEAAAABAAAAAQABAAEA6GEm4LzFqnYG6PaVTDb0AfShRso=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name	OEMID Value	OEMTableID Value
  APIC			GBT   		GBTUACPI
  FACP			GBT   		GBTUACPI
  HPET			GBT   		GBTUACPI
  MCFG			GBT   		GBTUACPI
  MSDM			GBT   		GBTUACPI
  TAMG			GBT   		GBT   B0
  SSDT			PmRef		CpuPm

NoelDP · 18 Jul 2012

OK that looks clean and good now - I can only assume that you managed to sweet-talk the activation operator into allowing it the first time you installed the Key and activated it? :)

GradeAbra · 18 Jul 2012

thanks