Windows 7: power outage = not genuine

ickymay · 12 Aug 2012

why not try something like this APC BE550G Back-UPS ES 8 Outlet 550VA 120V

TanyaC · 12 Aug 2012

Quote: Originally Posted by NoelDP

At the risk of teaching grandmothers to suck eggs, Malwarebytes is not an Anti-Virus!
Do you have an AV installed at all?
If not, I suggest that you do an offline scan with Defender Offline - What is Windows Defender Offline?

I am not a grandmother. My kids are too young to be married and have kids of their own. A rather peculiar saying tho.

No I do not have anything else installed. I use a hardware firewall, MWB, Windows defender and that's all. I have been infected with 1 virus once since the late 80's. Avoiding viruses is pretty easy.

I can guarantee all my systems are clean. But I'll run the above scan anyway, just for you

I'll post results when finished.

@layback bear: Yes, All of my PCs, TVs, modem/routers/switches all have $80 surge protectors. They are supposed to be high quality surge protectors.

@ickymay: Something like these: UPS Backup | Power Supply | Emergency Power Systems ? CyberPower Systems, Inc. give me around 1 - 2 minutes on load battery backup. Probably OK for most of the outages which last less than 5 seconds. But at $267 AUD each, I could get away with 5 of them, but it's a little expensive. Typical response time is 4ms, which I'm guessing would be fast enough for the PC to not reboot?

NoelDP · 12 Aug 2012

Teaching grandmother to suck eggs - Wikipedia, the free encyclopedia

I agree that generally, viruses are easy enough to avoid - but an AV is added insurance for when vigilance slackens. I've had one or two close shaves lately where I've forgotten to use a VM for opening a suspicious attachment and been saved by my AV. (that'll teach me for being curious!)

TanyaC · 12 Aug 2012

Quote: Originally Posted by NoelDP

Teaching grandmother to suck eggs - Wikipedia, the free encyclopedia

Oh, lol. I'd never heard that one before...

Ok, I've scanned all 8 PCs. All came up clean.

Just out of curiousity, what's the difference between the Windows Defender scan my PC runs each afternoon (full scan), and the full offfline scan? They seem to be the same. Is it just potentially locked files?

NoelDP · 12 Aug 2012

The Windows Defender in built in Windows 7 is an anti-malware app.
Microsoft Security Essentials forms MS's AV solution for Windows 7 (as well as for Vista and XP)
The Windows Defender Offline is a full virus and malware scanner - and is more akin to the Windows Defender that will be in Windows 8 (which again, is an AV and AM protection).

( I should also mention that MSE actually upgrades Windows Defender in Vista/Windows 7 - switching the original incarnation off)

ickymay · 13 Aug 2012

Quote: Originally Posted by TanyaC

@ickymay: Something like these: UPS Backup | Power Supply | Emergency Power Systems ? CyberPower Systems, Inc. give me around 1 - 2 minutes on load battery backup. Probably OK for most of the outages which last less than 5 seconds. But at $267 AUD each, I could get away with 5 of them, but it's a little expensive. Typical response time is 4ms, which I'm guessing would be fast enough for the PC to not reboot?

the reason I linked these APC BE550G Back-UPS ES 8 Outlet 550VA 120V is because you could use one for all eight PCs which should buffer the power for those few vital seconds

TanyaC · 13 Aug 2012

Quote: Originally Posted by ickymay

Quote: Originally Posted by TanyaC

@ickymay: Something like these: UPS Backup | Power Supply | Emergency Power Systems ? CyberPower Systems, Inc. give me around 1 - 2 minutes on load battery backup. Probably OK for most of the outages which last less than 5 seconds. But at $267 AUD each, I could get away with 5 of them, but it's a little expensive. Typical response time is 4ms, which I'm guessing would be fast enough for the PC to not reboot?

the reason I linked these APC BE550G Back-UPS ES 8 Outlet 550VA 120V is because you could use one for all eight PCs which should buffer the power for those few vital seconds

Ah, but the computers are in different rooms of the house, and on different floors. Still better pricing than the Cyberpower units at $140 AUD though.

Despite all this excellent advice regarding power protection, I suspect we might be getting a little off topic, which was that when the power does go out, Windows loses its activation state.

NoelDP · 13 Aug 2012

I'm still of the opinion that it's a race condition- as such there may be something in the Event logs - but I have to admit to no real idea what to look for.
Pick a machine (any machine) that went NG, and look at the Event logs for the first boot it went bad last time.
What error/critical/warning events do you get? - perhaps you could zip the two main Windows logs up and attach them?
(Application and System)

TanyaC · 13 Aug 2012

This is the section of those logs at the time of the power outage (August 10th, 18:47)

NoelDP · 13 Aug 2012

I'm thinking aloud here, so this could be a ramble in many parts

Code:

Information 10/08/2012 19:35:49 Microsoft-Windows-Security-SPP 1003 None "The Software Protection service has completed licensing status check.
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: 039998e3-3ef5-4adf-b758-d25fa0128ff4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 47188d7c-b5ef-4336-91a9-3857b219fe95, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 68531fb9-5511-4989-97be-d11a0f55633f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 6a4bd364-4b60-4856-a727-efb59d94348e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: 6d47464d-e43d-4228-b051-fddd47fd403f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: 8fe15d04-fc66-40e6-bf34-942481e06fd8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: 9a159de8-d114-41d7-a5bf-d3574edb42fa, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: a60c85a9-7eff-4690-8aa1-010ddf5d38f0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: a7dad4b1-8065-4576-9e61-2fd025fe16cc, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c60b048b-8071-4532-8398-f15f4c981861, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: c837408d-3762-4dea-a4d7-6dba48f6c305, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: c99b641f-c4ea-4e63-bec3-5ed2ccd0f357, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: da71774d-b2c9-4c42-bb7b-a66365d5abb2, 1, 1 [(0 )(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 10 960)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])]
14: f14c8ee3-560d-441e-aee1-325c2e9ae74a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
"
Information 10/08/2012 18:54:48 Microsoft-Windows-LoadPerf 1000 None Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service.
Information 10/08/2012 18:54:48 Microsoft-Windows-LoadPerf 1001 None Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data contains the new values of the system Last Counter and Last Help registry entries.
Information 10/08/2012 18:52:58 Windows Server Update Services 501 1 Update Services Service Started
Information 10/08/2012 18:52:54 MSSQL$MICROSOFT##SSEE 3454 (2) "The description for Event ID 3454 from source MSSQL$MICROSOFT##SSEE cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

The 0xC004F014 error indicates that the Product Key is not available - but the system has found a valid license and Key for the da71774d-b2c9-4c42-bb7b-a66365d5abb2 license type..

At that point in the boot, I suspect that the licensing files are being rebuilt (do a DIR C:\Windows\System32\7b*.* to see which ones I mean) - if those files become read-only for any reason, the system will start showing a c0000022 error, but if the the on-boot rebuild is stuck I suspect that they could produce such a response.

compare with the earlier one.....

Code:

Information 10/08/2012 18:50:49 Microsoft-Windows-Security-SPP 1003 None "The Software Protection service has completed licensing status check.
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: 039998e3-3ef5-4adf-b758-d25fa0128ff4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 47188d7c-b5ef-4336-91a9-3857b219fe95, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 68531fb9-5511-4989-97be-d11a0f55633f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 6a4bd364-4b60-4856-a727-efb59d94348e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: 6d47464d-e43d-4228-b051-fddd47fd403f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: 8fe15d04-fc66-40e6-bf34-942481e06fd8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: 9a159de8-d114-41d7-a5bf-d3574edb42fa, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: a60c85a9-7eff-4690-8aa1-010ddf5d38f0, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: a7dad4b1-8065-4576-9e61-2fd025fe16cc, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c60b048b-8071-4532-8398-f15f4c981861, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: c837408d-3762-4dea-a4d7-6dba48f6c305, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: c99b641f-c4ea-4e63-bec3-5ed2ccd0f357, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: da71774d-b2c9-4c42-bb7b-a66365d5abb2, 1, 1 [(0 )(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 10 1020)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])]
14: f14c8ee3-560d-441e-aee1-325c2e9ae74a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
"
Information 10/08/2012 18:50:49 Microsoft-Windows-Security-SPP 1066 None "Initialization status for service objects.
C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000
"
Information 10/08/2012 18:50:48 Microsoft-Windows-Security-SPP 900 None "The Software Protection service is starting.
"

If you then compare that with a report from my own OEM_HP system EventID1003

Code:

The Software Protection service has completed licensing status check.
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: 01f5fc37-a99e-45c5-b65e-d762f3518ead, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 2e7d060d-4714-40f2-9896-1e4f15b612ad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 3b965dfc-31d9-4903-886f-873a0382776c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 586bc076-c93d-429a-afe5-a69fbc644e88, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
5: 5e017a8a-f3f9-4167-b1bd-ba3e236a4d8f, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: 5e35dc43-389b-47c5-b889-2088b06738cb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: 6a7d5d8a-92af-4e6a-af4b-8fddaec800e5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: 9ab82e0c-ffc9-4107-baa1-c65a8bd3ccc3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: 9f83d90f-a151-4665-ae69-30b3f63ec659, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: a63275f4-530c-48a7-b0d3-4f00d688d151, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: b8a4bb91-69b1-460d-93f8-40e0670af04a, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: d2c04e90-c3dd-4260-b0f3-f845f5d27d64, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )]
13: e68b141f-4dfa-4387-b3b7-e65c4889216e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
14: ee4e1629-bcdc-4b42-a68f-b92e135f78d7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
15: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
16: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

...or the Pro VM TechNet

Code:

Description:
The Software Protection service has completed licensing status check.
Application Id=55c92734-d682-4d71-983e-d6ec3f16059f
Licensing Status=
1: 4de78642-0f7f-4b61-9392-8add86d70ae8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 50e329f7-a5fa-46b2-85fd-f224e5da7764, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 5a79ecd8-d33f-406c-a619-7785899b5d59, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 770bc271-8dc1-467d-b574-73cbacbeccd1, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 3 0 msft:rm/algorithm/hwid/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )]
5: 90a61a0d-0b76-4bf1-a8b8-89061855a4c9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: 92f9d22a-65f5-49a7-90fe-06491b4fc379, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: 9ccffaf9-86a2-414e-b031-b2f777720e90, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: b92e9980-b9d5-4821-9c94-140f632f6312, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c1027486-8ae8-4633-9cf9-9658ed80504d, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: c1e88de3-96c4-4563-ad7d-775f65b1e670, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: c33001fc-5e9c-4f27-8c05-e0154adb0db4, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: cf3c5b35-35ff-4c95-9bbd-a188e47ad14c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
14: cff07cac-7534-4cc3-b3f3-99e1a0aa3c20, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
15: d188820a-cb63-4bad-a9a2-40b843ee23b7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
16: d8e04254-f9a5-4729-ae86-886de6aa907c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
17: da22eadd-46dc-4056-a287-f5041c852470, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
18: e120e868-3df2-464a-95a0-b52fa5ada4bf, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
19: e838d943-63ed-4a0b-9fb1-47152908acc9, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
20: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
21: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

Windows 7: power outage = not genuine

power outage = not genuine problems?