Windows 7 Build 7601 This copy of Windows is not genuine - help please

militarymad · 10 Oct 2012

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\spldr  /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\spldr
    DisplayName    REG_SZ    Security Processor Loader Driver
    ErrorControl    REG_DWORD    0x3
    Start    REG_DWORD    0x0
    Type    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\spldr\Enum
    0    REG_SZ    Root\LEGACY_SPLDR\0000
    Count    REG_DWORD    0x1
    NextInstance    REG_DWORD    0x1


C:\Windows\system32>REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\R
oot\LEGACY_SPLDR /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000
    Service    REG_SZ    spldr
    Legacy    REG_DWORD    0x1
    ConfigFlags    REG_DWORD    0x400
    Class    REG_SZ    LegacyDriver
    ClassGUID    REG_SZ    {8ECC055D-047F-11D1-A537-0000F8753ED1}
    DeviceDesc    REG_SZ    Security Processor Loader Driver
    Capabilities    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000\Control
    ActiveService    REG_SZ    spldr


C:\Windows\system32>REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servi
ces\eventlog\Application\Software Protection Platform Service" /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Softwa
re Protection Platform Service
    EventMessageFile    REG_EXPAND_SZ    %windir%\system32\sppsvc.exe
    TypesSupported    REG_DWORD    0x7
    ProviderGuid    REG_SZ    {E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}


C:\Windows\system32>REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic
es\eventlog\Application\SPP /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\SPP
    TypesSupported    REG_DWORD    0x7
    EventMessageFile    REG_EXPAND_SZ    %systemroot%\system32\sxproxy.dll


C:\Windows\system32>REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servi
ces\eventlog\Key Management Service\KmsRequests" /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Key Management Ser
vice\KmsRequests
    EventMessageFile    REG_EXPAND_SZ    %windir%\system32\sppsvc.exe
    TypesSupported    REG_DWORD    0x7
    ProviderGuid    REG_SZ    {E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}


C:\Windows\system32>REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic
es\sppuinotify /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sppuinotify
    DisplayName    REG_SZ    @%SystemRoot%\system32\sppuinotify.dll,-103
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalServ
ice
    Description    REG_SZ    @%SystemRoot%\system32\sppuinotify.dll,-102
    ObjectName    REG_SZ    NT AUTHORITY\LocalService
    ErrorControl    REG_DWORD    0x1
    Start    REG_DWORD    0x3
    Type    REG_DWORD    0x20
    DependOnService    REG_MULTI_SZ    EventSystem
    ServiceSidType    REG_DWORD    0x1
    RequiredPrivileges    REG_MULTI_SZ    SeChangeNotifyPrivilege\0SeImpersonate
Privilege
    FailureActions    REG_BINARY    80510100000000000000000003000000140000000100
0000E093040001000000E09304000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sppuinotify\Parameters
    ServiceDll    REG_EXPAND_SZ    %SystemRoot%\system32\sppuinotify.dll
    ServiceDllUnloadOnStop    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sppuinotify\Security
    Security    REG_BINARY    01001480C8000000D4000000140000003000000002001C0001
00000002801400FF010F00010100000000000100000000020098000600000000001400FD01020001
010000000000051200000000002800FD010200010600000000000550000000F05B5807C3438C9AC7
8A72DD8F8CB4DF4447E7F800001800FF010F0001020000000000052000000020020000000014008D
010200010100000000000504000000000014008D0102000101000000000005060000000000140000
01000001010000000000050B000000010100000000000512000000010100000000000512000000


C:\Windows\system32>REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\servic
es\VSS\Diag\SPP /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag\SPP
    SppGetSnapshots (Enter)    REG_BINARY    4000000000000000BC046BCF3FA6CD01001
50000B40E0000D207000000000000000000000000000000000000000000000000000000000000000
0000000000000
    SppGetSnapshots (Leave)    REG_BINARY    40000000000000001BA57DCF3FA6CD01001
50000B40E0000D207000001000000000000000000000000000000000000000000000000000000000
0000000000000
    SppEnumGroups (Enter)    REG_BINARY    400000000000000041CB7DCF3FA6CD0100150
000B40E0000D10700000000000000000000000000000000000000000000000000000000000000000
00000000000
    SppEnumGroups (Leave)    REG_BINARY    40000000000000000FD3FAD43FA6CD0100150
000B40E0000D10700000100000000000000010000000000000000000000000000000000000000000
00000000000
    SppCreate (Enter)    REG_BINARY    40000000000000008262AD1161A6CD01C8030000E
8100000D007000000000000000000000000000000000000000000000000000000000000000000000
0000000
    SppGatherWriterMetadata (Enter)    REG_BINARY    40000000000000009089B41161A
6CD01C8030000E8100000D3070000000000000000000000000000000000000000000000000000000
000000000000000000000
    SppGatherWriterMetadata (Leave)    REG_BINARY    4000000000000000DD1BA31461A
6CD01C8030000E8100000D3070000010000000000000000000000000000000000000000000000000
000000000000000000000
    SppAddInterestingComponents (Enter)    REG_BINARY    40000000000000000342A31
461A6CD01C8030000E8100000D407000000000000000000000000000000000000000000000000000
0000000000000000000000000
    SppAddInterestingComponents (Leave)    REG_BINARY    40000000000000007C52CE1
461A6CD01C8030000E8100000D407000001000000000000000000000000000000000000000000000
0000000000000000000000000
    SppCreate (Leave)    REG_BINARY    40000000000000009883411861A6CD01C8030000E
8100000D007000001000000000000000000000000000000000000000000000000000000000000000
0000000


C:\Windows\system32>

NoelDP · 10 Oct 2012

That looks normal enough - although I have to admit I have no idea what the REG_BINARY values actually mean!

I need to do some more reseacrh - and I have an almost identical thread elsewehre to deal with :)

militarymad · 10 Oct 2012

Thanks Noel, I wait to hear from you, hopefully with some more ideas.

NoelDP · 10 Oct 2012

The other thread came to a succesful conclusion - much to my surprise!

Have you EVER had Avast installed as anti-virus?

even if not, please run their cleanup utility -

Download the Avast removal utility from here http://www.avast.com/uninstall-utility
Follow the instructions for running it, and when complete, reboot the machine.

then visit www.microsoft.com/genuine/validate and see what happens
then post a new MGADIag report.

militarymad · 10 Oct 2012

No I have never had Avast installed but recently I installed the full version of AVG's anti virus. I used Windows 'uninstall a program' to remove AVG a couple of days ago but I have since found a few scattered files left-over that I have had to remove manually.
I remember now that I also ran AVG's registry cleaner and thinking back it was around that time that my problems started.

I have run the Avast's clean-up utility which only took seconds.
After running www.microsoft.com/genuine/validate I was transferred to Microsoft's page to buy a 'Genuine Version of Windows 7'.

Here is my MGA.diag report:

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE21
Cached Online Validation Code: N/A, hr = 0xc0000022
Windows Product Key: *****-*****-3T7PC-WWBHB-BHRQC
Windows Product Key Hash: VvW3LsLNFcHl6WG9QpQ1rH+JREQ=
Windows Product ID: 00359-112-6321493-85980
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {1BC27C47-4AFC-4744-A15B-D2C8F5BD8CB6}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.120330-1504
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 100 Genuine
Microsoft Office Home and Student 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{1BC27C47-4AFC-4744-A15B-D2C8F5BD8CB6}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-BHRQC</PKey><PID>00359-112-6321493-85980</PID><PIDType>5</PIDType><SID>S-1-5-21-3341527090-2742051375-1317818011</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>ASUS A8N-E ACPI BIOS Revision 1010</Version><SMBIOSVersion major="2" minor="3"/><Date>20051125000000.000000+000</Date></BIOS><HWID>F8933E07018400F8</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>880986A854C70E</Val><Hash>XDPvojxu4+w2XnOUd4p11YcsCYQ=</Hash><Pid>81602-903-9710515-68915</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.
Error: 0x80070426 

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0001000000000000
Event Time Stamp: 10:10:2012 19:46
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered Service: sppsvc


HWID Data-->
HWID Hash Current: OgAAAAIABgABAAEAAAADAAAAAQABAAEAeqgkgNQabTXq1HTqAIfekz6Ofgi+m06TkopiPbYOrF00tQ==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            Nvidia        AWRDACPI
  FACP            Nvidia        AWRDACPI
  SRAT            AMD           HAMMER  
  SSDT            PTLTD         POWERNOW
  MCFG            Nvidia        AWRDACPI

NoelDP · 10 Oct 2012

Hokay.....
You need to run the removal tool for AVG -

Download the AVG Remover from here
http://www.avg.com/us-en/utilities
Follow the instructions for running it, and then reboot the machine (whether it asks for it or not, and whether the program rebooted already or not).

Again, run another MGADiag report afterwards

Britton30 · 10 Oct 2012

Did AVG create a registry backup for you? AVG tweaks and others cause borked systems. CCleaner is the only reg cleaner I would use.

militarymad · 10 Oct 2012

I believe AVG did have a registry back-up. All I know was I was not happy with the way it 'took over' with scans-update which I could not stop without re-booting.

Noel, as I ran the removal tool for AVG the command window opened with:

Code:

AvgRemover 2012.0.5
   
  AvgRemover 2012.0.5
   
  2012-10-10 19:11:37,833 INFO AvgRemover 2012.0.5
  -------------------------------------------------------
  2012-10-10 19:11:37,833 INFO Command line: "C:\Users\Mike\Desktop\avg_remover_st
  f_x86_2012_2125.exe"
  2012-10-10 19:11:37,833 WARN AvgDir param empty.
  2012-10-10 19:11:37,833 WARN AvgDataDir param empty.

The latest MGA.diag:

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE21
Cached Online Validation Code: N/A, hr = 0xc0000022
Windows Product Key: *****-*****-3T7PC-WWBHB-BHRQC
Windows Product Key Hash: VvW3LsLNFcHl6WG9QpQ1rH+JREQ=
Windows Product ID: 00359-112-6321493-85980
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {1BC27C47-4AFC-4744-A15B-D2C8F5BD8CB6}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.120330-1504
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 100 Genuine
Microsoft Office Home and Student 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{1BC27C47-4AFC-4744-A15B-D2C8F5BD8CB6}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-BHRQC</PKey><PID>00359-112-6321493-85980</PID><PIDType>5</PIDType><SID>S-1-5-21-3341527090-2742051375-1317818011</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>ASUS A8N-E ACPI BIOS Revision 1010</Version><SMBIOSVersion major="2" minor="3"/><Date>20051125000000.000000+000</Date></BIOS><HWID>F8933E07018400F8</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>880986A854C70E</Val><Hash>XDPvojxu4+w2XnOUd4p11YcsCYQ=</Hash><Pid>81602-903-9710515-68915</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.
Error: 0x80070426 

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0001000000000000
Event Time Stamp: 10:10:2012 19:46
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered Service: sppsvc


HWID Data-->
HWID Hash Current: OgAAAAIABgABAAEAAAADAAAAAQABAAEAeqgkgNQabTXq1HTqAIfekz6Ofgi+m06TkopiPbYOrF00tQ==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            Nvidia        AWRDACPI
  FACP            Nvidia        AWRDACPI
  SRAT            AMD           HAMMER  
  SSDT            PTLTD         POWERNOW
  MCFG            Nvidia        AWRDACPI

NoelDP · 10 Oct 2012

militarymad said:

I believe AVG did have a registry back-up. All I know was I was not happy with the way it 'took over' with scans-update which I could not stop without re-booting.

Noel, as I ran the removal tool for AVG the command window opened with:

Code:

AvgRemover 2012.0.5
 
  AvgRemover 2012.0.5
 
  2012-10-10 19:11:37,833 INFO AvgRemover 2012.0.5
  -------------------------------------------------------
  2012-10-10 19:11:37,833 INFO Command line: "C:\Users\Mike\Desktop\avg_remover_st
  f_x86_2012_2125.exe"
  2012-10-10 19:11:37,833 WARN AvgDir param empty.
  2012-10-10 19:11:37,833 WARN AvgDataDir param empty.

That's OK - it defaults to the standard folders (I hope!)

No change in the report

I need to do some more research - back tomorrow

militarymad · 10 Oct 2012

Thank you again for all your effort