Windows 7: Windows 7 Build 7601 This copy of Windows is not genuine - help please

militarymad · 06 Oct 2012

Please assist as the above watermark has appeared on my screen.
I purchased this Windows 7 software from a reputable retailer approximately 18 months ago to upgrade from XP, at the time it activated fine, and I have not had any problems until now.
The clock is running accurately though I am getting the ‘black screen’ occasionally.
I have carried out the following checks:
1) Windows update will not run but produces this message:
Windows could not search for new updates
An error occurred while checking for new updates for your computer
Error(s) found:
Code C0000022
2) The Software Protection Service is not running and when I try to start it I get the following message:
Windows could not start the Software Protection service on Local Computer. Error 5: Access is denied
3) I have run CHKDSK, as an administrator, with the following results:
No errors reported
4) I have run SFC /SCANNOW , as an administrator, with the following results:
Windows Resource Protection did not find any integrity violations.
5)I have downloaded and run System Update Readiness Tool (CheckSUR) :
No errors detected
6) I have run a full Malwarebytes scan which reported:
No malicious items detected
7) I have run Windows Validation and I was transferred to a page:
Buy genuine Windows
8) I have run System File Checker tool with this result:
Verification 100% complete.
Windows Resource Protection did not find any integrity violations.
9) I have run Windows Update troubleshooter-Microsoft Fix-it.

I have run out of ideas now, I did though use a registry cleaner recently!
Could this have caused this problem?
I am running Windows 7 Home Premium 32 bit 6.1.7601 SP1 Build 7601.
The SkyDrive link for the CBS.log file is: http://sdrv.ms/SBPVYZ
Please see the attached results from running MGA diag tool.

Code:

Diagnostic Report (1.9.0027.0):
  -----------------------------------------
  Windows Validation Data-->
   
  Validation Code: 0x8004FE21
  Cached Online Validation Code: N/A, hr = 0xc0000022
  Windows Product Key: *****-*****-3T7PC-WWBHB-BHRQC
  Windows Product Key Hash: VvW3LsLNFcHl6WG9QpQ1rH+JREQ=
  Windows Product ID: 00359-112-6321493-85980
  Windows Product ID Type: 5
  Windows License Type: Retail
  Windows OS version: 6.1.7601.2.00010300.1.0.003
  ID: {1BC27C47-4AFC-4744-A15B-D2C8F5BD8CB6}(3)
  Is Admin: Yes
  TestCab: 0x0
  LegitcheckControl ActiveX: N/A, hr = 0x80070002
  Signed By: N/A, hr = 0x80070002
  Product Name: Windows 7 Home Premium
  Architecture: 0x00000000
  Build lab: 7601.win7sp1_gdr.120330-1504
  TTS Error: 
  Validation Diagnostic: 
  Resolution Status: N/A
   
  Vista WgaER Data-->
  ThreatID(s): N/A, hr = 0x80070002
  Version: N/A, hr = 0x80070002
   
  Windows XP Notifications Data-->
  Cached Result: N/A, hr = 0x80070002
  File Exists: No
  Version: N/A, hr = 0x80070002
  WgaTray.exe Signed By: N/A, hr = 0x80070002
  WgaLogon.dll Signed By: N/A, hr = 0x80070002
   
  OGA Notifications Data-->
  Cached Result: N/A, hr = 0x80070002
  Version: N/A, hr = 0x80070002
  OGAExec.exe Signed By: N/A, hr = 0x80070002
  OGAAddin.dll Signed By: N/A, hr = 0x80070002
   
  OGA Data-->
  Office Status: 100 Genuine
  Microsoft Office Home and Student 2007 - 100 Genuine
  OGA Version: N/A, 0x80070002
  Signed By: N/A, hr = 0x80070002
  Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
   
  Browser Data-->
  Proxy settings: N/A
  User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
  Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
  Download signed ActiveX controls: Prompt
  Download unsigned ActiveX controls: Disabled
  Run ActiveX controls and plug-ins: Allowed
  Initialize and script ActiveX controls not marked as safe: Disabled
  Allow scripting of Internet Explorer Webbrowser control: Disabled
  Active scripting: Allowed
  Script ActiveX controls marked as safe for scripting: Allowed
   
  File Scan Data-->
   
  Other data-->
  Office Details: <GenuineResults><MachineData><UGUID>{1BC27C47-4AFC-4744-A15B-D2C8F5BD8CB6}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-BHRQC</PKey><PID>00359-112-6321493-85980</PID><PIDType>5</PIDType><SID>S-1-5-21-3341527090-2742051375-1317818011</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>ASUS A8N-E ACPI BIOS Revision 1010</Version><SMBIOSVersion major="2" minor="3"/><Date>20051125000000.000000+000</Date></BIOS><HWID>F8933E07018400F8</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>880986A854C70E</Val><Hash>XDPvojxu4+w2XnOUd4p11YcsCYQ=</Hash><Pid>81602-903-9710515-68915</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  
   
  Spsys.log Content: 0x80070002
   
  Licensing Data-->
  On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.
  Error: 0x80070426 
   
  Windows Activation Technologies-->
  HrOffline: 0x8004FE21
  HrOnline: N/A
  HealthStatus: 0x0001000000000000
  Event Time Stamp: 10:5:2012 18:28
  ActiveX: Registered, Version: 7.1.7600.16395
  Admin Service: Registered, Version: 7.1.7600.16395
  HealthStatus Bitmask Output:
  Tampered Service: sppsvc
   
   
  HWID Data-->
  HWID Hash Current: OgAAAAIABgABAAEAAAADAAAAAQABAAEAeqgkgNQabTXq1HTqAIfekz6Ofgi+m06TkopiPbYOrF00tQ==
   
  OEM Activation 1.0 Data-->
  N/A
   
  OEM Activation 2.0 Data-->
  BIOS valid for OA 2.0: yes, but no SLIC table
  Windows marker version: N/A
  OEMID and OEMTableID Consistent: N/A
  BIOS Information: 
    ACPI Table Name    OEMID Value            OEMTableID Value
    APIC                         Nvidia             AWRDACPI
    FACP                                    Nvidia             AWRDACPI
    SRAT                                    AMD                           HAMMER  
    SSDT                                    PTLTD                        POWERNOW
    MCFG                                   Nvidia             AWRDACPI

NoelDP · 06 Oct 2012

You're using Norton Software??

Please run the following commands, and post the results.
REG QUERY HKLM\SYSTEM\CurrentControlSet\services\spldr /S
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR /S
They may show something

Here are some instructions to make life easier

1) To open an Elevated Command Prompt Window (the CP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

militarymad · 06 Oct 2012

Thank you for your prompt reply.
I am running Norton 360
Here are the results:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\services\spldr /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\spldr
DisplayName REG_SZ Security Processor Loader Driver
ErrorControl REG_DWORD 0x3
Start REG_DWORD 0x0
Type REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\spldr\Enum
0 REG_SZ Root\LEGACY_SPLDR\0000
Count REG_DWORD 0x1
NextInstance REG_DWORD 0x1

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPL
DR /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR
NextInstance REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000
Service REG_SZ spldr
Legacy REG_DWORD 0x1
ConfigFlags REG_DWORD 0x400
Class REG_SZ LegacyDriver
ClassGUID REG_SZ {8ECC055D-047F-11D1-A537-0000F8753ED1}
DeviceDesc REG_SZ Security Processor Loader Driver
Capabilities REG_DWORD 0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000\Control
ActiveService REG_SZ spldr

C:\Windows\system32>

NoelDP · 06 Oct 2012

Hmm - it's the first time I've ever seen these symptoms where there hasn't been a problem in one of those two registry keys.
Cached Online Validation Code: N/A, hr = 0xc0000022
Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.
Error: 0x80070426

We'll have to go back to basics, and see what we find.

Please first run the following commands and post the results...

net start sppsvc
sc qc sppsvc
sc queryex sppsvc
sc qprivs sppsvc
sc qsidtype sppsvc
sc sdshow sppsvc

Copy and paste the output to your reply

Also, Copy the CBS.log file created to your desktop (you can't manipulate it directly) and then compress the copy and upload it to your SkyDrive (http://skydrive.live.com ) and post a link to it so that I can take a look.

militarymad · 06 Oct 2012

Hi Noel, here are the results:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>net start sppsvc
The Software Protection service is starting.
The Software Protection service could not be started.

A system error has occurred.

System error 5 has occurred.

Access is denied.

C:\Windows\system32>sc qc sppsvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: sppsvc
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START (DELAYED)
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\sppsvc.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Software Protection
DEPENDENCIES : RpcSs
SERVICE_START_NAME : NT AUTHORITY\NetworkService

C:\Windows\system32>sc queryex sppsvc

SERVICE_NAME: sppsvc
TYPE : 10 WIN32_OWN_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 5 (0x5)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>sc qprivs sppsvc
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: sppsvc
PRIVILEGES : SeAuditPrivilege
: SeChangeNotifyPrivilege
: SeCreateGlobalPrivilege
: SeImpersonatePrivilege

C:\Windows\system32>sc qsidtype sppsvc
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: sppsvc
SERVICE_SID_TYPE: UNRESTRICTED

C:\Windows\system32>sc sdshow sppsvc

D

A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO
CRRC;;;IU)(A;;CCLCSWRPLOCRRC;;;SU)(A;;LCRP;;;AU)S

AU;FA;CCDCLCSWRPWPDTLOCRSDRCW
DWO;;;WD)

C:\Windows\system32>

Mike

NoelDP · 06 Oct 2012

Hmmm - apart from the obvious error message, that looks normal.

Which registry cleaner was it you used? Did it create backups you can use to undo what it did?
(if so, can you post them?)

Conventionally, according to MS, the Error 5 indicates massive file corruption - IMHO, what they really mean is registry corruption.

Does System Restore work? - try a restore back to about 3 days before the problem surfaced (if you can!)

militarymad · 06 Oct 2012

Unfortunately I am not sure which Registry Cleaner did the damage as I have used 3 over the last 2 weeks.
Eusing Free Registry Defrag 2.0 Back-up created

CCleaner Registry Cleaner Back-up created

Norton 360 Registry Clean Up No back-up (that I know of)

As for System Restore, I do not seem to have any restore points
I will try and locate the above back-ups and and see if I can do anything there.

militarymad · 06 Oct 2012

I used System Restore but the earliest back-up was 1/10/12. When I restored to that date it also removed my Norton 360?
I cannot locate a restore point for Eusing and the CCleaner only goes back to the 1/10/12.
By the Windows update the last one I received was on the 27/09/12, I cannot restore that far back, unfortunately.
Any ideas?

NoelDP · 06 Oct 2012

If you left CCLeaner at default settings, it should be innocent.

Norton would be my favourite for the cause. - but I know nothing about Eusing (and all registry cleaners are bad news, anyhow)

NoelDP · 06 Oct 2012

What was the AV you had installed before Norton?

Windows 7: Windows 7 Build 7601 This copy of Windows is not genuine - help please

Windows 7 Build 7601 This copy of Windows is not genuine - help please problems?