Windows 7: Windows 7 Build 7601 "This Copy of Windows is Not Geniune" Error

BigTexas · 18 Oct 2012

This started to occur today for the first time. Can you help me diagnose and eliminate it?
I haven't run any registry cleanups or installed any new programs outside of windows updates for the last several weeks.

Running Windows 7 Pro 64 bit which was acquired from a neighbor who works for Microsoft here in WA so I know it is genuine. Haven't had a single issue with activation or recognition of it as genuine software until today.

The web test fails and directs me to a page to buy new windows software. Thanks, but no thanks.

Please help?

Adam

Code:

 
Results of my MGADiag
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
 
Validation Code: 0x8004FE21
Cached Online Validation Code: N/A, hr = 0x8007041d
Windows Product Key: *****-*****-G7KQH-TGHXM-7VPM3
Windows Product Key Hash: Tf7hfKdz0cSFtzYNQKXSpwiQLHA=
Windows Product ID: 00371-177-4443132-85742
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {BC7E392A-1B03-4B70-917B-D3F3719FBF91}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120830-0333
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
 
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
 
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
 
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
 
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Enterprise 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005
 
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
 
File Scan Data-->
 
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{BC7E392A-1B03-4B70-917B-D3F3719FBF91}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7VPM3</PKey><PID>00371-177-4443132-85742</PID><PIDType>5</PIDType><SID>S-1-5-21-808344236-533275635-2000723624</SID><SYSTEM><Manufacturer>MICRO-STAR INTERNATIONAL CO.,LTD</Manufacturer><Model>MS-7514</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>V1.1</Version><SMBIOSVersion major="2" minor="5"/><Date>20080528000000.000000+000</Date></BIOS><HWID>7D373B07018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>7514MS</OEMID><OEMTableID>A7514200</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>433658FB0019771</Val><Hash>XeKHqSQECPboiQSYscryrlPdDsk=</Hash><Pid>81599-952-0393526-65148</Pid><PidType>1</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 
 
Spsys.log Content: 0x80070002
 
Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x8007041D' to display the error text.
Error: 0x8007041D 
 
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0001000000000000
Event Time Stamp: 10:18:2012 15:08
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered Service: sppsvc
 
 
HWID Data-->
HWID Hash Current: NgAAAAEABgABAAEAAAACAAAAAQABAAEAonbyqfYYws6ENCwSCIXOJka8bJJSZGI9TLJ+giqF
 
OEM Activation 1.0 Data-->
N/A
 
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: no, invalid Windows marker
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
ACPI Table Name OEMID Value OEMTableID Value
APIC 7514MS A7514200
FACP 7514MS A7514200
HPET 7514MS OEMHPET 
MCFG 7514MS OEMMCFG 
SLIC 7514MS A7514200
OEMB 7514MS A7514200
SSDT DpgPmm CpuPm
 
 
Results of ChkDsk
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
 
C:\>chkdsk c:
The type of the file system is NTFS.
 
WARNING! F parameter not specified.
Running CHKDSK in read-only mode.
 
CHKDSK is verifying files (stage 1 of 3)...
243200 file records processed.
File verification completed.
597 large file records processed.
0 bad file records processed.
2 EA records processed.
44 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
313966 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 3)...
243200 file SDs/SIDs processed.
Security descriptor verification completed.
35384 data files processed.
CHKDSK is verifying Usn Journal...
33698360 USN bytes processed.
Usn Journal verification completed.
Windows has checked the file system and found no problems.
 
244196000 KB total disk space.
110486904 KB in 151581 files.
88608 KB in 35385 indexes.
0 KB in bad sectors.
350716 KB in use by the system.
65536 KB occupied by the log file.
133269772 KB available on disk.
 
4096 bytes in each allocation unit.
61049000 total allocation units on disk.
33317443 allocation units available on disk.

NoelDP · 19 Oct 2012

Something appears to be interfering with the ability of the Software Portection Service (or a related service) to start on demand.

Please open an Elevated (Administrator) Command Prompt window and use the following commands....

net start sppsvc
sc qc sppsvc
sc queryex sppsvc
sc qprivs sppsvc
sc qsidtype sppsvc
sc sdshow sppsvc

Copy and paste the output to your reply

Here are some instructions to make life easier

1) To open an Elevated Command Prompt Window (the CP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

BigTexas · 19 Oct 2012

Noel

Here's what I got back from the commands:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\>net start sppsvc
The Software Protection service is starting.
The Software Protection service was started successfully.

C:\>sc qc sppsvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: sppsvc
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START (DELAYED)
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\sppsvc.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Software Protection
DEPENDENCIES : RpcSs
SERVICE_START_NAME : NT AUTHORITY\NetworkService

C:\>sc queryex sppsvc

SERVICE_NAME: sppsvc
TYPE : 10 WIN32_OWN_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 4080
FLAGS :

C:\>sc qprivs sppsvc
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: sppsvc
PRIVILEGES : SeAuditPrivilege
: SeChangeNotifyPrivilege
: SeCreateGlobalPrivilege
: SeImpersonatePrivilege

C:\>sc qsidtype sppsvc
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: sppsvc
SERVICE_SID_TYPE: UNRESTRICTED

C:\>sc sdshow sppsvc

D

A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO
CRRC;;;IU)(A;;CCLCSWRPLOCRRC;;;SU)(A;;LCRP;;;AU)S

AU;FA;CCDCLCSWRPWPDTLOCRSDRCW
DWO;;;WD)

C:\>

NoelDP · 19 Oct 2012

OK - so it looks as if the problem is not with the SPPSVC.
let's check some of the other critical services.
open an Elevated Command Prompt window, and run the following commands - post anything that doesn't start.

NET START SPPUINOTIFY
NET START WUAUSERV
NET START BITS
NET START SPLDR
NET START BFE
NET START TRUSTEDINSTALLER

BigTexas · 19 Oct 2012

Here is the latest - it looks like the only one that wouldn't start was the first one.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\>net start sppuinotify
The SPP Notification Service service is starting.
The SPP Notification Service service could not be started.

The service did not report an error.

More help is available by typing NET HELPMSG 3534.

C:\>net start wuauserv
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

C:\>net start bits
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

C:\>net start spldr
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

C:\>net start bfe
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

C:\>net start trustedinstaller
The Windows Modules Installer service is starting.
The Windows Modules Installer service was started successfully.

C:\>

NoelDP · 20 Oct 2012

The SPPUINotify service is misbehaving - let's see if the service it depends on is started....

run the followng commands from an Elevated Command prompt.

NET START EVENTSYSTEM
SC QC EVENTSYSTEM
SC QUERYEX EVENTSYSTEM

If that's started, OK then we'll have to hunt-and-peck

BigTexas · 20 Oct 2012

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\>net start eventsystem
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

C:\>sc qc eventsystem
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: eventsystem
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k LocalService
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : COM+ Event System
DEPENDENCIES : rpcss
SERVICE_START_NAME : NT AUTHORITY\LocalService

C:\>sc queryex eventsystem

SERVICE_NAME: eventsystem
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 1088
FLAGS :

C:\>

NoelDP · 20 Oct 2012

OK - lets get the detail on the SPPUINotify service, then....
run the following command in an Eleveated command prompt, and post the results.

REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\SPPUINotify /S
ICACLS C:\Windows\System32\sppuinotify.* /T
DIR C:\Windows\sppuinotify.* /S

(the last two commands may be a little slow - wait for the return of the prompt)

BigTexas · 20 Oct 2012

Below is the response. I also got an error popup saying i had a corruption in a file while running the last command. I tried to click on it for more details or to copy the error message and it just disappeared.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\>reg query hklm\system\currentcontrolset\services\sppuinotify /s

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sppuinotify
DisplayName REG_SZ @%SystemRoot%\system32\sppuinotify.dll,-103
ImagePath REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k LocalServ
ice
Description REG_SZ @%SystemRoot%\system32\sppuinotify.dll,-102
ObjectName REG_SZ NT AUTHORITY\LocalService
ErrorControl REG_DWORD 0x1
Start REG_DWORD 0x3
Type REG_DWORD 0x20
DependOnService REG_MULTI_SZ EventSystem
ServiceSidType REG_DWORD 0x1
RequiredPrivileges REG_MULTI_SZ SeChangeNotifyPrivilege\0SeImpersonate
Privilege
FailureActions REG_BINARY 80510100000000000000000003000000140000000100
0000E093040001000000E09304000000000000000000

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sppuinotify\Parameters
ServiceDll REG_EXPAND_SZ %SystemRoot%\system32\sppuinotify.dll
ServiceDllUnloadOnStop REG_DWORD 0x1

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sppuinotify\Security
Security REG_BINARY 01001480C8000000D4000000140000003000000002001C0001
00000002801400FF010F00010100000000000100000000020098000600000000001400FD01020001
010000000000051200000000002800FD010200010600000000000550000000F05B5807C3438C9AC7
8A72DD8F8CB4DF4447E7F800001800FF010F0001020000000000052000000020020000000014008D
010200010100000000000504000000000014008D0102000101000000000005060000000000140000
01000001010000000000050B000000010100000000000512000000010100000000000512000000

C:\>icacls c:\windows\system32\sppuinotify.* /t
c:\windows\system32\sppuinotify.dll NT SERVICE\TrustedInstaller

F)
BUILTIN\Administrators

RX)
NT AUTHORITY\SYSTEM

RX)
BUILTIN\Users

RX)

c:\windows\system32\en-US\sppuinotify.dll.mui NT SERVICE\TrustedInstaller

F)
BUILTIN\Administrators

RX)
NT AUTHORITY\SYSTEM

RX)
BUILTIN\Users

RX)

c:\windows\system32\LogFiles\WMI\RtBackup\sppuinotify.*: Access is denied.
Successfully processed 2 files; Failed processing 1 files

C:\>dir c:\windows\sppuinotify.* /s
Volume in drive C has no label.
Volume Serial Number is 06DA-AB8F

Directory of c:\windows\System32

07/13/2009 06:41 PM 65,536 sppuinotify.dll
1 File(s) 65,536 bytes

Directory of c:\windows\System32\en-US

07/13/2009 07:29 PM 3,072 sppuinotify.dll.mui
1 File(s) 3,072 bytes

Directory of c:\windows\winsxs\amd64_microsoft-windows-s..ty-spp-ux.resources_3
1bf3856ad364e35_6.1.7600.16385_en-us_54dae2e5153375ce

07/13/2009 07:29 PM 3,072 sppuinotify.dll.mui
1 File(s) 3,072 bytes

Directory of c:\windows\winsxs\amd64_microsoft-windows-security-spp-ux_31bf3856
ad364e35_6.1.7600.16385_none_b7b69062b883381f

07/13/2009 06:41 PM 65,536 sppuinotify.dll
1 File(s) 65,536 bytes

Directory of c:\windows\winsxs\amd64_microsoft-windows-security-spp-ux_31bf3856
ad364e35_6.1.7601.17514_none_b9e7a42ab571bbb9

07/13/2009 06:41 PM 65,536 sppuinotify.dll
1 File(s) 65,536 bytes

Total Files Listed:
5 File(s) 202,752 bytes
0 Dir(s) 139,055,071,232 bytes free

C:\>

NoelDP · 20 Oct 2012

c:\windows\system32\LogFiles\WMI\RtBackup\sppuinotify.*: Access is denied.
Successfully processed 2 files; Failed processing 1 files

..is an odd one - I've seen this type of response a few times with different errors but never really got to the bottom of it.
I suspect there are permission problems with that folder, but ofte teh problem has been resolved without touching it.

Please run the following commands in an Elevated command prompt, so we can check it.

DIR C:\Windows\System32\Logfiles\WMI\RTBackup /S
ICACLS C:\Windows\System32\Logfiles\WMI\RTBackup
DIR C:\Windows\System32\Logfiles\WMI
ICACLS C:\Windows\System32\Logfiles\WMI
ATTRIB C:\Windows\System32\Logfiles\WMI\*.* /s

Windows 7: Windows 7 Build 7601 "This Copy of Windows is Not Geniune" Error

Windows 7 Build 7601 "This Copy of Windows is Not Geniune" Error problems?