my windows OEM is no longer activated

NoelDP · 03 Nov 2012

Odd - please run the following command and post the results....

DIR %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform /S
DIR %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform /AH /S

Here are some instructions to make life easier :)
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

Jirokarja17 · 03 Nov 2012

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\windows\system32>DIR %windir%\ServiceProfiles\NetworkService\AppData\Roaming\
Microsoft\SoftwareProtectionPlatform /S
Volume in drive C is OS
Volume Serial Number is 9ADB-4D6F

Directory of C:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsof
t\SoftwareProtectionPlatform

11/02/2012 02:04 PM <DIR> .
11/02/2012 02:04 PM <DIR> ..
07/14/2009 12:46 AM <DIR> Cache
10/10/2012 01:21 PM 7,188,300 tokens.bar
1 File(s) 7,188,300 bytes

Directory of C:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsof
t\SoftwareProtectionPlatform\Cache

07/14/2009 12:46 AM <DIR> .
07/14/2009 12:46 AM <DIR> ..
11/02/2012 12:11 AM 153,304 cache.dat
1 File(s) 153,304 bytes

Total Files Listed:
2 File(s) 7,341,604 bytes
5 Dir(s) 1,890,548,301,824 bytes free

C:\windows\system32>DIR %windir%\ServiceProfiles\NetworkService\AppData\Roaming\
Microsoft\SoftwareProtectionPlatform /AH /S
Volume in drive C is OS
Volume Serial Number is 9ADB-4D6F
File Not Found

C:\windows\system32>

ok here is the results

NoelDP · 03 Nov 2012

OK - the new .DAT file isn't being created properly - and hasn't been since 10th October.

Please run the following command from an Elevated Command Prompt window(1)

Copy and paste set of commands below into the window – once completed, hit the Enter Key to ensure that the last command has run (2)

REG QUERY HKU
REG QUERY HKU\S-1-5-20
REG QUERY HKU\S-1-5-20\Environment
REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20"
sc sdshow plugplay
REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18" /S
REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19" /S
ICACLS C:\Windows\ServiceProfiles\NetworkService\AppData
ICACLS C:\Windows\ServiceProfiles\Networkservice
ICACLS C:\Windows\ServiceProfiles
ICACLS C:\Windows
ICACLS C:\Windows\System32
Copy the whole output to your response(3)

Jirokarja17 · 03 Nov 2012

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\windows\system32>REG QUERY HKU

HKEY_USERS\.DEFAULT
HKEY_USERS\S-1-5-19
HKEY_USERS\S-1-5-20
HKEY_USERS\S-1-5-21-69682363-3814587300-356812041-1001
HKEY_USERS\S-1-5-21-69682363-3814587300-356812041-1001_Classes
HKEY_USERS\S-1-5-18

C:\windows\system32>REG QUERY HKU\S-1-5-20

HKEY_USERS\S-1-5-20\AppEvents
HKEY_USERS\S-1-5-20\Console
HKEY_USERS\S-1-5-20\Control Panel
HKEY_USERS\S-1-5-20\Environment
HKEY_USERS\S-1-5-20\EUDC
HKEY_USERS\S-1-5-20\Keyboard Layout
HKEY_USERS\S-1-5-20\Network
HKEY_USERS\S-1-5-20\Printers
HKEY_USERS\S-1-5-20\Software
HKEY_USERS\S-1-5-20\System

C:\windows\system32>REG QUERY HKU\S-1-5-20\Environment

HKEY_USERS\S-1-5-20\Environment
TEMP REG_EXPAND_SZ %USERPROFILE%\AppData\Local\Temp
TMP REG_EXPAND_SZ %USERPROFILE%\AppData\Local\Temp

C:\windows\system32>REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
\ProfileList\S-1-5-20"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-
5-20
ProfileImagePath REG_EXPAND_SZ C:\Windows\ServiceProfiles\NetworkServi
ce
Flags REG_DWORD 0x0
State REG_DWORD 0x0

C:\windows\system32>sc sdshow plugplay

D

A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S

AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\windows\system32>REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
\ProfileList\S-1-5-18" /S

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-
5-18
Flags REG_DWORD 0xc
State REG_DWORD 0x0
RefCount REG_DWORD 0x1
Sid REG_BINARY 010100000000000512000000
ProfileImagePath REG_EXPAND_SZ %systemroot%\system32\config\systemprof
ile

C:\windows\system32>REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
\ProfileList\S-1-5-19" /S

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-
5-19
ProfileImagePath REG_EXPAND_SZ C:\Windows\ServiceProfiles\LocalService

Flags REG_DWORD 0x0
State REG_DWORD 0x0

C:\windows\system32>ICACLS C:\Windows\ServiceProfiles\NetworkService\AppData
C:\Windows\ServiceProfiles\NetworkService\AppData NT AUTHORITY\SYSTEM

I)(OI)(CI
)(F)
BUILTIN\Administrators

I)(OI)
(CI)(F)
NT AUTHORITY\NETWORK SERVICE

I)(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>ICACLS C:\Windows\ServiceProfiles\Networkservice
C:\Windows\ServiceProfiles\Networkservice NT AUTHORITY\SYSTEM

OI)(CI)(F)
BUILTIN\Administrators

OI)(CI)(F)
NT AUTHORITY\NETWORK SERVICE

OI)(CI)(
F)

Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>ICACLS C:\Windows\ServiceProfiles
C:\Windows\ServiceProfiles NT SERVICE\TrustedInstaller

I)(F)
NT SERVICE\TrustedInstaller

I)(CI)(IO)(F)
NT AUTHORITY\SYSTEM

I)(F)
NT AUTHORITY\SYSTEM

I)(OI)(CI)(IO)(F)
BUILTIN\Administrators

I)(F)
BUILTIN\Administrators

I)(OI)(CI)(IO)(F)
BUILTIN\Users

I)(RX)
BUILTIN\Users

I)(OI)(CI)(IO)(GR,GE)
CREATOR OWNER

I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>ICACLS C:\Windows
C:\Windows NT SERVICE\TrustedInstaller

F)
NT SERVICE\TrustedInstaller

CI)(IO)(F)
NT AUTHORITY\SYSTEM

M)
NT AUTHORITY\SYSTEM

OI)(CI)(IO)(F)
BUILTIN\Administrators

M)
BUILTIN\Administrators

OI)(CI)(IO)(F)
BUILTIN\Users

RX)
BUILTIN\Users

OI)(CI)(IO)(GR,GE)
CREATOR OWNER

OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>ICACLS C:\Windows\System32
C:\Windows\System32 NT SERVICE\TrustedInstaller

F)
NT SERVICE\TrustedInstaller

CI)(IO)(F)
NT AUTHORITY\SYSTEM

M)
NT AUTHORITY\SYSTEM

OI)(CI)(IO)(F)
BUILTIN\Administrators

M)
BUILTIN\Administrators

OI)(CI)(IO)(F)
BUILTIN\Users

RX)
BUILTIN\Users

OI)(CI)(IO)(GR,GE)
CREATOR OWNER

OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>

NoelDP · 03 Nov 2012

Those all look OK.

Please run the following commands in an Elevated Command Prompt, and post the results.

DIR C:\Windows\System32 /AR /S
NET START EVENTSYSTEM
NET START EVENTLOG
NET START WINMGMT

Jirokarja17 · 03 Nov 2012

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\windows\system32>DIR C:\Windows\System32 /AR /S
Volume in drive C is OS
Volume Serial Number is 9ADB-4D6F

Directory of C:\Windows\System32

08/19/2009 11:50 PM 24,416 AdobePDFUI.dll
08/26/2008 03:23 PM 70 R.BAT
08/26/2008 03:23 PM 74 S.BAT
3 File(s) 24,560 bytes

Directory of C:\Windows\System32\drivers\N360x64\0604000.009

12/01/2011 09:56 PM 7,450 iron.cat
11/16/2011 11:17 PM 772 iron.inf
11/16/2011 11:17 PM 190,072 ironx64.sys
08/16/2011 02:51 AM 2,852 symds.inf
08/16/2011 02:51 AM 7,496 symds64.cat
08/16/2011 02:51 AM 451,192 symds64.sys
11/16/2011 11:37 PM 1,441 symnet.inf
11/23/2011 10:23 PM 7,458 symnet64.cat
11/16/2011 11:37 PM 405,624 symnets.sys
9 File(s) 1,074,357 bytes

Directory of C:\Windows\System32\DRVSTORE\USBFilter_178B4A5C5A1ED5C7508DAF503E9
C03F887463F05

12/25/2010 09:20 PM 8,050 usbfilter.cat
12/19/2010 07:17 PM 4,969 USBFilter.INF
2 File(s) 13,019 bytes

Directory of C:\Windows\System32\DRVSTORE\USBFilter_178B4A5C5A1ED5C7508DAF503E9
C03F887463F05\amd64

12/15/2010 11:06 AM 47,232 usbfilter.sys
1 File(s) 47,232 bytes

Directory of C:\Windows\System32\OEM

08/19/2009 10:58 AM 2,731 ZT_GROUP.XRM-MS
1 File(s) 2,731 bytes

Directory of C:\Windows\System32\oobe\INFO

08/30/2006 05:18 PM 30,656 OEMLOGO.BMP
04/14/2008 12:10 PM 224 OOBE.XML
2 File(s) 30,880 bytes

Directory of C:\Windows\System32\restore

02/27/2012 10:26 PM 76 MachineGuid.txt
1 File(s) 76 bytes

Total Files Listed:
19 File(s) 1,192,855 bytes
0 Dir(s) 1,888,263,032,832 bytes free

C:\windows\system32>NET START EVENTSYSTEM
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

C:\windows\system32>NET START EVENTLOG
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

C:\windows\system32>NET START WINMGMT

NoelDP · 03 Nov 2012

That looks normal - I see that you have/had Norton software installed.
Is it currently installed?
What other security software is also installed?
What other Anti-Virus programs have ever been installed?

Jirokarja17 · 03 Nov 2012

none but Norton and yes it is installed

NoelDP · 03 Nov 2012

I can't help wondering if it's part of the cause - The file dates seem rather old for the current release.
Have you updated/upgraded Norton at all in the past month or so (other than normal definition updates)??
Again - has any other AV EVER been installed on this system? (what did it ship with?)
Please run the following command and post the results - it may take a while to run, so wait until the prompt returns before copying to your reply.

DIR C:\Norton* /AD /S

Jirokarja17 · 03 Nov 2012

no it didn't come with any other virus protection the computer was empty. Sigh all this from a power outage. here the post.

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\windows\system32>DIR C:\Norton* /AD /S
Volume in drive C is OS
Volume Serial Number is 9ADB-4D6F

Directory of C:\Program Files\Windows Sidebar\Gadgets

10/02/2012 11:01 AM <DIR> Norton.Gadget
0 File(s) 0 bytes

Directory of C:\Program Files (x86)

02/29/2012 03:05 PM <DIR> Norton 360 Premier Edition
02/27/2012 11:13 PM <DIR> NortonInstaller
0 File(s) 0 bytes

Directory of C:\Program Files (x86)\Norton 360 Premier Edition

02/29/2012 03:05 PM <DIR> Norton 360
0 File(s) 0 bytes

Directory of C:\Program Files (x86)\Norton 360 Premier Edition\Norton 360\MUI\G
adgets

02/29/2012 03:05 PM <DIR> Norton.Gadget
0 File(s) 0 bytes

Directory of C:\ProgramData

02/29/2012 03:08 PM <DIR> Norton
11/16/2011 02:25 PM <DIR> NortonInstaller
0 File(s) 0 bytes

Directory of C:\ProgramData\Microsoft\Windows\Start Menu\Programs

10/02/2012 11:01 AM <DIR> Norton 360 Premier Edition
0 File(s) 0 bytes

Directory of C:\Users\All Users

02/29/2012 03:08 PM <DIR> Norton
11/16/2011 02:25 PM <DIR> NortonInstaller
0 File(s) 0 bytes

Directory of C:\Users\All Users\Microsoft\Windows\Start Menu\Programs

10/02/2012 11:01 AM <DIR> Norton 360 Premier Edition
0 File(s) 0 bytes

Directory of C:\Users\Jirokarja17\AppData\Roaming\Microsoft\Windows\Start Menu\
Programs

02/29/2012 03:07 PM <DIR> Norton
0 File(s) 0 bytes

Directory of C:\Users\Public\Downloads

02/27/2012 11:12 PM <DIR> Norton
0 File(s) 0 bytes

Directory of C:\Windows\System32\Tasks

10/02/2012 11:07 AM <DIR> Norton 360
0 File(s) 0 bytes

Total Files Listed:
0 File(s) 0 bytes
14 Dir(s) 1,884,136,865,792 bytes free

C:\windows\system32>