Windows 7: Windows 7 build 7601 not genuine message, slui will not run

kylescf · 01 Jan 2013

Yes, we had a fine night, thank you. Whisky was drunk and a good time was had by all.

I replaced Norton 360 with Microsoft Security Essentials - a quick scan showed nothing, running a full scan now. and I will do checks with Malwarebytes Anti-Malware and Windows Defender Offline.

There is no immediate hurry about sorting this as no one will need to use this computer for the rest of the week.

I did try to carry out repair install last week but it failed near the end, before it asks for licence information, claiming there were incompatibility problems then promptly rebooted and restored Windows to the original current state complete with the problem.

I'll post the scan results when I get them.

kylescf · 02 Jan 2013

Hi Noel,

I have run all the virus and malware programmes now in full scan mode (which took a few hours) but they have found nothing. Any suggestions/thoughts?

NoelDP · 02 Jan 2013

Still nothing in the other thread - the OP doesn't seem to be particularly keen to fix it (or they are still recovering

)

Let's have a look at the Event logs....

Please open Event Viewer
In the left pane, navigate to the Windows Logs
right-click on Applications and select 'Save all events as...' save as Apps.evtx
repeat for the System logs - save as Sys.evtx
Compress both files, and attach to your reply.

kylescf · 02 Jan 2013

Attached are the apps and sys event logs as requested.

NoelDP · 02 Jan 2013

There seems to be a fight going on between VSS, NSSDK.MfpifValidator.1, and NSSDK.CprMfpif.1 to decide which gets more error entries in the Application logs.

MSE appears to be having problems updating.

There appear to be bad blocks present in one of your disks - but CHKDSK says not the C: drive (any ide which one \Device\Harddisk1\DR4 is?). Looking at the log, it may be an external drive, as it disappears on 29/12

From what little I understand in the logs, a common facter appears to be a stall ShellHWDetection Service
let's see if we can find out if anything is wrong with its settings.....

Open an elevated Command Prompt, and run the following commands....

NET START ShellHWDetection
SC QC ShellHWDetection
SC QUERYEX ShellHWDetection
SC SDSHOW ShellHWDetection
SC QPRIVS ShellHWDetection

post the results.

Here are some instructions to make life easier

1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

kylescf · 02 Jan 2013

I used a USB hard drive to backup all the User files and it had an initial problem as the power lead was not fully in. Maybe that was the hard disk problem.

Anyway, here are the results of the commands you asked for:

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\admin>NET START ShellHWDetection
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.


C:\Users\admin>SC QC ShellHWDetection
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ShellHWDetection
        TYPE               : 20  WIN32_SHARE_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 0   IGNORE
        BINARY_PATH_NAME   : C:\Windows\System32\svchost.exe -k netsvcs
        LOAD_ORDER_GROUP   : ShellSvcGroup
        TAG                : 0
        DISPLAY_NAME       : Shell Hardware Detection
        DEPENDENCIES       : RpcSs
        SERVICE_START_NAME : LocalSystem

C:\Users\admin>SC QUERYEX ShellHWDetection

SERVICE_NAME: ShellHWDetection
        TYPE               : 20  WIN32_SHARE_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 944
        FLAGS              :

C:\Users\admin>SC SDSHOW ShellHWDetection

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Users\admin>SC QPRIVS ShellHWDetection
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: ShellHWDetection
        PRIVILEGES       : SeImpersonatePrivilege

C:\Users\admin>

Is this useful/helpful? Fingers crossed!

NoelDP · 02 Jan 2013

Have you tired typing with crossed fingers? (come to think of it- it might improve mine!)

Nope - that's all standard, so there's something getting in its way and the trick is to work out what.

I finally managed to find out what NSSDK.MfpifValidator.1 is from - it's a network Scanner from Sharp.
You need to check the IP addresses for all the items on the network - there appears to be a conflict at times.

NoelDP · 02 Jan 2013

... fat-fingered it!
to continue.....
The VSS errors are more likely to be related - here's the detail from one such error...

Code:

Log Name: Application
Source: VSS
Date: 02/01/2013 16:45:45
Event ID: 8194
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: admin-PC
Description:
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process. 
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {cba7cd60-8843-4153-9594-6944a54dcd25}
Event Xml:
<Event xmlns="Error">
<System>
<Provider Name="VSS" />
<EventID Qualifiers="0">8194</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-01-02T16:45:45.000000000Z" />
<EventRecordID>30582</EventRecordID>
<Channel>Application</Channel>
<Computer>admin-PC</Computer>
<Security />
</System>
<EventData>
<Data>0x80070005, Access is denied.
</Data>
<Data>
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {cba7cd60-8843-4153-9594-6944a54dcd25}</Data>

Please open an Elevated Command Prompt, and run the following command

vssadmin list writers >%userprofile%\desktop\noel1.log

This will create a new file on your desktop - noel1.log - please attach it to your response (you can read the content in Notepad if you like)

We can then see what VSS is up to (maybe!)

kylescf · 02 Jan 2013

Actually, my main problem from the fingers point of view is that the girls in the office use such corrosive hand lotion chemicals that the letters on this keyboard have all but been erased (not being a trained touch typist). I have taken the opportunity of their being on holiday to take this machine home to try and sort out this problem. They would be happy to live without updates and a black screen rather than fix the problem....

Tomorrow I will be back at work in my real job so I will only be about (forum-wise) in the evenings.

There is a Sharp photocopier/printer in the office that is no doubt the source of conflict. But the other two PCs seem to cope with the network without becoming invalid copies of windows and refusing to update. Hmmm

kylescf · 02 Jan 2013

Overlapping posts there - missed you latest one.

The file requested is attached

Windows 7: Windows 7 build 7601 not genuine message, slui will not run

Windows 7 build 7601 not genuine message, slui will not run problems?