Windows 7 Ultimate x64 Genuine issue - ''vbscript.dll''

RikkertW · 07 Feb 2013

After reading multiple topics and trying lots of different solutions for the 'Windows Genuine problem', I am following NoelDP's request by starting a new thread.

Since 2 days I'm getting a message, displayed at the right bottom side of my desktop, saying my version of Windows 7 Ultimate isn't genuine. Besides this I'm getting the occasional 'You may be a victim of software counterfeiting' message aswell. I have followed every instruction, I think. But after 'regfixing' I get an error message (see attachment 'Register-editor error message').

This here remains the problem:

Code:

 C:\Windows\system32>reg query HKEY_CLASSES_ROOT\CLSID\{B54F3741-5B07-11cf-A4B0-0
0AA004A55E8}\InprocServer32

HKEY_CLASSES_ROOT\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32
    (standaard)    REG_SZ    C:\Windows\system32\vbscript.dll
    ThreadingModel    REG_SZ    Both


C:\Windows\system32>

I have attached a Windows diagnostics report aswell. Don't know if it's needed or not. I hope the problem description is crystal clear. Now for the answer... :) Thanks in advance.

Golden · 08 Feb 2013

Hi,

This is really Noel's area of expertise, but I'll try help out with the obvious. The error code below (if I recall correctly implies that WAT is not validated properly).

Code:

Validation Code: 0
Cached Online Validation Code: N/A, hr = 0xc004f012

Please follow the instructions in this link to run the online validation, and report back the results please:

What is validation and how does it work? - Microsoft Windows

If this doesn't help, then the fault lies here with Windows 7 not being able to find the .vbs, as you already determined, and we will leave this for Noel to analyse and suggest a fix:

Code:

Licensing Data-->
Invoerfout: Kan scriptbestand C:\Windows\system32\slmgr.vbs niet vinden.

Regards,
Golden

RikkertW · 08 Feb 2013

Golden, thanks for your quick response. It's pretty stupid that I didn't even care to complete the normal validation process, would have felt so stupid if that would have solved the problem. It didn't, see attachment for the result. I'm hoping Noel will jump to my rescue, or anyone else with enough knowledge about this stuff.

Golden · 08 Feb 2013

No worries. Upload a new MGADIAG report since the attempt at validation may have added information that will help us solve the issue.

I've asked Noel to have a look at this, so look out for his reply.

RikkertW · 08 Feb 2013

Hmmhmm, thanks for your help buddy.

Golden · 08 Feb 2013

Thanks - I see no difference, so lets await Noel's suggestion.

NoelDP · 08 Feb 2013

Sorry for the late response - mislaid my Power Supply!(don't ask!!)

You have more than one problem

start with the 'minor one' - the indications are that the installation has been enabled by use of a hacker's program called 'RemoveWAT'.
You can confirm this by opening an Elevated Command Prompt, and running the following command....

DIR C:\Windows\System32\slmgr.* /S

post the results, and we'll see where we are...

The major problem is that the Key in use is an MSDN Key from a not-for-resale MSDN account.
Unless you are an MSDN subscriber, you are not entitled to use the Key – and whoever sold it to you was not entitled to do so.
You need to claim an immediate refund from the vendor - do NOT accept the offer of a new key (all they are trying to do is to get past the 45-day claims window or avoid you sending the evidence of their crimes to the authorities)

Please read the following posts.... .................................

http://social.microsoft.com/Forums/en-US/genuinewindows7/thread/a2444f34-0aff-4f29-a8ac-67e28b0c0285

and

http://social.microsoft.com/Forums/en-US/genuinewindows7/thread/309bb621-92d5-43d6-98c1-2bb51b35607f

The pirates have got VERY good at this over the past few years, as the price of equipment for manufacturing the packages drops, and as factories open in less well-policed countries.

see also this post....

http://social.microsoft.com/Forums/en-US/genuinewindows7/thread/46a58748-5a64-41ff-b7f4-f6d3b47beca9

Also - have a look at this video....

http://www.youtube.com/watch?v=hzqNNiOM0cs

You may be able to get a complimentary copy of the OS from Microsoft - fill in the Counterfeit report here...
http://www.microsoft.com/en-gb/howtotell/default.aspx

RikkertW · 09 Feb 2013

Thanks for your reply, I find it came pretty fast; awesome. I'm away for the weekend, will follow the steps first thing when I come back. Will post the results as I go along. The remove-Wat can still cause an obstruction? I confess I used it (my dad actually) together with a key he still had, did that once before when I still was a student. It caused problems this time, so I went legit (can now afford it). Thought I had removed all the crap though.

To be continued... Have a great weekend!

*Edit: Have now read your whole post (my first response came from my Iphone); I got scammed...will take actions when I'm back. Thanks for the information Noel.

RikkertW · 12 Feb 2013

Noel and Golden, I wanted to thank you both again for helping. I claimed a refund (via the seller/paypal) and filed a counterfeit software report. I highly doubt I will be seeing any money back. That's a shame, but doesn't matter the most. I feel really stupid and I hope this website 'www.nowin8.com' get's on the blacklist and the seller has to go through some work to cover his mess up.

his was the first time I came across sevenforums, I bookmarked it for any future problems I maybe stumble on...been a great help.

Regards

NoelDP · 12 Feb 2013

You're welcome - sorry about the bad experience!
Unfortunately, with that type of scam, I doubt very much you'll get a complimentary copy of Windows from MS - and paypal are known for not being forward on refunds

I would suspect that the seller will attempt to fob you off with another Key - do NOT accept it, as it will go the same way as the first.
Press your case with both them and paypal - and notify law enforcement as well.

For what it's worth - the first warning flag on that site is the total lack of any physical means of contact - no snail-mail address, no telephone number, and no email address.
Second clue is that the place normally occupied by the webmaster's link only contains an icon - which leads to http://www.51.la/
If you do a whois on those two domains....

Code:

Domain Name ..................... nowin8.com
Name Server ..................... f1g1ns1.dnspod.net
                                  f1g1ns2.dnspod.net
Registrant ID ................... whois-protect
Registrant Name ................. WHOIS AGENT
Registrant Organization ......... DOMAIN WHOIS PROTECTION SERVICE
Registrant Address .............. 3/F.,HiChina Mansion,No.27 Gulouwai Avenue
                                  Dongcheng District,Beijing 100120,China
Registrant City ................. Beijing
Registrant Province/State ....... Beijing
Registrant Postal Code .......... 100120
Registrant Country Code ......... CN
Registrant Email ................ @whoisprivacyprotectionservices.com
Administrative ID ............... whois-protect
Administrative Name ............. WHOIS AGENT
Administrative Organization ..... DOMAIN WHOIS PROTECTION SERVICE
Administrative Address .......... 3/F.,HiChina Mansion,No.27 Gulouwai Avenue
                                  Dongcheng District,Beijing 100120,China
Administrative City ............. Beijing
Administrative Province/State ... Beijing
Administrative Postal Code ...... 100120
Administrative Country Code ..... CN
Administrative Email ............ @whoisprivacyprotectionservices.com
Billing ID ...................... whois-protect
Billing Name .................... WHOIS AGENT
Billing Organization ............ DOMAIN WHOIS PROTECTION SERVICE
Billing Address ................. 3/F.,HiChina Mansion,No.27 Gulouwai Avenue
                                  Dongcheng District,Beijing 100120,China
Billing City .................... Beijing
Billing Province/State .......... Beijing
Billing Postal Code ............. 100120
Billing Country Code ............ CN
Billing Email ................... @whoisprivacyprotectionservices.com
Technical ID .................... whois-protect
Technical Name .................. WHOIS AGENT
Technical Organization .......... DOMAIN WHOIS PROTECTION SERVICE
Technical Address ............... 3/F.,HiChina Mansion,No.27 Gulouwai Avenue
                                  Dongcheng District,Beijing 100120,China
Technical City .................. Beijing
Technical Province/State ........ Beijing
Technical Postal Code ........... 100120
Technical Country Code .......... CN
Technical Email ................. @whoisprivacyprotectionservices.com
Expiration Date ................. 2013-11-21 05:39:04

Code:

Domain ID:CNIC-DO473296
Domain Name:51.LA
Created On:17-Jan-2005 01:00:00 UTC
Last Updated On:14-Mar-2012 16:59:32 UTC
Expiration Date:17-Jan-2017 23:59:59 UTC
Status:TRANSFER PROHIBITED
Status:RENEW PERIOD
Registrant ID:P-23189298
Registrant Name:Yang Fucheng
Registrant Street1:5-32, 55 Jingsan Road
Registrant City:Zhengzhou
Registrant Postal Code:450008
Registrant Country:CN
Registrant Phone:+86.37168712665
Registrant Email:@hotmail.com
Admin ID:P-23189298
Admin Name:Yang Fucheng
Admin Street1:5-32, 55 Jingsan Road
Admin City:Zhengzhou
Admin Postal Code:450008
Admin Country:CN
Admin Phone:+86.37168712665
Admin Email:@hotmail.com
Tech ID:P-23189298
Tech Name:Yang Fucheng
Tech Street1:5-32, 55 Jingsan Road
Tech City:Zhengzhou
Tech Postal Code:450008
Tech Country:CN
Tech Phone:+86.37168712665
Tech Email:@hotmail.com
Billing ID:P-23189298
Billing Name:Yang Fucheng
Billing Street1:5-32, 55 Jingsan Road
Billing City:Zhengzhou
Billing Postal Code:450008
Billing Country:CN
Billing Phone:+86.37168712665
Billing Email:@hotmail.com
Sponsoring Registrar ID:7091-KS
Sponsoring Registrar IANA ID:269
Sponsoring Registrar Organization:Key Systems GmbH
Sponsoring Registrar Street1:Im Oberen Werk 1
Sponsoring Registrar City:St. Ingbert
Sponsoring Registrar Postal Code:66386
Sponsoring Registrar Country:DE
Sponsoring Registrar Phone:+49.68949396850
Sponsoring Registrar FAX:+49 (0)68949396851
Sponsoring Registrar Website:http://www.key-systems.net/
Name Server:NS1.DNSV2.COM
Name Server:NS2.DNSV2.COM
DNSSEC:Unsigned

...so it looks like you've been scammed by the Chinese.