Windows 7 Pro x86, constantly de-regestering itself

SkrumpyJax · 07 Mar 2013

Code:

 
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: N/A, hr = 0xc002001b
Windows Product Key: *****-*****-JW6W3-RHH8B-DY2T4
Windows Product Key Hash: kVEtlTjyRvVl6nCMhy78CAl9ghI=
Windows Product ID: 00371-220-3620136-86822
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {8E580F9E-59F8-4C86-95A3-6E54C1C9D095}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.120830-0333
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Standard 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{8E580F9E-59F8-4C86-95A3-6E54C1C9D095}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-DY2T4</PKey><PID>00371-220-3620136-86822</PID><PIDType>5</PIDType><SID>S-1-5-21-1113955543-3317005351-503478103</SID><SYSTEM/><BIOS/><HWID>68A13407018400FA</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90120000-0012-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Standard 2007</Name><Ver>12</Ver><Val>8ABE66D1AD36EC0</Val><Hash>RjTUlRFd4/Lq0jkHxrTRZNYjgI0=</Hash><Pid>89396-864-9221007-65728</Pid><PidType>8</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  
Spsys.log Content: 0x80070002
Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.
Error: 0x80070426 
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0001000000000000
Event Time Stamp: 3:6:2013 18:54
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered Service: sppsvc

HWID Data-->
HWID Hash Current: MgAAAAEABAABAAEAAAABAAAAAgABAAEAJJRud+ggSOSqdoCfzAbEzz5mIiNq01A9KoU=
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name OEMID Value OEMTableID Value
  APIC   041009  APIC1733
  FACP   041009  FACP1733
  MCFG   041009  OEMMCFG 
  OEMB   041009  OEMB1733
  GSCI   041009  GMCHSCI 
  SSDT   DpgPmm  CpuPm

This PC is constantly de-regestering itself, have tried alternate freshly generated keys from MSDN account, re-installed to a different HDD.
I am now at the end of my knowledge and seek help please.

NoelDP · 07 Mar 2013

You have a VERY rare error -
Cached Online Validation Code: N/A, hr = 0xc002001b

... and a service tamper
Tampered Service: sppsvc

Please open an Elevated (Administrator) Command Prompt window and use the following commands....

net start sppsvc
sc qc sppsvc
sc queryex sppsvc
sc qprivs sppsvc
sc qsidtype sppsvc
sc sdshow sppsvc

Copy and paste the output to your reply

Here are some instructions to make life easier :)
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

(I'm asking a moderator to split this thread so it gets the attention it deserves.)

SkrumpyJax · 07 Mar 2013

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>net start sppsvc
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.


C:\Windows\system32>sc qc sppsvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: sppsvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START  (DELAYED)
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Windows\system32\sppsvc.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Software Protection
        DEPENDENCIES       : RpcSs
        SERVICE_START_NAME : NT AUTHORITY\NetworkService

C:\Windows\system32>sc queryex sppsvc

SERVICE_NAME: sppsvc
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
        PID                : 752
        FLAGS              :

C:\Windows\system32>sc qprivs sppsvc
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: sppsvc
        PRIVILEGES       : SeAuditPrivilege
                         : SeChangeNotifyPrivilege
                         : SeCreateGlobalPrivilege
                         : SeImpersonatePrivilege

C:\Windows\system32>sc qsidtype sppsvc
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: sppsvc
SERVICE_SID_TYPE:  UNRESTRICTED

C:\Windows\system32>sc sdshow sppsvc

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO
CRRC;;;IU)(A;;CCLCSWRPLOCRRC;;;SU)(A;;LCRP;;;AU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCW
DWO;;;WD)

C:\Windows\system32>

SkrumpyJax · 07 Mar 2013

Thanks for the help so far and in advance.

NoelDP · 07 Mar 2013

Odd - that's all perfectly normal.
I wonder if it's a SubKey in the registry, or a new Value?

Please run the following commands and post the results

REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\SPPSVC /s
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR /S
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SLSVC
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SPPSVC

SkrumpyJax · 07 Mar 2013

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\SPPSVC /s

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPPSVC
    DisplayName    REG_SZ    @%SystemRoot%\system32\sppsvc.exe,-101
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\sppsvc.exe
    Description    REG_SZ    @%SystemRoot%\system32\sppsvc.exe,-100
    ObjectName    REG_SZ    NT AUTHORITY\NetworkService
    ErrorControl    REG_DWORD    0x1
    Start    REG_DWORD    0x2
    DelayedAutoStart    REG_DWORD    0x1
    Type    REG_DWORD    0x10
    DependOnService    REG_MULTI_SZ    RpcSs
    ServiceSidType    REG_DWORD    0x1
    RequiredPrivileges    REG_MULTI_SZ    SeAuditPrivilege\0SeChangeNotifyPrivil
ege\0SeCreateGlobalPrivilege\0SeImpersonatePrivilege
    FailureActions    REG_BINARY    80510100000000000000000003000000140000000100
0000C0D4010001000000E09304000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SPPSVC\Security
    Security    REG_BINARY    01001480A0000000AC000000140000003000000002001C0001
00000002801400FF010F00010100000000000100000000020070000500000000001400FD01020001
010000000000051200000000001800FF010F0001020000000000052000000020020000000014009D
010200010100000000000504000000000014009D0102000101000000000005060000000000140014
00000001010000000000050B000000010100000000000512000000010100000000000512000000


C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPL
DR /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR
    NextInstance    REG_DWORD    0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000
    Service    REG_SZ    spldr
    Legacy    REG_DWORD    0x1
    ConfigFlags    REG_DWORD    0x400
    Class    REG_SZ    LegacyDriver
    ClassGUID    REG_SZ    {8ECC055D-047F-11D1-A537-0000F8753ED1}
    DeviceDesc    REG_SZ    Security Processor Loader Driver
    Capabilities    REG_DWORD    0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000\Control
    ActiveService    REG_SZ    spldr


C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SLS
VC
ERROR: The system was unable to find the specified registry key or value.

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SPP
SVC
ERROR: The system was unable to find the specified registry key or value.

C:\Windows\system32>

NoelDP · 07 Mar 2013

That's normal as well.
Back to basics, then :)

Please run a full CHKDSK and SFC scan....

Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

CHKDSK C: /R

and hit the Enter key.
You will be told that the drive is locked,
and the CHKDSK will run at he next boot - hit the Y key, press Enter, and then reboot.

The CHKDSK will take a few hours depending on the size of the drive, so be patient!

After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -
then run the SFC.

SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

SFC /SCANNOW

and hit the Enter key

Wait for the scan to finish - make a note of any error messages - and then reboot.

Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and attach it to your reply

Post a new MGADiag report with details of any error messages encountered.

SkrumpyJax · 08 Mar 2013

When I've run SFC /scannow on this pc in an elevated cmd prompt previously it's given a windows protection error.
There was only so much I could do on RDP last night and the chkdsk must have error'd as the pc didn't come back online. I will try and get round there over the weekend and see what went wrong.
Thanks for the help so far!

SkrumpyJax · 11 Mar 2013

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 50
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-JW6W3-RHH8B-DY2T4
Windows Product Key Hash: kVEtlTjyRvVl6nCMhy78CAl9ghI=
Windows Product ID: 00371-220-3620136-86822
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {8E580F9E-59F8-4C86-95A3-6E54C1C9D095}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.120830-0333
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 100 Genuine
Microsoft Office Standard 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Users\WineCellar\AppData\Local\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{8E580F9E-59F8-4C86-95A3-6E54C1C9D095}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-DY2T4</PKey><PID>00371-220-3620136-86822</PID><PIDType>5</PIDType><SID>S-1-5-21-1113955543-3317005351-503478103</SID><SYSTEM><Manufacturer>BIOSTAR Group</Manufacturer><Model>G31-M7 TE</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>080014 </Version><SMBIOSVersion major="2" minor="5"/><Date>20090410000000.000000+000</Date></BIOS><HWID>68A13407018400FA</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90120000-0012-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Standard 2007</Name><Ver>12</Ver><Val>8ABE66D1AD36EC0</Val><Hash>RjTUlRFd4/Lq0jkHxrTRZNYjgI0=</Hash><Pid>89396-864-9221007-65728</Pid><PidType>8</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: 770bc271-8dc1-467d-b574-73cbacbeccd1
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00172-220-362013-00-2057-7601.0000-0662013
Installation ID: 010436807745340052020934108910242202151016895816377255
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: DY2T4
License Status: Notification
Notification Reason: 0xC004F009 (grace time expired).
Remaining Windows rearm count: 4
Trusted time: 11/03/2013 19:13:57

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0xC004C532
HealthStatus: 0x0000000000000000
Event Time Stamp: 3:8:2013 09:53
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MgAAAAEABAABAAEAAAABAAAAAgABAAEAJJRud+ggSOSqdoCfzAbEzz5mIiNq01A9KoU=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name	OEMID Value	OEMTableID Value
  APIC			041009		APIC1733
  FACP			041009		FACP1733
  MCFG			041009		OEMMCFG 
  OEMB			041009		OEMB1733
  GSCI			041009		GMCHSCI 
  SSDT			DpgPmm		CpuPm

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sfc /scannow

Beginning system scan. This process will take some time.

Windows Resource Protection could not perform the requested operation.

C:\Windows\system32>

NoelDP · 11 Mar 2013

The installed Key is an MSDN license - I trust that the user is a member of MSDN/TechNet?? (otherwise the license is counterfeit, and cannot be activated)

There are a lot of errors in the CBS.log - here's the list from yesterday alone.....

Code:

Line 83281: 2013-03-10 09:37:36, Error                 CSI    00000005 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83282: 2013-03-10 09:37:36, Error                 CSI    00000006@2013/3/10:09:37:36.100 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83284: 2013-03-10 09:37:36, Error                 CSI    00000007 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #81315# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83301: 2013-03-10 09:37:38, Error                 CSI    00000009 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83302: 2013-03-10 09:37:38, Error                 CSI    0000000a@2013/3/10:09:37:38.475 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83304: 2013-03-10 09:37:39, Error                 CSI    0000000b (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #162658# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83327: 2013-03-10 09:38:01, Error                 CSI    0000000d (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83328: 2013-03-10 09:38:01, Error                 CSI    0000000e@2013/3/10:09:38:01.225 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83330: 2013-03-10 09:38:01, Error                 CSI    0000000f (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #244002# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83353: 2013-03-10 09:38:23, Error                 CSI    00000011 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83354: 2013-03-10 09:38:23, Error                 CSI    00000012@2013/3/10:09:38:23.459 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83356: 2013-03-10 09:38:23, Error                 CSI    00000013 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #325346# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83379: 2013-03-10 09:38:46, Error                 CSI    00000015 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83380: 2013-03-10 09:38:46, Error                 CSI    00000016@2013/3/10:09:38:46.053 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83382: 2013-03-10 09:38:46, Error                 CSI    00000017 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #406690# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83405: 2013-03-10 09:39:10, Error                 CSI    00000019 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83406: 2013-03-10 09:39:10, Error                 CSI    0000001a@2013/3/10:09:39:10.850 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83408: 2013-03-10 09:39:11, Error                 CSI    0000001b (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #488034# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83431: 2013-03-10 09:39:35, Error                 CSI    0000001d (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83432: 2013-03-10 09:39:35, Error                 CSI    0000001e@2013/3/10:09:39:35.709 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83434: 2013-03-10 09:39:36, Error                 CSI    0000001f (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #569378# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83457: 2013-03-10 09:39:58, Error                 CSI    00000021 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83458: 2013-03-10 09:39:58, Error                 CSI    00000022@2013/3/10:09:39:58.834 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83460: 2013-03-10 09:39:59, Error                 CSI    00000023 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #650722# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83483: 2013-03-10 09:40:23, Error                 CSI    00000025 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83484: 2013-03-10 09:40:23, Error                 CSI    00000026@2013/3/10:09:40:23.788 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83486: 2013-03-10 09:40:24, Error                 CSI    00000027 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #732066# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83501: 2013-03-10 09:50:26, Error                 CSI    00000029 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83502: 2013-03-10 09:50:26, Error                 CSI    0000002a@2013/3/10:09:50:26.676 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83504: 2013-03-10 09:50:27, Error                 CSI    0000002b (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #813399# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83533: 2013-03-10 10:56:41, Error                 CSI    00000005 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83534: 2013-03-10 10:56:41, Error                 CSI    00000006@2013/3/10:10:56:41.897 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83536: 2013-03-10 10:56:42, Error                 CSI    00000007 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #81315# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83553: 2013-03-10 10:56:44, Error                 CSI    00000009 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83554: 2013-03-10 10:56:44, Error                 CSI    0000000a@2013/3/10:10:56:44.256 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83556: 2013-03-10 10:56:44, Error                 CSI    0000000b (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #162658# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83579: 2013-03-10 10:57:08, Error                 CSI    0000000d (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83580: 2013-03-10 10:57:08, Error                 CSI    0000000e@2013/3/10:10:57:08.741 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83582: 2013-03-10 10:57:09, Error                 CSI    0000000f (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #244002# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83605: 2013-03-10 10:57:31, Error                 CSI    00000011 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83606: 2013-03-10 10:57:31, Error                 CSI    00000012@2013/3/10:10:57:31.100 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83608: 2013-03-10 10:57:31, Error                 CSI    00000013 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #325346# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83631: 2013-03-10 10:57:53, Error                 CSI    00000015 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83632: 2013-03-10 10:57:53, Error                 CSI    00000016@2013/3/10:10:57:53.366 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83634: 2013-03-10 10:57:53, Error                 CSI    00000017 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #406690# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83657: 2013-03-10 10:58:23, Error                 CSI    00000019 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83658: 2013-03-10 10:58:23, Error                 CSI    0000001a@2013/3/10:10:58:23.069 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83660: 2013-03-10 10:58:23, Error                 CSI    0000001b (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #488034# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83683: 2013-03-10 10:58:47, Error                 CSI    0000001d (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83684: 2013-03-10 10:58:47, Error                 CSI    0000001e@2013/3/10:10:58:47.022 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83686: 2013-03-10 10:58:47, Error                 CSI    0000001f (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #569378# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83709: 2013-03-10 10:59:11, Error                 CSI    00000021 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83710: 2013-03-10 10:59:11, Error                 CSI    00000022@2013/3/10:10:59:11.100 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83712: 2013-03-10 10:59:11, Error                 CSI    00000023 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #650722# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83735: 2013-03-10 10:59:34, Error                 CSI    00000025 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83736: 2013-03-10 10:59:34, Error                 CSI    00000026@2013/3/10:10:59:34.772 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83738: 2013-03-10 10:59:35, Error                 CSI    00000027 (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #732066# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")
 Line 83753: 2013-03-10 11:09:37, Error                 CSI    00000029 (F) Invalid attribute name found: [l:28{14}]"PublicKeyToke."[gle=0x80004005]
 Line 83754: 2013-03-10 11:09:37, Error                 CSI    0000002a@2013/3/10:11:09:37.428 (F) d:\win7sp1_gdr\base\wcp\identity\id_baseidentity.cpp(1263): Error STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME originated in function Windows::Identity::Rtl::Implementation::CRtlIdentityBase::CRtlIdentityBase_Initialize expression: pBAI != 0
 Line 83756: 2013-03-10 11:09:37, Error                 CSI    0000002b (F) STATUS_SXS_INVALID_IDENTITY_ATTRIBUTE_NAME #813399# from Windows::Identity::Rtl::Implementation::CRtlIdentityAuthority::IRtlIdentityAuthority_Parse(flags = 0, string = [l:308{154}]"8bc63dac42e4eabaca3593ddd2f5d84d, Culture=neutral, Version=6.1.7601.22110, PublicKeyToke.=b03f5f7f11d50a3a, ProcessorArchitecture=x86, versionScope=NonSxS")

Analysis to follow :)