Windows 7 Build 7601 - windows not genuine error

annieuk · 21 Aug 2014

I have just noticed the following error message coming up in the right corner of my screen on boot-up...

Windows 7
Build 7601
This copy of windows is not genuine

This error doesn't seem to appear every time I boot and I'm not entirely sure when it began. My PC is custom built and I got it in about Feb/March this year. The last Windows update was on 14th Aug so I assume things were OK then.

When I look at the System in Control Panel, it shows that Windows is activated and has a Product ID code with OEM in the middle of it.

I've tried to read about this online. Am I right in thinking one particular key has stopped working and I might need to use the one on the side of the computer? If so, why would the first one stop and does this mean that I have lost the ability to use the first key and am now only down to one? Sorry if this is a naive question. I'm not at all technical.

Here is my MGADiag report. I'm hoping someone might be able to assist me. Many thanks.

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-99B47-Y269M-2JPX7
Windows Product Key Hash: xRgFpGRNyi3w/mKTlFS16bDXyfs=
Windows Product ID: 00371-OEM-9046153-46557
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {71440050-EAA5-4EB1-8253-F6BA5156798B}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.140303-2144
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 114 Blocked VLK 2
Microsoft Office Professional Edition 2003 - 114 Blocked VLK 2
Microsoft Office FrontPage 2003 - 100 Genuine
Microsoft Office OneNote 2003 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 77F760FE-153-80070002_7E90FEE8-175-80070002_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{71440050-EAA5-4EB1-8253-F6BA5156798B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-2JPX7</PKey><PID>00371-OEM-9046153-46557</PID><PIDType>3</PIDType><SID>S-1-5-21-442994278-4166319896-4171443153</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>H61M-D2H-USB3</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F8</Version><SMBIOSVersion major="2" minor="4"/><Date>20130813000000.000000+000</Date></BIOS><HWID>A9FD3707018400FE</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>114</Result><Products><Product GUID="{90110409-6000-11D3-8CFE-0150048383C9}"><LegitResult>114</LegitResult><Name>Microsoft Office Professional Edition 2003</Name><Ver>11</Ver><Val>59D1605114E3500</Val><Hash>vfZmaSmFPIYrLWTcZSZErUQg+Fo=</Hash><Pid>73931-640-0000106-57580</Pid><PidType>14</PidType></Product><Product GUID="{90170409-6000-11D3-8CFE-0150048383C9}"><LegitResult>100</LegitResult><Name>Microsoft Office FrontPage 2003</Name><Ver>11</Ver><Val>5EA9C3672EB0500</Val><Hash>GZD+9sfb5ecL3RxyV4F75a86u2M=</Hash><Pid>72079-640-0000106-55370</Pid><PidType>14</PidType></Product><Product GUID="{90A10409-6000-11D3-8CFE-0150048383C9}"><LegitResult>100</LegitResult><Name>Microsoft Office OneNote 2003</Name><Ver>11</Ver><Val>5EA9C3672EB0500</Val><Hash>GZD+9sfb5ecL3RxyV4F75a86u2M=</Hash><Pid>70172-640-0000106-55900</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="11" Result="114"/><App Id="16" Version="11" Result="114"/><App Id="17" Version="11" Result="100"/><App Id="18" Version="11" Result="114"/><App Id="19" Version="11" Result="114"/><App Id="1A" Version="11" Result="114"/><App Id="1B" Version="11" Result="114"/><App Id="44" Version="11" Result="114"/><App Id="A1" Version="11" Result="100"/></Applications></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: e120e868-3df2-464a-95a0-b52fa5ada4bf
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00180-461-546557-02-2057-7601.0000-0672014
Installation ID: 004052293360427242226593553752900393700573249100908474
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: 2JPX7
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 21/08/2014 09:59:20

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 6:7:2014 16:42
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: NAAAAAIABAABAAEAAAACAAAAAQABAAEAln0QTZxgqtJiNErdPkJyODB/jiyKm/QBNMiWYw==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            GBT           GBTUACPI
  FACP            GBT           GBTUACPI
  HPET            GBT           GBTUACPI
  MCFG            GBT           GBTUACPI
  MSDM            GBT           GBTUACPI
  ASPT            GBT           PerfTune
  SSPT            GBT           SsptHead
  TAMG            GBT           GBT   B0
  SSDT            INTEL        PPM RCM 
  MATS                    MATS RCM

NoelDP · 21 Aug 2014

There's no problems showing in the report - Windows is properly activated, and was successfully validated on 7th June (or maybe 6th July!). There certainly doesn't look to be anything wrong with your Key.

The symptoms you're describing are typical of a race condition - often caused by conflicting security software.
What AV is currently installed? Whot other security software is installed?
What other AV's have EVER been installed?

annieuk · 21 Aug 2014

Thank you for your reply. The date of activation doesn't seem to fit. I'm pretty sure I did this when the PC was new which was about Feb/March.

I have been running AVG Free 2014 since the PC was new. I'm fairly certain I've never activated Windows Defender and it's not turned on now because I've just checked. I put Malwarebytes Free Ant-Malware on when the news was full of the GameOver Zeus virus which was probably about the beginning of June so could it be this, I wonder?

I've just run a scan with Malwarebytes and there are a few items which have shown up which I've put below.

Code:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 21/08/2014
Scan Time: 20:36:07
Logfile: 
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.08.21.07
Rootkit Database: v2014.08.16.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Chelsea

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 318587
Time Elapsed: 8 min, 58 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 2
PUP.Optional.SystemSpeedup, HKLM\SOFTWARE\WOW6432NODE\SYSTWEAK\ssd, , [d863c10868130c2acd0b06e844be7888], 
PUP.Optional.SystemSpeedup, HKU\S-1-5-21-442994278-4166319896-4171443153-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SYSTWEAK\ssd, , [23181cad24570333b1260fdf8e743ec2], 

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 2
PUP.Optional.AmazonBrowserBar.A, C:\Users\Chelsea\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pbjikboenpfhbbejgkoklgkhjpfogcam, , [af8cc3063e3d67cfda6e02d042c052ae], 
PUP.Optional.SystemSpeedup, C:\Users\Chelsea\AppData\Roaming\systweak\ssd, , [a5964089750656e084c055808e7430d0], 

Files: 7
PUP.Optional.AmazonBrowserBar.A, C:\Users\Chelsea\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pbjikboenpfhbbejgkoklgkhjpfogcam_0.localstorage, , [8ead9b2e611a60d6c78861e833d1ad53], 
PUP.Optional.AmazonBrowserBar.A, C:\Users\Chelsea\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pbjikboenpfhbbejgkoklgkhjpfogcam\000003.log, , [af8cc3063e3d67cfda6e02d042c052ae], 
PUP.Optional.AmazonBrowserBar.A, C:\Users\Chelsea\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pbjikboenpfhbbejgkoklgkhjpfogcam\CURRENT, , [af8cc3063e3d67cfda6e02d042c052ae], 
PUP.Optional.AmazonBrowserBar.A, C:\Users\Chelsea\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pbjikboenpfhbbejgkoklgkhjpfogcam\LOCK, , [af8cc3063e3d67cfda6e02d042c052ae], 
PUP.Optional.AmazonBrowserBar.A, C:\Users\Chelsea\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pbjikboenpfhbbejgkoklgkhjpfogcam\LOG, , [af8cc3063e3d67cfda6e02d042c052ae], 
PUP.Optional.AmazonBrowserBar.A, C:\Users\Chelsea\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pbjikboenpfhbbejgkoklgkhjpfogcam\MANIFEST-000002, , [af8cc3063e3d67cfda6e02d042c052ae], 
PUP.Optional.SystemSpeedup, C:\Users\Chelsea\AppData\Roaming\systweak\ssd\SSDPTstub.exe, , [a5964089750656e084c055808e7430d0], 

Physical Sectors: 0
(No malicious items detected)


(end)

I'm wondering whether the Registry Key errors have anything to do with it. I haven't quarantined these items yet but would be keen to know what you think.

I'm mystified about the Amazon Browser bar too. I have Chrome on my PC but don't tend to use it. I nearly always use Firefox.

NoelDP · 21 Aug 2014

There's a big difference between Activation and validation.

Activation is mandatory - and must normally happen within 30 days of installation. It's done (in theory) once only.

Validation is required only for download and/or installation of certain updates and add-ons - and can happen any number of times (I've done it for a variety of reasons, 5 or 6 times inside an hour)

I would UNINSTALL SystemSpeedUp - it's pure snake-oil - if you installed it. It appears to come from a number of different sources, having been rebadged. You'll need to look closely in the Programs and Features listing.

The Amazon Browser bar could be legit, but it's probably best uninstalled from either the Chrome options, or the Programs & Features listing.

Once both are uninstalled, run MBAM again, in Custom mode, doing a full scan of the C: drive. Delete EVERYTHING it finds.

If you're still having problems after that, I'll take a look at your event logs - they may show something...

Open Event Viewer
click on the Windows logs entry in the left pane to expand it.
Now click on the Application entry - wait while it loads.
Click on 'File' in the menu bar and select Save...
Save the file as Appevt.evtx
Repeat for the System log
then zip both, and upload them to a reply.

annieuk · 21 Aug 2014

Thanks NoelDP. Just to give an update. I wasn't able to find anything in Programs & Features for either SystemSpeedUp or similar or the Amazon Bar and nothing showed up in the Chrome Extensions either.

I resorted to quarantining the items using MalwareBytes and now I'm in the midst of doing a custom scan with MalwareBytes. I ticked to scan rootkits and I'm not sure how long the scan is likely to take. If it goes on much longer, I will try again in the morning.

One thing to note is that after the quarantining, the Build 7601 message didn't reappear but I will need to do a few more reboots before I can safely say that the problem is solved as I don't think the message showed up every time.

In the meantime I'm attaching the Event Logs (hopefully I've done this correctly).

NoelDP · 22 Aug 2014

You're the second person to post in 24 hours with software installed from a company I'd never heard of until yesterday! (O&O Software)

Your System log shows the following recurring service load errors at boot...

Code:

oodivd
oodivdh
UimBus
Uim_DEVIM
Uim_IM

The first two are from tweaking tools by O&O
The rest appear to be from Paragon software.
Do you actually use these tools? (and if so what for?) If not, they are best uninstalled and we'll see if that helps.

annieuk · 22 Aug 2014

Hi,

I have never heard of O & O at all but I did trial some backup software when the system was new and one of the programs was Paragon Backup & Recovery 2014 Free. However, I uninstalled Paragon quite soon afterwards as I decided to use a different program called EaseUs ToDo backup. I also have AOEMI Backupper on the PC which I use sporadically.

I don't see anything labelled O&O or Paragon in my Programs & Features but I'm wondering whether Paragon left any residual files.

I also trialled some other backup software at the time including NovaBackup. There may have been others. I purchased Acronis Backup but found it was too buggy and had that refunded and I removed that program as well.

I can't seem to find a tool to remove Paragon. Do you have any suggestions?

I will redo the Malwarebytes scan as it was taking ages last night so I cancelled it and shut it down. Should I include scanning for rootkits as I believe this is what took the time?

I really appreciate you taking the time to help me with this as I wouldn't have a clue.

annieuk · 22 Aug 2014

I thought it may be useful to show a screenshot of the Programs I have on my PC just in case I'm missing something.