Windows 7 Build 7601 Not Genuine - SFC Error

Triton46 · 08 Nov 2014

Hi All,

I have been following directions in several threads here to fix the "Windows 7 Build 7601 This copy of Windows is not genuine" error. Background: This is a licensed copy of Windows on my 1.5 year old Asus EB1503. This just popped up within the last 2 days (noticed it today).

Problems: Normal login: Very slow, hard to type or bring up applications (services.msc, cmd.exe, etc). These can take upward of 5 min. Explorer takes a very long time to come up. Safe Mode: Everything is back to normal performance wise.

CHKDSK c:/ r - Reports disk has no issues. Comes back very fast after reboot.

SFC SCANNOW and SFC /scannow /offbootdir=e:\ /offwindir=e:\windows both fail. The former stops at 32% of verification and reports: "Windows Resource Protection could not start the repair service". The Windows Modules Installer is set to MANUAL.

Attached is my CBS.txt file. Attachment 339819

Is my disk hosed?

Triton46 · 08 Nov 2014

I ran it again, this time starting the Windows Module Installer service as well. This time I get a different error:

"Windows Resource Protection could not perform the requested operation"

2014-11-08 20:52:55, Error CSI 0000011c (F) c0000185 [Error,Facility=(system),Code=389 (0x0185)] #2510043# from Windows::Rtl::SystemImplementation:

irectFileSystemProvider::SysReadFile(h = a10 ("\Device\HarddiskVolume3\Windows\winsxs\amd64_microsoft-windows-ime-korean-hwresource_31bf3856ad364e35_6.1.7600.16385_none_ac4a6957c5dbd4bb\mshwkorrIME.dll"), evt = 0, apcr = NULL, apcc = NULL, iosb = @0x84cbb0, data = {l:0 b:}, byteoffset = 458752 (0x0000000000070000), key = (null))
[gle=0xd0000185]
2014-11-08 20:52:55, Error CSI 0000011d@2014/11/9:01:52:55.756 (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(2155): Error c0000185 [Error,Facility=(system),Code=389 (0x0185)] originated in function Windows::Rtl::SystemImplementation:

irectFileSystemProvider::SysReadFile expression: (null)
[gle=0x80004005]
2014-11-08 20:52:58, Error CSI 0000011e (F) c0000185 [Error,Facility=(system),Code=389 (0x0185)] #2510042# from Windows::Rtl::SystemImplementation::CFile_IRtlFileTearoff::ReadFile(Flags = 3, Buffer = {l:0 ml:65536 b:}, Offset = 458752 (0x0000000000070000), Disposition = 0)[gle=0xd0000185]

NoelDP · 09 Nov 2014

Let's have the MGADiag report please.

Please followthis tutorial and post an MGADiag report - then we can see what the problem is.

https://www.sevenforums.com/windows-updates-activation/234159-windows-genuine-activation-issue-posting-instructions.html

Ignore errors produced when clicking on theCopy button - they simply mean that the tool could not create the backup filesfor some reason. The data is still copied to the clipboard for pasting to yourresponse.

Please also statethe Version and Edition of Windows quoted on your COA sticker (if you have one)on the case of your machine (or inside the battery compartment), but do NOTquote the Key on the sticker!

http://www.microsoft.com/en-us/howtotell/Hardware.aspx

NoelDP · 09 Nov 2014

Your SFC scan crashed with the following error...

Code:

2014-11-08 15:25:24, Error                 CSI    00000232 (F) c0000185 [Error,Facility=(system),Code=389 (0x0185)] #5016923# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysReadFile(h = 8b0 ("\Device\HarddiskVolume3\Windows\winsxs\amd64_microsoft-windows-ime-korean-hwresource_31bf3856ad364e35_6.1.7600.16385_none_ac4a6957c5dbd4bb\mshwkorrIME.dll"), evt = 0, apcr = NULL, apcc = NULL, iosb = @0xa3cd20, data = {l:0 b:}, byteoffset = 458752 (0x0000000000070000), key = (null))
[gle=0xd0000185]
2014-11-08 15:25:24, Error                 CSI    00000233@2014/11/8:20:25:24.305 (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(2155): Error c0000185 [Error,Facility=(system),Code=389 (0x0185)] originated in function Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysReadFile expression: (null)
[gle=0x80004005]
2014-11-08 15:25:24, Error                 CSI    00000234 (F) c0000185 [Error,Facility=(system),Code=389 (0x0185)] #5016922# from Windows::Rtl::SystemImplementation::CFile_IRtlFileTearoff::ReadFile(Flags = 3, Buffer = {l:0 ml:65536 b:}, Offset = 458752 (0x0000000000070000), Disposition = 0)[gle=0xd0000185]
2014-11-08 15:35:25, Info                  CBS    Reboot mark refs incremented to: 1
2014-11-08 15:35:25, Info                  CBS    Scavenge: Starts

You say that you ran CHKDSK - please post the log files...

Open Event Viewer

click on theWindows logs entry in the left pane to expand it.

Now click on the Application entry - wait while it loads.

Click on 'File' in the menu bar and select Save...

Save the file as Appevt.evtx

Repeat for the System log

then zip both, and upload them.

Triton46 · 09 Nov 2014

I replaced that file: mshwkorrIME.dll and the sfc scannow is progressing. I'll gather the other logs and upload.

Non-safemode is still very slow...15 min for explorer to come up. Shutdown took 30 min.

Also, I tried creating a new profile...no luck...still get the same "not genuine" screen and slowness with the new profile.

Triton46 · 09 Nov 2014

OK, I got the sfc scan to complete:

Code:

c:\Windows\System32>sfc /scannow

Beginning system scan.  This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.

Windows Resource Protection did not find any integrity violations.

Attachment 339865 Attached Event logs. Working on diagnosis.

Triton46 · 09 Nov 2014

MGADiag

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 50
Cached Online Validation Code: N/A, hr = 0x8007043c
Windows Product Key: *****-*****-BJD6C-K3YVH-DVQJG
Windows Product Key Hash: WFqPPaNJ0hrc3E/8MgITJa2Xf0M=
Windows Product ID: 00359-OEM-8992687-00118
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {A75E65D6-7D3B-4C4C-A69D-AE006962FF9A}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.140303-2144
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{A75E65D6-7D3B-4C4C-A69D-AE006962FF9A}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-DVQJG</PKey><PID>00359-OEM-8992687-00118</PID><PIDType>2</PIDType><SID>S-1-5-21-612552391-2311362538-1607580098</SID><SYSTEM><Manufacturer>ASUSTeK Computer INC.</Manufacturer><Model>EB1503</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>0502</Version><SMBIOSVersion major="2" minor="7"/><Date>20120523000000.000000+000</Date></BIOS><HWID>F9613807018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>_ASUS_</OEMID><OEMTableID>Notebook</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x8007043C' to display the error text.
Error: 0x8007043C 

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 10:1:2014 21:36
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Not Registered - 0x8007043c
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: LAAAAAIAAQABAAEAAAAAAAAAAgABAAEA6GHOoBa2TSbIYyDPEN0edhSHBBo=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            ALASKA        A M I
  FACP            ALASKA        A M I
  HPET            ALASKA        A M I
  MCFG            ALASKA        A M I
  RTCF            A1234        RTCONFIG
  IFEU            ALASKA        A M I
  SLIC            _ASUS_        Notebook

NoelDP · 09 Nov 2014

I fond myself wondering about the machine's history here....
The report you posted is from a Safe Mode boot - and not terribly reliable.

The installed Product Key is for Home Premium - but the machine appears to me to have been shipped only with Home Basic or Starter (but I could be way off base!).

If I'm right (no guarantees!) then that would explain your problems, since the SLIC table would almost certainly not allow the 'upgrade'.

Please check your machine's case - is there a COA sticker on the case?? If so, for which version and edition is it valid?

Triton46 · 09 Nov 2014

The machine was purchased on Amazon (from Asus) on 04/2013 as brand new. It's an Eeebox (EB1503). It has ran flawlessly (24/7) as a media pc/server until this issue.

The sticker on the side states:
Windows 7 Home Premium OA

The MGADiag will not run in normal mode. 30 min for Explorer.exe to come up, MGADiag took 1 hour to come up after clicking on it, and then it ran for another 1hour before Explorer was frozen. I kept getting popups for Explorer (Would you like to stop the process?). Ctrl-Alt-Del in normal mode no longer functions, I get a pop up telling me to press the power button.

Safe Mode with networking is about all I have at this point.

I'm currently running Spybot/Teatimer, MalwareBytes, and CheckSur to investigate further.

Also, I removed AVG (clean uninstall and then ran the remover program).

NoelDP · 09 Nov 2014

we need to see afull copy of the report produced by the MGADiag tool

(download andsave to desktop - http://go.microsoft.com/fwlink/?linkid=52012)

Once saved, run the tool.

Click on theContinue button, which will produce the report.

To copy the report to your response, click onthe Copy button in the tool (ignore any error messages at this point), and thenpaste (using either r-click/Paste, or Ctrl+V ) into your response.

- in your own thread, please

Please also statethe Version and Edition of Windows quoted on your COA sticker (if you have one)on the case of your machine (or inside the battery compartment), but do NOTquote the Key on the sticker!

http://www.microsoft.com/en-us/howtotell/Hardware.aspx