Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Windows 7 activation issue (real or fake?)

06 May 2015   #1
RonM

windows 7 home premium 32 bit
 
 
Windows 7 activation issue (real or fake?)

I had a virus problem with my PC about a month ago. I took it to a PC repair shop for repair and they told me that it would be a good idea to upgrade my PC from XP to Win 7 in addition to correcting the virus issue.

They upgraded my PC and everything seem OK for about a month and then a Window activation message popped up whenever I booted my PC and periodically while running. The message indicates that Windows must be activated and to click on a link for online processing. I also noticed that when the message appears the wallpaper is disabled.

I called the shop they told me to bring it in, which I did and they checked and claim windows was activated and that the pop-up is a virus/trojan.

Form reading several threads on the web it appears that others have also run into this issue.

But I ran malwarebytes and spybot and neither picked up the issue.

I emailed malwarebytes and they think that this copy of windows may not be legit. And Murice in product support suggested that I mention Noel Paton as someone who should look into this on your forum.

I ran the MGADiag program and here are the results.


Code:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 50
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-74XYM-BH4JX-XM76F
Windows Product Key Hash: KeYfcvXg/a1Q01x73+f8IL/JC4Y=
Windows Product ID: 00359-112-0000007-85721
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {2E9A562F-7F02-4A0A-AAEE-C346F7C20830}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.140303-2144
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 100 Genuine
Microsoft Office Enterprise 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-b01a_E2AD56EA-766-0_E2AD56EA-148-80004005_16E0B333-89-80004005_B4D0AA8B-1029-80004005

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE; Win32)
Default Browser: C:\Program Files\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\user32.dll[6.1.7600.16385], Hr = 0x800b0100

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{2E9A562F-7F02-4A0A-AAEE-C346F7C20830}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-XM76F</PKey><PID>00359-112-0000007-85721</PID><PIDType>5</PIDType><SID>S-1-5-21-3988670118-4129494783-1430437545</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Vostro 200</Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>1.0.11</Version><SMBIOSVersion major="2" minor="5"/><Date>20080131000000.000000+000</Date></BIOS><HWID>BF183D07018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>FX09   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>7480B9502DF0D86</Val><Hash>oYWOW5ayFE3pZ+jvTpuXYsY64JE=</Hash><Pid>89388-707-8722531-65357</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: 2e7d060d-4714-40f2-9896-1e4f15b612ad
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00170-112-000000-00-1033-7601.0000-0912015
Installation ID: 008392973385675234351915679195294281180105449813224200
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: XM76F
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 5/6/2015 11:25:39 AM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0xC004F022
HealthStatus: 0x0000000000000000
Event Time Stamp: 4:1:2015 18:35
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MAAAAAEABAABAAEAAAABAAAAAQABAAEAJJRkUkZvYCGI/eZyZP7m3uYPri4EVyqF

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x0
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name	OEMID Value	OEMTableID Value
  APIC			DELL  		FX09   
  FACP			DELL  		FX09   
  HPET			DELL  		FX09   
  MCFG			DELL  		FX09   
  SLIC			DELL  		FX09   
  DMY2			DELL  		FX09   
  SSDT			PmRef		CpuPm



My System SpecsSystem Spec
.
06 May 2015   #2
NoelDP

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
 
 

The installed Product Key is the Default Key, which can NEVER be activated, legally.
Your machine looks as if it originally shipped with Vista installed - What does the COA sticker on the case say?

The current install is classed as counterfeit, because the Key cannot be activated legally, and yet is apparently activated. The only way this could happen is if there is a hacker's Activation Exploit present to bypass activation and validation requirements.
I can also tell you which hack it is that's installed - it produces characteristic errors in the MGADiag report. Part of it has broken down, probably as a result of cleanup operations (has an SFC /SCANNOW been run at some time since?)


When the shop upgraded your machine - they should have given you the (holographic) reinstall media, and (MOST important) the new Product Key on either a COA sticker, or a Proof of License card.
Did they do this?
If not, then they sold you a counterfeit, and you should threaten them with action for misrepresentation and fraud (as well as counterfeiting). They also stand a good chance of a visit from the FBI if you actually follow through (the FBI has jurisdiction in the US over software counterfeiting).

In short - go for the jugular!
My System SpecsSystem Spec
06 May 2015   #3
RonM

windows 7 home premium 32 bit
 
 

I purchased the PC directly from Dell several years ago and it had XP Home Edition installed (that is also what's on the sticker on the PC).

I am not sure what SFC/SCANNOW is but I didn't run it. It may have been run by the PC shop.

I did not receive anything from the PC shop when I picked up my PC.

Thanks for your help on this.
My System SpecsSystem Spec
.

06 May 2015   #4
NoelDP

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
 
 

Good luck!
Feel free to come back with supplementary questions if you need to.
My System SpecsSystem Spec
06 May 2015   #5
RonM

windows 7 home premium 32 bit
 
 

Have one question related to the Vista question.

When the PC shop installed Win 7 they switched my two drives. The original drive was smaller than another I installed a couple of years after purchase.

When I picked up the PC after the Win & install I noticed that my d drive is now c and c is now d. And the windows XP appears to be on d.

Could the shop have installed Vista and then upgraded to Win 7 to somehow try to hide that it was not a genuine version?
My System SpecsSystem Spec
06 May 2015   #6
NoelDP

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
 
 

That makes no difference to the license - I was reading the BIOS data 'blind', which shows that the BIOS date is 2008, and the SLIC table is a v2.0 one.

Vista was released to manufacture late in 2006, together with the 'new' v2.0 BIOS SLIC tables. These tables are what allow a Windows install to be self-activating right out of the box, and all machines from large manufacturers have them. They are (to an extent) backwards-compatible, so may be able to activate an XP Home install.

Since your machine has an XP Home COA sticker on the case, there is no doubt that it came with XP Home pre-installed.

Your discovery about the disk letter changes is interesting, though, since it shows that they could not have used OEM media (and Key) for the 'upgrade', as that does not allow such a procedure. They must therefore have used 'Retail' media - either an Upgrade or Full retail Key. The Default Key acts in all respects as a Full Retail Key apart from the fact that it is blocked by MS from activation, and cannot therefore ever be activated on ANY machine. It's likely that your store just chose to install this and then the hack because it's effectively free for them, so anything they get from you for the 'license' is clear profit.

Had they done the job properly, it would have cost them in the region of $75 for the license and disk(s) depending on how they managed to do it (they would actually nowadays have had to have bought a OEM System Builder kit for you, since MS stopped selling retail and upgrades some time ago). Then there's the cost of install and whatever cleanup they did actually do on your old install. You'd have been lucky to get away with less than $150 for a bill, and it could easily have come to over $250.
My System SpecsSystem Spec
06 May 2015   #7
RonM

windows 7 home premium 32 bit
 
 

It did cost me about $150 for the "upgrade" and cleanup.
My System SpecsSystem Spec
07 May 2015   #8
NoelDP

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
 
 

So they definitely ripped you off! demand a refund and correction.
My System SpecsSystem Spec
07 May 2015   #9
RonM

windows 7 home premium 32 bit
 
 

I went back to the PC shop today and told the owner that after running diagnostics on the PC it appears that the Windows installation is not legit. The owner claims it is legit but would not give me copies of the CD and license (claims it would cost $150-$200). How do I report this shop?
My System SpecsSystem Spec
07 May 2015   #10
NoelDP

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
 
 

Contact Microsoft and the FBI Assuming you're in the USA!)
https://www.microsoft.com/en-gb/howtotell/default.aspx

https://www.microsoft.com/en-gb/howt...fr/report.aspx

FBI

Did you tell them that you propose to report them to the FBI unless you receive satisfaction? In writing??
My System SpecsSystem Spec
Reply

 Windows 7 activation issue (real or fake?)




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Skydive fake or real?
open to debate!! vleQ1bh-YAM
Chillout Room
real or fake?
I have Microsoft Security Essentials on my computer. Lately I'm getting a warning popup. Is this actually MSSE or is it malware?
System Security
how to tell fake windows 7 ultimate from the real thing without openin
I bought a copy of Windows 7 ultimate off ebay, at the time when I activated the key, everything was fine, until recent when I reformatted my PC I realised that I have been scammed, the key I have a MSDN key, the disk inside in fake because the hologram can be peeled off. I can not activate...
General Discussion
fake or real help
Virustotal. MD5: 59495520c6236a722c6df6395a23b34e Trojan Horse Trojan.Generic.60079 probably a variant of Win32/Agent is this file safe it says that 65 percent detected it as a virus but each one has a different name for type of threat i website cheathappens says that it is a fasle postive any...
System Security
7300 Is it Real or Fake
There is a leak floating around for 7300 (x86) Just dont know if it is real or fake Ken
General Discussion
Torrent 7068, Real? Fake?
REAL, FAKE? http://www.masimagenes.com/images/no9c3exnsfe2hrwg59.jpg http://www.masimagenes.com/images/w08pfh2w342kmfl5hge.jpg
General Discussion


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 17:23.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App