This computer is not running genuine Windows, error 0x8004fe21

vedlos · 07 Sep 2015

Hi,

I'm having the same problem as some other people with this popup telling me my Windows 7 copy is not legal.

I did some research and tried to uninstall KB 3004394 (didn't work), then tried to install KB 3024777 (didn't work either). I phoned Microsoft twice, first the activation people reactivated the copy, but the error kept appearing. And today Technical Support was doing some stuff by remote assistance, and they they told me "if the problem persisted" I should do a clean reinstall. And the problem persists.

This is my MGADiag report:

Code:

Diagnostic Report (1.9.0019.0):
-----------------------------------------
WGA Data-->
Validation Status: Genuine
Validation Code: 0

Cached Validation Code: 0x0
Windows Product Key: *****-*****-JXW6K-7QH84-TQWJW
Windows Product Key Hash: 7gBQ34rewf5uJBMrPlnjleORDyA=
Windows Product ID: 00371-618-4750093-85951
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {D85E9675-4B97-442E-B51C-CFAB8599EDB6}(3)
Is Admin: Yes
TestCab: 0x0
WGA Version: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.150715-0600
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

WGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 114 Blocked VLK 2
Microsoft Office Professional Edition 2003 - 114 Blocked VLK 2
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\Windows\system32\en-us\user32.dll.mui[hr = 0x80070002]

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{D85E9675-4B97-442E-B51C-CFAB8599EDB6}</UGUID><Version>1.9.0019.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-TQWJW</PKey><PID>00371-618-4750093-85951</PID><PIDType>5</PIDType><SID>S-1-5-21-903292933-1070546492-1983568055</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>2003   </Version><SMBIOSVersion major="2" minor="6"/><Date>20101214000000.000000+000</Date></BIOS><HWID>33873F07018400FC</HWID><UserLCID>0C0A</UserLCID><SystemLCID>0C0A</SystemLCID><TimeZone>Hora estándar romance(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>114</Result><Products><Product GUID="{90110C0A-6000-11D3-8CFE-0150048383C9}"><LegitResult>114</LegitResult><Name>Microsoft Office Professional Edition 2003</Name><Ver>11</Ver><Val>59D1605114E3500</Val><Hash>vfZmaSmFPIYrLWTcZSZErUQg+Fo=</Hash><Pid>73961-640-0000106-57840</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="11" Result="114"/><App Id="16" Version="11" Result="114"/><App Id="18" Version="11" Result="114"/><App Id="19" Version="11" Result="114"/><App Id="1A" Version="11" Result="114"/><App Id="1B" Version="11" Result="114"/><App Id="44" Version="11" Result="114"/></Applications></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Versión del Servicio de licencias de software: 6.1.7601.17514

Nombre: Windows(R) 7, Professional edition
Descripción: Windows Operating System - Windows(R) 7, RETAIL channel
Id. de activación: e838d943-63ed-4a0b-9fb1-47152908acc9
Id. de aplicación: 55c92734-d682-4d71-983e-d6ec3f16059f
PID extendido: 00371-00170-618-475009-01-3082-7601.0000-2502015
Id. de instalación: 009874136422744090100151588782105732629913600882821284
URL del certificado de procesador: http://go.microsoft.com/fwlink/?LinkID=88338
URL del certificado de maquina: http://go.microsoft.com/fwlink/?LinkID=88339
URL de la licencia de uso: http://go.microsoft.com/fwlink/?LinkID=88341
URL del certificado de clave de producto: http://go.microsoft.com/fwlink/?LinkID=88340
Clave de producto parcial: TQWJW
Estado de la licencia: con licencia
Recuento de rearmado de Windows restante: 4
Hora de confianza: 07/09/2015 19:55:20

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: 0x00000000
HealthStatus: 0x0000000000000200
Event Time Stamp: 9:1:2015 18:53
WAT Activex: Registered
WAT Admin Service: Registered

HWID Data-->
HWID Hash Current: LgAAAAEAAgABAAEAAAACAAAAAQABAAEAln1g5T3o5nbY4G68Rh8yt5IyoHlcXQ==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            121410        APIC1527
  FACP            121410        FACP1527
  HPET            121410        OEMHPET 
  MCFG            121410        OEMMCFG 
  OEMB            121410        OEMB1527
  ASPT            121410        PerfTune
  OSFR            121410        OEMOSFR 
  SSDT            DpgPmm        CpuPm

Here is also the SFC /SCANNOW report:

https://www.dropbox.com/s/lfp5jwxp7ufmpm5/CBS.zip?dl=0

I really hope you guys can help me out with this... Thanks!!

NoelDP · 08 Sep 2015

File Scan Data-->
File Mismatch: C:\Windows\system32\en-us\user32.dll.mui[hr = 0x80070002]

The error message implies that the file is missing - but the SFC scan appeared to find it OK

This may mean a number of things...
Let's see if we can work out which one...

Please open an Elevated Command Prompt, and run the following commands:

ICACLS C:\Windows\System32\user32.* /T
ATTRIB C:\Windows\System32\user32.* /S

Each will take a minute or two to run - be patient!
Post the results...
Here are some instructions to make life easier :)
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

vedlos · 08 Sep 2015

There you go:

Code:

Microsoft Windows [Versión 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. Reservados todos los derechos.

C:\Windows\system32>ICACLS C:\Windows\System32\user32.* /T
C:\Windows\System32\user32.dll NT SERVICE\TrustedInstaller:(F)
                               BUILTIN\Administradores:(RX)
                               NT AUTHORITY\SYSTEM:(RX)
                               BUILTIN\Usuarios:(RX)

C:\Windows\System32\es-ES\user32.dll.mui NT SERVICE\TrustedInstaller:(F)
                                         BUILTIN\Administradores:(RX)
                                         NT AUTHORITY\SYSTEM:(RX)
                                         BUILTIN\Usuarios:(RX)

C:\Windows\System32\LogFiles\WMI\RtBackup\user32.*: Acceso denegado.
Se procesaron correctamente 2 archivos; error al procesar 1 archivos

C:\Windows\system32>ATTRIB C:\Windows\System32\user32.* /S
A            C:\Windows\System32\es-ES\user32.dll.mui
A            C:\Windows\System32\manifeststore\user32.amx
A            C:\Windows\System32\user32.dll

C:\Windows\system32>

The words in Spanish berween both commands mean "Access denied. 2 files were processed correctly, error processing 1 file."

Thanks a lot!

NoelDP · 08 Sep 2015

The results are exactly as I would have expected.
The problem appears to be a mismatch in language versions.
I've never seen this exact problem before so I'm going to have to grope around a bit to work out what's happening.
Back later

vedlos · 01 Oct 2015

Hi, Noel.

Did you manage to find out any possible solution to the language mismatch?

Thanks!

NoelDP · 01 Oct 2015

Sorry! - you fell off my ToDo list

I'll review tonight and get back to you.

vedlos · 01 Oct 2015

No problem! I really appreciate your help!

NoelDP · 01 Oct 2015

The only thing I can think of is that you may have installed mismatched update somehow

I need a few files....
Open Event Viewer
click on the Windows logs entry in the left pane to expand it.
Now click on the Application entry - wait while it loads.
Click on 'File' in the menu bar and select Save...
Save the file as Appevt.evtx
Repeat for the System log
then zip both, and upload them.

ALSO...
I need to have a look at your COMPONENTS registry hive

Please copy the C:\Windows\System32\config\COMPONENTS file (no extension) to your desktop and then compress it - upload the compressed file to your favoured fileshare site (preferably Dropbox or OneDrive) and post a link.

vedlos · 01 Oct 2015

NoelDP said:

The only thing I can think of is that you may have installed mismatched update somehow

I had to repair Windows Update, it might have been that...

NoelDP said:

Open Event Viewer
click on the Windows logs entry in the left pane to expand it.
Now click on the Application entry - wait while it loads.
Click on 'File' in the menu bar and select Save...

In the menu bar I only see "Save all events as..." Anyway I've saved and zipped both with the components file:

https://www.dropbox.com/s/4m89kk0kb7r4am7/Logs.zip?dl=0

Thanks!

NoelDP · 01 Oct 2015

Hmmm - this has worked for me once or twice in the past with the error-code here...

Please run the following commands in an Elevated Command Prompt

NET STOP CRYPTSVC
REN C:\WINDOWS\SYSTEM32\CATROOT2 CATROOT2OLD
NET START CRYPTSVC

once complete, leave the system alone for at least an hour to rebuild the database, then reboot, and run another MGADiag report and post the results.

Note that this may delete your Update History - but all updates will remain installed, and can be viewed in the Installed Updates listing.