Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Windows not genuine after sfc /scannow following missing dnsapi.dll

20 Oct 2015   #11
jobucks

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 
Resubmitted checksur and event logs

My deep apologies.

The initial run produced no errors and 7 updates. I told it to install the updates. The machine immediately shut down and then was left with 4 updates and the same error as before.




Attached Files
File Type: log CheckSUR.log (1.1 KB, 2 views)
File Type: log CheckSUR.persist.log (2.7 KB, 0 views)
File Type: zip eventlogs.zip (4.42 MB, 1 views)
My System SpecsSystem Spec
.
20 Oct 2015   #12
NoelDP

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
 
 

Not your fault - obviously a bug in CheckSUR somewhere. It got it right this time

The problem seems to be with permissions somewhere - the first two errors in a boot sequence are both 'Access Denied' ones - for DNS Client, and DHCP Client.

Open Regedit, and navigate to the
HKLM\SYSTEM\CurrentControlSet\Services folder -

Look there for the entry for Dhcp
Right-click on it and select Permissions
Please list all the entries in the Security tab's top window - if SYSTEM is present, highlight it, and list the tcked entries in the bottom windows

repeat for the DNScache entry

Then close Regedit and post the results

Open an Elevated Command Prompt, and run the following commands:

REG QUERY HKLM\SYSTEM\CurrentControlSet\Services /S >> "%userprofile%\desktop\dhcpdns.txt"
REG QUERY HKLM\SYSTEM\CurrentControlSet\DNScache /S >> "%userprofile%\desktop\dhcpdns.txt"

This will put a file on your desktop - dhcpdns.txt - please upload it to your reply
My System SpecsSystem Spec
20 Oct 2015   #13
jobucks

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 

Thank you again.

I opened regedit and the permissions for SYSTEM appear to be on.

REG QUERY for Services ran and I attach the file.

REG QUERY for DNS Cache said there was no key.

I attach screen shots of the message, the permissions and the presence of an Unknown user.

Thanks again, Jo

PS I had to zip the .txt file because it was too big - did I run it more than once perhaps?


Attached Thumbnails
Windows not genuine after sfc /scannow following missing dnsapi.dll-no_key.png  
Attached Images
Windows not genuine after sfc /scannow following missing dnsapi.dll-permissions.png Windows not genuine after sfc /scannow following missing dnsapi.dll-extra-user-dnscache.png 
Attached Files
File Type: zip dhcpdns.zip (420.1 KB, 4 views)
My System SpecsSystem Spec
.

21 Oct 2015   #14
NoelDP

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
 
 

Yeah - my mistake on the commands - but it contains the data we need, anyhow
back later when I get time to digest it!
My System SpecsSystem Spec
21 Oct 2015   #15
jobucks

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 
Extra info - maybe irrelevant - dnsapi.dll

The thread seems to have got tangled.

I am too out of my depth to know if this is relevant - but from the outset the dnsapi.dll has been missing and the firewall was quarantining a trojan that arrived with the updates.
My System SpecsSystem Spec
21 Oct 2015   #16
NoelDP

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
 
 

The SFC scan doesn't show any problems about a missing dnsapi.dll - I suspect that it may have been part of your Trojan.
Are you getting the error at boot every time? What is the EXACT error message?
My System SpecsSystem Spec
21 Oct 2015   #17
jobucks

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 
Error msgs on boot

1. The Windows Activation / Windows is not genine / Get genuine now / Ask me later / 0x80070005

2. At bottom left: Windows 7 Build 7601 This copy of Windows is not genuine.

3. The next visible message is from Skype saying it cannot load then dnsapi.dll

4. Firefox crashes

5. Chrome and Opera hang.

6. Somewhere after a restore the internet connection got scribbled (could no longer ping). I attach a screen shot and the log file. I can see the problem is the connection to an unidentified public network but I can't find how to disconnect it.

Thanks - I hope this is not trying your patience too much. Jo


Attached Thumbnails
Windows not genuine after sfc /scannow following missing dnsapi.dll-network_connections.png   Windows not genuine after sfc /scannow following missing dnsapi.dll-captur.png  
Attached Images
Windows not genuine after sfc /scannow following missing dnsapi.dll-firefox_crash.png Windows not genuine after sfc /scannow following missing dnsapi.dll-homegroup_diagnostics.png Windows not genuine after sfc /scannow following missing dnsapi.dll-victim_of.png 
Attached Files
File Type: zip homenetwork_diagnostics.zip (142.4 KB, 3 views)
My System SpecsSystem Spec
21 Oct 2015   #18
torchwood

W7 home premium 32bit/W7HP 64bit/w10 tp insider ring
 
 

That unknown ssid 556 relates to the fact that the machine has been turned into a domain controller, which is further confirmed by the multiple networks screenshot.
This in turn has modified permissions on this comp.

Firewalls DO NOT quarintine they block, and i have never known of any MS update containing a virus.
What AV are you running, and what were the last results from its log files
Roy
My System SpecsSystem Spec
21 Oct 2015   #19
jobucks

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 
Info requested by Roy

Thanks Roy - I am afraid I am out of my depth here. I am hoping Noel still has the patience to guide me through this.

The history was that I was away for two weeks and the original problem emerged when I powered up. I use Microsoft Security Essentials.

Thanks for the pointer. I will read up DC to be a little less ignorant of what is happening.

Jo
My System SpecsSystem Spec
22 Oct 2015   #20
NoelDP

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
 
 

I don't believe that it has anything to do with a Domain Controller?

Let's work on the basis that the dnsapi.dll is present - and check the permissions on it.

Open an Elevated Command Prompt, and run the following commands:

ICACLS C:\Windows\System32\dnsapi.dll /T
ICACLS C:\Windows\winsxs\dnsapi.dll /T
ICACLS C:\Windows\SysWOW64\dnsapi.dll /T
DIR C:\Windows\dnsapi.dll /S

(The last one will take a couple of minutes to complete - be patient!)

post the results...

Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.
My System SpecsSystem Spec
Reply

 Windows not genuine after sfc /scannow following missing dnsapi.dll




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Cannot connect to Malwarebytes DNSAPI.DLL Missing
So my internet connection randomly went out tonight. I reset my modem/router several times, unplugged chords and made sure everything was plugged in. It showed the internet as connected (I wire my connection with a 40ft cable) however I could not access websites; it immediately gave me a screen...
Network & Sharing
Windows Seven, No Longer genuine (Sfc /Scannow probably caused it).
After sucessfully removing a lot of viruses with malwarebytes and manual cleaning. I trying to fix the lsp by running an /SFC Scannow on the cmd; but when it was finished it said it successfully repaired a lode of files. After a reboot, I find that my Avast, internet, lsp are all still busted...
Windows Updates & Activation
tom982 - sfc /scannow unable to repair missing ATL80.dll file
Hello, I read with interest that tom982 has a way of giving special instructions for repairing corrupt or missing files that sfc /scannow is unable to repair. Maybe others can also help me with this, but I only looked at the following thread mentioning tom982 (so far):...
Performance & Maintenance
Sfc /scannow results - missing file (_isdel.exe)
Hey everyone, I received the follwoing message after running sfc /scannow: Windows Resource Protection found corrupt files but was unable to fix some of them. Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log So I went ahead and opened...
Performance & Maintenance
Windows saying not genuine after bootmgr is missing problem
My computer stopped booting because it said "Bootmgr is missing". So I thought maybe I could use my Vista DVD to do Startup Repair (my Win 7 DVD is missing). It didn't work for the first time - so I did it again... successful! Bootmgr is missing went away and my computer is working again. I...
Installation & Setup


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 23:22.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App