Windows 7 turns not genuine after 1.5 years

[iquest]

Yesterday I received a notice that my Windows 7 is not genuine. Below is the reports I run.

The W7 runds my HP desktop I bought 1.5 years ago. Since then I've been receiving updates from Microsoft. I don't remember whether I registered directly with Microsoft or just followed the HP instructions.

About a month ago I started to experience some difficulties with my computer. It would freeze and the Task manager wouldn't be available. The computer would start working after I haphazardly stir cables inside, unhook and hood back the cables connected to the HD.

Any help/advice would be greatly appreciated.

After having previewed my post I can't see how wrap function should work. I didn't edit the report, just pasted it. I hope I did it right.

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 50
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-73CQT-WMF7J-3Q6C9
Windows Product Key Hash: KaFG+RmurcM3ZxzWyfEP9WtPUJw=
Windows Product ID: 00359-OEM-8992687-00010
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {736FAEA0-DF57-4A27-B82A-ED618140DD29}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120503-2030
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Enterprise 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{736FAEA0-DF57-4A27-B82A-ED618140DD29}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-3Q6C9</PKey><PID>00359-OEM-8992687-00010</PID><PIDType>2</PIDType><SID>S-1-5-21-683786449-1924329095-4103933838</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>SLIC-CPC</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>6.05</Version><SMBIOSVersion major="2" minor="6"/><Date>20110118000000.000000+000</Date></BIOS><HWID>A5ED3607018400F2</HWID><UserLCID>1009</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>DDD15FEFA96D86</Val><Hash>CWjDZWB+u86tHXdQsqC51yUlX54=</Hash><Pid>89388-707-7629254-65613</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800010-02-1033-7600.0000-2052009
Installation ID: 006101223921753156155024312081938750716216002746662444
Processor Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88338[/URL]
Machine Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88339[/URL]
Use License URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88341[/URL]
Product Key Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88340[/URL]
Partial Product Key: 3Q6C9
License Status: Notification
Notification Reason: 0xC004F057.
Remaining Windows rearm count: 3
Trusted time: 8/04/12 6:40:07 PM
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 7:21:2012 20:29
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
 
HWID Data-->
HWID Hash Current: LAAAAAEAAQABAAEAAAABAAAAAgABAAEA6GEq/9iGIJF8/FTIAqi+4LQlQho=
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
ACPI Table Name OEMID Value OEMTableID Value
APIC HPQOEM SLIC-CPC
FACP HPQOEM SLIC-CPC
SRAT HPQOEM SLIC-CPC
HPET HPQOEM SLIC-CPC
MCFG HPQOEM SLIC-CPC
OEMB HPQOEM SLIC-CPC
SSDT HPQOEM SLIC-CPC
SSDT HPQOEM SLIC-CPC

 

[Golden]

Hi,

Did you activate this installation using the 25 character key on the COA sticker? On desktops, the COA sticker is attached to the side of the case. On laptops, the COA sticker is attached underneath the laptop, or inside the battery compartment.

Regards,
Golden

 

[iquest]

I don't remember how I activated the system. That was 1.5 years ago. The sticker should be in place, it is just located very inconveniently.

 

[Golden]

Try reactivate it with that COA key, and let us know.

Regards,
Golden

 

[iquest]

It is bad to be stupid - I'm talking about myself.

I tried to re-activate W7 with the key on the sticker and W7 was re-activated successfully. After than I ran a full Norton scan and there were no treats detected.
So I'm still at a loss how this thing could have happened.

I also chatted online with a Microsoft rep. I did that before I reactivated the system. The rep showed me a screen with a list of errors and said that the hackers
attacked me and caused all my problems. He said he would fix all my problems for $99.99. When I said I have to think about that he immediately went down
to $49.99. At that point I became really scared.

Anyway, the system works for now, we'll see how it goes. Has anybody heard of any malicious soft behaving in a similar way?

 

[Golden]

Hi,

I hope you didn't pay to have anything fixed................ If so, then you were conned.

Did you save a screen capture image of the screen he showed you?

Regards,
Golden

 

[iquest]

Hi,

I hope you didn't pay to have anything fixed................ If so, then you were conned.

Did you save a screen capture image of the screen he showed you?

Regards,
Golden

No I didn't pay anything. I actually got really scared when he started this sort of bargaining, very typical of conmen. So I terminated all connections with him as soon as I could.

And I didn't make any screenshots. First, I don't know how to do them, second, I wanted to close all windows ASAP after his chat. There were a lot of error messages on the log, but all of them looked like 2-3 the same repeated messages, likely notifications of the system being not genuine and something about a printer. The printer Has been off for a long time, so that might be an error of a port that the printer uses being inactive. I have very little knowledge of those things.

 

[Golden]

Thats good.

So is your system showing as Genuine now? Are there other issues that need solving?

Regards,
Golden

 

[iquest]

The basic Sysinfo (found in the properties of My Computer) says that W7 is activated, and there is a bluish rectangular to the right
in which Microsoft offers genuine soft. I couldn't find anything anywhere that would say explicitly that W7 is genuine. But the notification
re W7 being not genuine that I had before disappeared. That notification stayed in the right bottom corner and there is nothing there now.
So I hope this issue has been resolved for now.

 

[Golden]

Hi,

That sounds OK then - run another MGADIAG report and post it here again, since you re-validated your installation.

Regards,
Golden

 

[Arc]

Open explorer, my computer window. Click on the "system Properties button" and scroll down to the bottom. Is it saying that the windows is activated ? If so ? it is OK.

Sometimes if due to some network or other problem if windows fail to get any update, such a non-genuine message may appear.

 

[NoelDP]

The problem here is a relatively common one - teh SLIC table is missing from the BIOS.
This happens for one of three reasons.
1) The machine was originally shipped without Windows installed
2) The machine has been repaired by the manufacturer, and they forgot to properly flash the BIOS before it left the factory.
3) The BIOS has been updated with a non-win7-compliant version for some reason.

The solutions to each are:-
1) purchase a license
2) either demand the manufacturer do the jobe properly, or change the Key to the one on the COA sticker (or both)
3) Change the Key to the one on the COA sticker.

@ iquest
Please post a new MGADiag report so we can check that the system is now properly activated.

 

[NoelDP]

I also chatted online with a Microsoft rep. I did that before I reactivated the system. The rep showed me a screen with a list of errors and said that the hackers
attacked me and caused all my problems. He said he would fix all my problems for $99.99. When I said I have to think about that he immediately went down
to $49.99. At that point I became really scared.

This is worrying.

From where did you get the link to chat to this 'MS rep'?
Microsoft *could not* show you anything from your computer unless you first gave them access.
Microsoft DO NOT haggle over prices - take 'em or leave 'em is their attitude on that.
You were right to be scared!

 

[iquest]

The problem here is a relatively common one - teh SLIC table is missing from the BIOS.
This happens for one of three reasons.
1) The machine was originally shipped without Windows installed
2) The machine has been repaired by the manufacturer, and they forgot to properly flash the BIOS before it left the factory.
3) The BIOS has been updated with a non-win7-compliant version for some reason.

The solutions to each are:-
1) purchase a license
2) either demand the manufacturer do the jobe properly, or change the Key to the one on the COA sticker (or both)
3) Change the Key to the one on the COA sticker.

@ iquest
Please post a new MGADiag report so we can check that the system is now properly activated.

I bought the machine in Best Buy 1.5 years ago. I haven't done anything with W7 since then. I believe my license is genuine unless somebody in HP or Best Buy tweaked it. I'm sure I wouldn't buy a refurbished machine; and the manufacturers/vendors normally notify when something is refurbished.

I don't really understand what you are saying about BIOS because I don't have knowledge in this area. What I do know is that about a month ago I started to experiense some issues with my machine I described in the OP.

And yes, the sysinfo says the W7 is activated.

I'll post my new report in the next message.

Many thanks to everybody for their input.

 

[iquest]

Forgot to add that I went to the Microsoft website, there is a button Chat Now, this is how I initiated a chat with the guy I hope is a MS rep. That was Saturday 8 pm pacific time, so he might as well be from some Indian call center if MS has them there. I did allow him to access my comp. Might have been a mistake. And yes, his attitute/behaviour was that made me to terminate any connection with him.

 

[iquest]

Here is my report. I wish I was able to understand it, but I guess one person can't know everyhing. Thanks a lot everybody.

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-T7V9D-8QBVQ-J8CPC
Windows Product Key Hash: fxNOlXX+cm2usNq/cvnnYOid2m0=
Windows Product ID: 00359-OEM-9808881-65550
Windows Product ID Type: 8
Windows License Type: COA SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {736FAEA0-DF57-4A27-B82A-ED618140DD29}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120503-2030
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Enterprise 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{736FAEA0-DF57-4A27-B82A-ED618140DD29}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-J8CPC</PKey><PID>00359-OEM-9808881-65550</PID><PIDType>8</PIDType><SID>S-1-5-21-683786449-1924329095-4103933838</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>SLIC-CPC</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>6.05</Version><SMBIOSVersion major="2" minor="6"/><Date>20110118000000.000000+000</Date></BIOS><HWID>A5ED3607018400F2</HWID><UserLCID>1009</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>DDD15FEFA96D86</Val><Hash>CWjDZWB+u86tHXdQsqC51yUlX54=</Hash><Pid>89388-707-7629254-65613</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
Activation ID: 5e017a8a-f3f9-4167-b1bd-ba3e236a4d8f
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00196-088-865550-02-4105-7601.0000-2172012
Installation ID: 006743602975932751589976627736279015001840445886233271
Processor Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88338[/URL]
Machine Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88339[/URL]
Use License URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88341[/URL]
Product Key Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88340[/URL]
Partial Product Key: J8CPC
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 8/05/12 12:18:53 PM
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 7:21:2012 20:29
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:

HWID Data-->
HWID Hash Current: LAAAAAEAAQABAAEAAAABAAAAAgABAAEA6GEq/9iGIJF8/FTIAqi+4LQlQho=
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name OEMID Value OEMTableID Value
  APIC   HPQOEM  SLIC-CPC
  FACP   HPQOEM  SLIC-CPC
  SRAT   HPQOEM  SLIC-CPC
  HPET   HPQOEM  SLIC-CPC
  MCFG   HPQOEM  SLIC-CPC
  OEMB   HPQOEM  SLIC-CPC
  SSDT   HPQOEM  SLIC-CPC
  SSDT   HPQOEM  SLIC-CPC

 

[NoelDP]

That report looks fine.

So long as you got the from the MS site, that should be OK - you were probably connected to a contractor, who took the opportunityfor a sales pitch!

What you should do now is a little house-cleaning - just in case the rep was actually telling the truth!

Update your Anti-Virus, then download and install (UNtick 'Enable free trial of MBAM PRO' at the end of the installation) Malwarebytes Anti-malware (free version) www.malwarebytes.org and update it, and run a full scan in your main account, and Quick scans in any other user accounts.

(this has the advantage of ensuring that every file gets looked at by both the AV and MBAM, for the price of a slightly longer scan time)

post the results of the MBAM scan, and we'll take a look.

 

[iquest]

I just run a full scan with Malwarebytes. Nothing malicious detected as far as I can tell:

Malwarebytes Anti-Malware 1.62.0.1300
[URL="http://www.malwarebytes.org/"]www.malwarebytes.org[/URL]
Database version: v2012.08.06.01
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
ID :: ID-HP [administrator]
8/05/12 6:54:39 PM
mbam-log-2012-08-05 (18-54-39).txt
Scan type: Full scan (C:\|D:\|J:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 364500
Time elapsed: 43 minute(s), 39 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)

I also see that there is at least one more victim of W7 7601 build.

 

[NoelDP]

There are always 'victoms' - many such are the result of their own actions
In your case, it appears to be a result of poor quality control on the part of the manufacturer.

Enjoy your genuine system!

 

[Golden]

Just a precautionary note : make sure remote connection is turned off - I'm presuming you allowed that for him to 'diagnose' your system.