Windows "not genuine" but can't run legitcheck.hta - HELP!

[ship691]

Hi

My Windows 7 x64 is legit.

However a couple of days ago a message popped up sayint that it isn't. (i.e. "This copy of Windows is not genuine" or something similar.)

Now the only way I can get into windows is via Safe Mode (using F8 during boot).

It asks me to prove it is legit by downloading legitcheck.hta. However when I try to run that file I get a message saying that "legitcheck.hta is not a valid Win32 application"

I just managed to run Malwarebyte Anti-Malware Home (Premium) v2.1.4.1018 (safe mode), but it found no malware.

My normal anti-viral software is AGV Cloudcare.

My Windows 7 is Build 7601

When I attempt a normal boot, the screen is black apart form a Windows Activation window has the error message "OxC004F009" at the bottom of the screen.


Do I have malware?
Has Microsoft release a dodgy patch?
Why cant it run legitcheck.hta (which does appear to come from microsoft.com)
What should I do next?
Should I phone microsoft?

Many thanks

J


Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 50
Cached Online Validation Code: N/A, hr = 0x8007043c
Windows Product Key: *****-*****-V9927-V68FX-PKJVQ
Windows Product Key Hash: sgMpz9msfkkcRsyp5CLuCh8a1Vc=
Windows Product ID: 00371-OEM-9044202-90070
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {5673C385-BB15-4915-BE33-E2B598435A5D}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.9.42.0
Signed By: Microsoft
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.150316-1654
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: B4D0AA8B-604-645_B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{5673C385-BB15-4915-BE33-E2B598435A5D}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-PKJVQ</PKey><PID>00371-OEM-9044202-90070</PID><PIDType>3</PIDType><SID>S-1-5-21-163801654-3582672073-2290200179</SID><SYSTEM><Manufacturer>INTEL_</Manufacturer><Model>WBIBX10J</Model></SYSTEM><BIOS><Manufacturer>Intel Corp.</Manufacturer><Version>WBIBX10J.86A.0333.2012.0129.2308</Version><SMBIOSVersion major="2" minor="6"/><Date>20120129000000.000000+000</Date></BIOS><HWID>F5833107018400FE</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x8007043C' to display the error text.
Error: 0x8007043C

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: N/A
HealthStatus: 0x0000000000000000
Event Time Stamp: N/A
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Not Registered - 0x8007043c
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: LgAAAAEABAABAAEAAAAAAAAAAQABAAEAln16IZIrgJYyiELG5rNs3dboPv12Vg==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC INTEL WBIBX10J
FACP INTEL WBIBX10J
HPET INTEL WBIBX10J
MCFG INTEL WBIBX10J
WDDT INTEL WBIBX10J
ASF! INTEL WBIBX10J
ASPT INTEL WBIBX10J
WDTT INTEL WBIBX10J
SSDT INTEL SSDT PM

 

[NoelDP]

The above report was produced while in Safe Mode - and is pretty much useless.
When attempting to validate, you should go to www.microsoft/genuine/validate using Internet Explorer - this avoids having to use the legitcheck process. (which won't work in Safe Mode anyhow - although I'm not certain that the normal method will work anyhow, as I've never tried it!)

You need to be able to boot to Normal mode before attempting to diagnose anything.
The non-genuine notification does NOT prevent access to Normal Mode Windows - if you are unable to access Normal Mode, tehn you have other problems as well.

You should first attempt a System Restore back to a point where the system was running 'normally' and see if that helps.
Then start diagnosis if necessary.

 

[ship691]

System Restore "did not complete successfully". It said it may have been to do with anti-viral software still running, so I set AVG to be off for 15 mins and tried again.

This time it said "System Restore did not complete successfully, your computer's system files and settings were not changed"

I'll get more details and revert this thread from other PC.

OK here you go:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-V9927-V68FX-PKJVQ
Windows Product Key Hash: sgMpz9msfkkcRsyp5CLuCh8a1Vc=
Windows Product ID: 00371-OEM-9044202-90070
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {5673C385-BB15-4915-BE33-E2B598435A5D}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.9.42.0
Signed By: Microsoft
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.150316-1654
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: B4D0AA8B-604-645_B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{5673C385-BB15-4915-BE33-E2B598435A5D}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-PKJVQ</PKey><PID>00371-OEM-9044202-90070</PID><PIDType>3</PIDType><SID>S-1-5-21-163801654-3582672073-2290200179</SID><SYSTEM><Manufacturer>INTEL_</Manufacturer><Model>WBIBX10J</Model></SYSTEM><BIOS><Manufacturer>Intel Corp.</Manufacturer><Version>WBIBX10J.86A.0333.2012.0129.2308</Version><SMBIOSVersion major="2" minor="6"/><Date>20120129000000.000000+000</Date></BIOS><HWID>F5833107018400FE</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: e120e868-3df2-464a-95a0-b52fa5ada4bf
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00180-442-090070-02-2057-7601.0000-0982015
Installation ID: 015930749404926972400223239211251513150260111726145605
Processor Certificate URL: SpcService Web Service
Machine Certificate URL: RacService Web Service
Use License URL: UseLicenseService Web Service
Product Key Certificate URL: PkcService Web Service
Partial Product Key: PKJVQ
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 23/04/2015 12:59:59

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: N/A
HealthStatus: 0x0000000000000000
Event Time Stamp: N/A
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: NgAAAAEABAABAAEAAAAEAAAAAQABAAEAln16IZIrgJYyiELG5rNs3dboYj1cOr1+E+Q+/XZW

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC INTEL WBIBX10J
FACP INTEL WBIBX10J
HPET INTEL WBIBX10J
MCFG INTEL WBIBX10J
WDDT INTEL WBIBX10J
ASF! INTEL WBIBX10J
ASPT INTEL WBIBX10J
WDTT INTEL WBIBX10J
SSDT INTEL SSDT PM

 

[NoelDP]

There's no problem in the MGADiag report - although it does appear that the install has never been validated.
Attempt validation at www.microsoft/genuine/validate using Internet Explorer - what happens?

 

[ship691]

I tried an earlier restore point. It seemed to get further this time during System Restore however it is still complaining about not being able to access a file. This was depite my having AVG disabled and SuperAntiSpyware and DropBox/Teamviewer/Ditto also closed.


Error: 0x80070005

P.S.
> Attempt validation at www.microsoft/genuine/validate using Internet Explorer - what happens?
It says "Validation Status: Action Required"
But I still cant run legitcheck.hta because "it is not a valid Win32 application" :^(


PPS
I tried opening rather than saving to run and now it is offering me a free copy of Microsoft Security Essentials. Should I run this? (I am nervous because i already have AVG running and thought that it is bad to run more than one antivirus software...)

At least it is no longer saying that my Windows is not legit but I am now worried about malware.

 

[NoelDP]

That error code is an 'Access Denied' one
You may have better luck attempting a System Restore either from Safe Mode, or from the 'Repair my Computer' option in the Advanced Boot Menu.

The fact that you were offered MSE means that validation passed!
You do NOT want to install it unless you first uninstall AVG - it's never a good idea to have two active AV apps installed, and an even worse idea to have both active!

 

[ship691]

Nope - System Restore from Safe Mode failed too.
Wait do I need to hit f8 when it reboots AFTER the system restore too?

J

EDIT:
Nope I tried that too. I booted into Safe Mode, ran System Restore and hit F9 as it rebooted to take it back into Safe Mode. However I still got: "System Restore could not access a file" and "did not complete successfully." 0x80070005.

I was trying the oldest of my available dates for System Restore. Now what?

Is there any better way to test for Malware?

Btw, I am now pretty sure I have malware because it fired up some porn site I've never seen when I tried to got to a forum about lawn mowers ! :^[

 

[NoelDP]

You shouldn't need to.
Try it again from Repair My Computer

 

[ship691]

If I hit F8 during boot, one of the options is Repair Your Computer. I am assuming that is what you mean, yes?

EDIT:
OK yes, that gives additional dates. Although I had to attach my backup HD in order for them to be found! Trying now

EDIT02:
My first attempt from backup HD took a long time (20mins?) and then failed with the exact same message as before. OK I'm going back to the 4th of Jan this year. If I go back much further I may as well re-install windows from scratch. (It's just such a monumental disruption that maybe i should buy an upgrade to Window 8.1 in fact.... [groan])

EDIT03
OMG, okay this time it took well over an hour to run system restore by I still get "An unspecified error during system restore (0x8007700b7)

Now what?

 

[ship691]

Wait - you couldn't make this stuff up.

I just rebooted and came back saying that it HAS successfully run system restore - restored to that date I chose!

What should I do next - esp to check for malware... ?
(Should I run e.g. Windows Update? Microsoft malicious software removal tool ?)

 

[NoelDP]

First make sure that your AV is up to date then run a full system scan.

 

[ship691]

No threats detected by AVG

 

[NoelDP]

Now run malwarebytes anti malware. Again, a full scan

 

[ship691]

oh-oh. PUP.Optional.MarketScore
Five detected objects (so far)
Type: key
Location:
HKLM\SOFTWARE\ [various - see attachment]

 

[ship691]

Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software

Scan Date: 23/04/2015
Scan Time: 20:39:01
Logfile:
Administrator: Yes

Version: 2.01.4.1018
Malware Database: v2015.04.23.05
Rootkit Database: v2015.04.21.01
License: Premium
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Enabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Alec

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 468611
Time Elapsed: 9 min, 43 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 5
PUP.Optional.MarketScore, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{35B7E48B-9D81-4C6C-9578-5FD4F620D886}, , [8baf8fe0e4a679bd9fd27cec93708d73],
PUP.Optional.MarketScore, HKLM\SOFTWARE\CLASSES\Setup.Player.2K2, , [8baf8fe0e4a679bd9fd27cec93708d73],
PUP.Optional.MarketScore, HKLM\SOFTWARE\CLASSES\Setup.Player, , [8baf8fe0e4a679bd9fd27cec93708d73],
PUP.Optional.MarketScore, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Setup.Player, , [8baf8fe0e4a679bd9fd27cec93708d73],
PUP.Optional.MarketScore, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Setup.Player.2K2, , [8baf8fe0e4a679bd9fd27cec93708d73],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

 

[ship691]

Should I quarantine them all ?

 

[NoelDP]

Yup!
nothing particularly bad there - but it's an indicator that you may need to review your ideas of what is 'acceptable' to install.

 

[RolandJS]

One can run two antivirus programs; only one of the two has its real time shields active; both can have non-overlapping scheduled scans. I have both Avast and Avira, one w/activated real time shields, both running scans.

 

[ship691]

OK I've quarantined those 5 PUP things.
How can I be sure that I've not got any other 'unwanted' stuff?
What else should I run?

 

[Supportacus]

Greetings,
I don't want to interrupt or something...

License Status: Notification
Notification Reason: 0xC004F009 (grace time expired).

Windows must be activated within 30 days of install, Your 30 day grace period has expired.
You will have to activate by phone
STEPS:
1) Click Start, and in the Search box type: slui.exe 4
2) Next press the 'ENTER' key
3) Select your 'Country' from the list.
4) Choose the 'Phone Activation' option.
5) Stay on the phone (do not select/press any options) and wait for a person to help you with activation.
6) Explain your problem clearly to the support person.

MBAM is one of the best AM it can also detect rootkits....Viruses...etc.
It comes with chameleon.com*.exe in the installation path.
For best scanner there is for viruses and malware services there is RKill.exe(NAMED: iexplorer.exe) only 1MB size.
If you want to ultimately secure...The BD RescueCD that Almost anyone would rate it 5 stars is a rescue disk used to detect and remove many viruses and trojans that boot with the computer it even works against the malware that makes the explorer.exe stop working in normal mode.