Another Windows 7 suddenly not genuine issue

[bmeadows]

Hi! I found your forum while trying to find a fix for why my version of Windows 7 was suddenly not genuine after having this computer for 8 months.

I bought the computer from TigerDirect in January 2012. It is a CyberPower Inc computer running Windows 7 home premium 64 bit edition. On Sunday, my roommate turned the computer on to have the validation error message. At the same time, Windows has 4 critical security updates it is trying to make but keeps failing on - 3 are security updates (KB2705219, KB2712808, and KB2731847) and one for IE9 for windows 7 64 bit systems (KB2722913). Every time we turn the computer off and on, it tries to make these updates and fails.

I ran malwarebytes to be sure I don't have malware causing the problem. I tried to do a system restore, but the system fails every time it tries. There was a thread that suggested trying rsop.msc, but my computer doesn't have that available. another suggestion looked at the registry editor users/1-5-20 (something like that), but that didn't work either. I saw a third suggestion on deleting a certain update, but can't find that one now that I restarted my system.

I ran the MGADaig.exe tool and got the results below. One interesting thing I noted is that when the tool ran, the product key listed agreed with the product key on the service tag on the side of the computer; however, when I go to control panel/system security/system and look at the key listed there, it doesn't agree. The system will not let me change the key to match the service tag.

Any help would be greatly appreciated!

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
 
Validation Code: 50
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-3CWJQ-MRVTW-DCPPQ
Windows Product Key Hash: neXxosy/u4lya5lkkxfmkqOm4kg=
Windows Product ID: 00359-OEM-8802172-70121
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {3E8865BE-E016-4987-9C68-213BF6AEF8B2}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120503-2030
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
 
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
 
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
 
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
 
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
 
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
 
File Scan Data-->
 
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{3E8865BE-E016-4987-9C68-213BF6AEF8B2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-DCPPQ</PKey><PID>00359-OEM-8802172-70121</PID><PIDType>3</PIDType><SID>S-1-5-21-1688581731-837907838-1233772342</SID><SYSTEM><Manufacturer>BIOSTAR Group</Manufacturer><Model>H61MHB</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>4.6.4</Version><SMBIOSVersion major="2" minor="7"/><Date>20110517000000.000000+000</Date></BIOS><HWID>32440900010000FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 
 
Spsys.log Content: 0x80070002
 
Licensing Data-->
C:\Windows\system32\slmgr.vbs(1333, 5) (null): The service has not been started. 
 
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0xC004C533
HealthStatus: 0x0000000000000000
Event Time Stamp: 8:21:2012 19:16
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
 
 
HWID Data-->
N/A, hr = 0x8007000d
 
OEM Activation 1.0 Data-->
N/A
 
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
ACPI Table Name OEMID Value OEMTableID Value
APIC ALASKA A M I
FACP ALASKA A M I
HPET ALASKA A M I
MCFG ALASKA A M I
SSDT AMICPU PROC
ASPT ALASKA PerfTune

also, I tried this solution found here: http://www.sevenforums.com/windows-...dows-7-all-sudden-saying-its-not-genuine.html

but this did not work. When I tried to re-enter my key, I get error code 0x80070426: the service has not been started.

 

[Golden]

Licensing Data-->
C:\Windows\system32\slmgr.vbs(1333, 5) (null): The service has not been started.

Hi,

Have you tried this suggestion from Noel:
http://www.sevenforums.com/windows-...udden-saying-its-not-genuine.html#post1907700

Regards,
Golden

 

[bmeadows]

hi, thank you!

Yes, I did try that, but when I got to step 10, it still would not validate.

 

[NoelDP]

Interesting - I suspect that you have more than one problem going on.
Let's see what service is being talked about
Please open an Elevated Command Prompt, and run the following commands.

SC QC SPPSVC
SC QC SPPUINOTIFY
SC QC WUAUSERV
SC QC BITS
SC QC TRUSTEDINSTALLER
NET START SPPSVC
NET START SPPUINOTIFY

copy and paste the results to your reply

Here are some instructions to make life easier
1) To open an Elevated Command Prompt Window (the CP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Windows, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[bmeadows]

okay, as requested:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
 
C:\Windows\system32>SC QC SPPSVC
[SC] QueryServiceConfig SUCCESS
 
SERVICE_NAME: SPPSVC
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START (DELAYED)
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\sppsvc.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Software Protection
DEPENDENCIES : RpcSs
SERVICE_START_NAME : NT AUTHORITY\NetworkService
 
C:\Windows\system32>SC QC SPPUINOTIFY
[SC] QueryServiceConfig SUCCESS
 
SERVICE_NAME: SPPUINOTIFY
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k LocalService
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : SPP Notification Service
DEPENDENCIES : EventSystem
SERVICE_START_NAME : NT AUTHORITY\LocalService
 
C:\Windows\system32>SC QC WUAUSERV
[SC] QueryServiceConfig SUCCESS
 
SERVICE_NAME: WUAUSERV
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START (DELAYED)
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Windows Update
DEPENDENCIES : rpcss
SERVICE_START_NAME : LocalSystem
 
C:\Windows\system32>SC QC BITS
[SC] QueryServiceConfig SUCCESS
 
SERVICE_NAME: BITS
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\System32\svchost.exe -k netsvcs
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Background Intelligent Transfer Service
DEPENDENCIES : RpcSs
: EventSystem
SERVICE_START_NAME : LocalSystem
 
C:\Windows\system32>SC QC TRUSTEDINSTALLER
[SC] QueryServiceConfig SUCCESS
 
SERVICE_NAME: TRUSTEDINSTALLER
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\servicing\TrustedInstaller.exe
LOAD_ORDER_GROUP : ProfSvc_Group
TAG : 0
DISPLAY_NAME : Windows Modules Installer
DEPENDENCIES :
SERVICE_START_NAME : localSystem
 
C:\Windows\system32>NET START SPPSVC
The requested service has already been started.
 
More help is available by typing NET HELPMSG 2182.
 
 
C:\Windows\system32>NET START SPPUINOTIFY
The requested service has already been started.
 
More help is available by typing NET HELPMSG 2182.
 
 
C:\Windows\system32>

 

[NoelDP]

Odd - That's all normal, and I don't know of any other services likely to be involved at that point.

What happens if you run

SLMGR.VBS /DLV
CSCRIPT SLMGR.VBS /DLV
WSCRIPT SLMGR.VBS /DLV

(you should get a popup window from the first and third commands, and results in the Command prompt windows from the second)


perhaps the scripting host has a problem?

 

[shawn77]

Please download Rkill

http://download.bleepingcomputer.com/grinler/rkill.com

• Double-click on the Rkill desktop icon to run the tool.
• If using Vista, right-click on it and Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

Attach the log contents here

 

[NoelDP]

The only relevant service that may be invovled that I can find is the Event Log service....

please run
SC QC EVENTLOG
NET START EVENTLOG

and post the results.

 

[bmeadows]

The only relevant service that may be invovled that I can find is the Event Log service....

please run
SC QC EVENTLOG
NET START EVENTLOG

and post the results.

Okay, as you requested, here is are the results from running the above:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>SC QC EVENTLOG
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: EVENTLOG
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\System32\svchost.exe -k LocalServiceNetw
orkRestricted
LOAD_ORDER_GROUP : Event Log
TAG : 0
DISPLAY_NAME : Windows Event Log
DEPENDENCIES :
SERVICE_START_NAME : NT AUTHORITY\LocalService

C:\Windows\system32>NET START EVENTLOG

 

[bmeadows]

another interesting I noticed is that when I ran the original tool at the beginning, I saw that the last 3 sets of the product key were shown and matched what is on the service tag of my machine. However, when I go into Control Panel\System & Security\System, the product key does not match there, and I cannot change it to make it match.

I'm hoping we can fix this without doing a total re-install of Windows, as I really, really don't want to have to do that--it will take days for me to re-install everything!

Thanks for all the help!

 

[NoelDP]

I suspect that there's something inhibiting the SPPSVC at times - do you have any game-optimising software installed? This type of thing has a nasty habit of blocking such services in the mistaken belief that it frees clock-cycles for the came.
The other likely cause is malware (or even your AV!)

<thinking aloud>
In the 10,000 or so MGADiag reports I've analysed in the past couple of years, I don't recall ever seeing this particular error message before
C:\Windows\system32\slmgr.vbs(1333, 5) (null): The service has not been started.

The 80070426 error is a relatively common one, but usually present in the MGADiag report - and indicates that a service couldn't start within the timeout (usually the SPPSVC).
Since your SPPSVC seems to have no problem starting manually, there should be no problem running normally unless there's interference.

As the problem only shows in the SLMGR.VBS area, it is more likely to be something associated with the scripting at that point - unfortunately my scripting skills are best described as non-existent.
</thinking aloud>

Did you run the script commands in my earlier post? (SLMGR.VBS.... etc?) what happened?

I'll do some research - but I'm occupied most of tomorrow, so it'll probably be Friday before I can get back to you.

 

[NoelDP]

What you see in the System properties page is the Product ID - not the Product Key.

Windows Product Key: *****-*****-3CWJQ-MRVTW-DCPPQ
Windows Product ID: 00359-OEM-8802172-70121

 

[NoelDP]

Searching Google for the error, I see that I have actually seen it a couple of time before - but the outcome in both instances was not a happy one.
In general, it seems that if a System Restore doesn't fix the problem, then a repair install (at least) has been required.

I'd like to change that - do you feel up to what could be a long and grinding thread, attempting to isolate the problem and fix it?

 

[bmeadows]

Please download Rkill

http://download.bleepingcomputer.com/grinler/rkill.com

• Double-click on the Rkill desktop icon to run the tool.
• If using Vista, right-click on it and Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

Attach the log contents here

As you requested, I did download Rkill and got the following results: I admit I have no clue what I'm looking at After I ran Rkill, I proceeded to run Malwarebytes, which found nothing (it's log is listed below as well)

Rkill 2.3.1 by Lawrence Abrams (Grinler)
Bleeping Computer - Computer Help and Discussion
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
RKill - What it does and What it Doesn't - A brief introduction to the program

Program started at: 08/22/2012 05:50:18 PM in x64 mode.
Windows Version: Windows 7 Service Pack 1

Checking for Windows services to stop.

* No malware services found to stop.

Checking for processes to terminate.

* No malware processes found to kill.

Checking Registry for malware related settings.

* Explorer Policy Removed: NoActiveDesktopChanges [HKLM]

Backup Registry file created at:
C:\Users\Bridget\Desktop\rkill\rkill-08-22-2012-05-50-31.reg

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks.

* Windows Defender Disabled

[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware" = dword:00000001

Checking Windows Service Integrity:

* Plug and Play (PlugPlay) is not Running.
Startup Type set to: Automatic

* Plug and Play (RpcSs) is not Running.
Startup Type set to: Automatic

* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual

* AppMgmt [Missing Service]
* CscService [Missing Service]
* PeerDistSvc [Missing Service]
* UmRdpService [Missing Service]

* PlugPlay [Missing ServiceDLL Value]

Searching for Missing Digital Signatures:

* No issues found.

Program finished at: 08/22/2012 05:50:40 PM
Execution time: 0 hours(s), 0 minute(s), and 21 seconds(s)



Malwarebyte log:

Malwarebytes Anti-Malware (Trial) 1.62.0.1300
Malwarebytes : Free anti-malware download

Database version: v2012.08.21.13

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Bridget :: GAMING-PC [administrator]

Protection: Enabled

8/22/2012 5:51:03 PM
mbam-log-2012-08-22 (17-51-03).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 322650
Time elapsed: 33 minute(s), 3 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

 

[bmeadows]

Searching Google for the error, I see that I have actually seen it a couple of time before - but the outcome in both instances was not a happy one.
In general, it seems that if a System Restore doesn't fix the problem, then a repair install (at least) has been required.

I'd like to change that - do you feel up to what could be a long and grinding thread, attempting to isolate the problem and fix it?

*sighs* It figures that my machine of course would have the one problem that isn't easy to fix

And thanks for clearing up the issue over the product keys--goes to show I really know very little about trouble shooting computers!

I'm willing to try a few more things before finally going back and doing a complete re-install. It was a headache and hours just to get this thing to work for me--I hate the idea of having to go through it again!

Oh, and in answer to your first post: I don't use this machine much myself--my roommate uses it. It's my computer, but she uses this one and I use the old one because she's the gamer, not me. As far as I know, the only games she plays on it are Lord of the Rings Online, Sims 3, and various little games from Big Fish. If she had downloaded any kind of accelerator, I don't know, and she probably wouldn't know what I was talking about if I asked her.

I just ran rkill and malwarebytes to ensure I don't have Malware, or at least as sure as I can be.

One thing I can say is that about 3 weeks ago, I had problems with McAfee after the software attempted to update. After searching McAfee's forums, I found it was a common McAfee problem (though now I can't quite remember now what the problem was--I think it had something to do with the real time advisor, I think). In any case, I had to completely remove McAfee and re-install it--twice. It seems to be working fine now.

One final note: this computer does give us the blue screen once in a while, and I have had the occasional issue with loading software or drivers. I've always chalked it up to it being Windows 7 64 bit. And it does tend to freeze once in a while-though sometimes those freeze moments I suspect would be fine if my roommate would leave it alone. I've caught her doing a hard restart--i.e. turning it off by the power button--a few times, and I know she does it when I'm not around to catch her. I've told her and told her not to do that, but she keeps insisting that it froze, or gave her the blue screen and she had no choice......


I really wish I could just put XP on this machine *sigh* My older PC has XP and I don't have problems with it!

 

[NoelDP]

Funny you should mention McAfee
The two worst enemies of Windows in my opinion are Norton and McAfee software. They are both incredibly bloated, and attempt to take total control of the machine for themselves, rather than for the user - and are installed in a vast number of computers.

I really would suggest that you uninstall McAfee and run the MCPR tool (again?) - then install something less intrusive.

For 99% of people the Windows firewall is more than sufficient, and the free MSE Anti-Virus is perfectly good enough. The other 1% should be running inside virtual machines anyhow. The extra bundled software that comes with Norton and McAfee borders on being malware itself, IMHO.

It may be that your problems with McAfee are what began this problem, so it's even more likely that a proper removal will at least assist in finding the source of the problem - McAfee does make significant changes to the registry, which the uninstaller is supposedly designed to undo.

 

[bmeadows]

Funny you should mention McAfee
The two worst enemies of Windows in my opinion are Norton and McAfee software. They are both incredibly bloated, and attempt to take total control of the machine for themselves, rather than for the user - and are installed in a vast number of computers.

I really would suggest that you uninstall McAfee and run the MCPR tool (again?) - then install something less intrusive.

For 99% of people the Windows firewall is more than sufficient, and the free MSE Anti-Virus is perfectly good enough. The other 1% should be running inside virtual machines anyhow. The extra bundled software that comes with Norton and McAfee borders on being malware itself, IMHO.

It may be that your problems with McAfee are what began this problem, so it's even more likely that a proper removal will at least assist in finding the source of the problem - McAfee does make significant changes to the registry, which the uninstaller is supposedly designed to undo.

I can do that--which thread was the MCPR tool?

A friend did suggest Avast, but I had kept McAfee because it had already been paid for the year and because it was on my other PC as well, and I had a nightmare trying to network two machines with different AV in the past.

Thanks!

 

[NoelDP]

The MCPR tool....


Download the McAfee removal tool from:

http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe


Click Save, and save the file to a folder on your computer.
Navigate to the folder where you saved the file.
right-click on MCPR.exe and select 'Run as Administrator' to run the removal tool.

when complete, reboot immediately, whether asked to or not!

Has any other AV EVER been installed on this machine? If so, then you need to run the removal tool for that as well.

 

[Britton30]

[interject facts]Norton does not have any bundled software, just a light weight and efficient security suite. In the past 3-4 years it has become very light on resources, lower than MSE, which I have also tried, plus it will catch more "bad stuff". McAfee and AVG are buggy though.[/interject facts]

 

[NoelDP]

Norton carries with it sundry things that bear no relation to its function - while strictly speaking these are not 'bundled' software, they are not in any way or form useful products and are known to cause problems in use.