Error 0x80070002 - Windows 7 cannot check for updates

[nostradamus77]

Unfortunately, I cannot update my Win7x64. I am getting 0x80070002. I have tried to auto-repair and dozens of other things. I only now stumbled over this dedicated forum. Please see below my MGA Diagnostic. Any idea hugely appreciated. Thanks!!!


Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-GJY49-VJBQ7-HYRR2
Windows Product Key Hash: W5/6nm6F2UPXrCkY5xUhXb/+21g=
Windows Product ID: 00426-OEM-8992662-00006
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {127305AA-75CB-4796-8A51-A367EF2DE727}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130318-1533
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\npwatweb.dll[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\watux.exe[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\watweb.dll[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\sppobjs.dll[6.1.7601.17514], Hr = 0x80092003
File Mismatch: C:\Windows\system32\sppc.dll[6.1.7601.17514], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003
File Mismatch: C:\Windows\system32\slc.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\slcext.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\sppuinotify.dll[6.1.7600.16385], Hr = 0x80092003
File Mismatch: C:\Windows\system32\slui.exe[6.1.7601.17514], Hr = 0x80092003
File Mismatch: C:\Windows\system32\sppcomapi.dll[6.1.7601.17514], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\sppcommdlg.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\sppsvc.exe[6.1.7601.17514], Hr = 0x80092003
File Mismatch: C:\Windows\system32\drivers\spsys.sys[6.1.7127.0], Hr = 0x80092003
File Mismatch: C:\Windows\system32\drivers\spldr.sys[6.1.7127.0], Hr = 0x80092003
File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7601.17514], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\user32.dll[6.1.7601.17514], Hr = 0x800b0100

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{127305AA-75CB-4796-8A51-A367EF2DE727}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-HYRR2</PKey><PID>00426-OEM-8992662-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-2581678553-2185481043-1544113848</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>1616</Version><SMBIOSVersion major="2" minor="7"/><Date>20121005000000.000000+000</Date></BIOS><HWID>A9630500018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>China Standard Time(GMT+08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00178-926-600006-02-1033-7601.0000-1732013
Installation ID: 021224687530765452932623561041745765655194344701486235
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: HYRR2
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 10/20/2013 3:21:55 PM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: N/A
HealthStatus: 0x0000000000000000
Event Time Stamp: N/A
ActiveX: Not Registered - 0x80040154
Admin Service: Not Registered - 0x80040154
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: LgAAAAAAAwABAAEAAQABAAAAAQABAAEAln0yDHTEZMcKUwpT7kKgqTKopmCWYw==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC ALASKA A M I
FACP ALASKA A M I
HPET ALASKA A M I
MCFG ALASKA A M I
FPDT ALASKA A M I
SSDT SataRe SataTabl
SSDT SataRe SataTabl
SSDT SataRe SataTabl
DMAR INTEL SNB
SLIC ACRSYS ACRPRDCT

 

[NoelDP]

Your installation is counterfeit.
You have an Acer OEM_SLP Key and SLIC table - but the motherboard is a retail one. The whole thing is held together by a hacker's Activation Exploit.

You need to reformat and reinstall using genuine media and Key.

 

[nostradamus77]

Oh, this is very unfortunate. I got a custom built from a vendor who provided me a complete package-deal. I already had some concerns as I am living in China and was curious whether these vendors actually have access to proper Windows licenses. Ultimately, I actually paid for this so called license.

Is there any other way than reformatting? Any chance to buy a proper key online? Any chance to update to Windows 8.0 or 8.1 to solve this when buying a proper license key?

I don't want to format and redo everything. Also not sure whether I can even buy a proper Windows version here in China...

 

[NoelDP]

China is a bit of a nightmare when it comes to licensing - I think there are more fakes than genuine licenses out there! Yours is a fairly typical example. For the future, always check for a COA sticker,(or if from a large manufacturer, the Windows 8 tamper-proof sticker from now on) How to Tell ? Hardware

The problem with systems activated using an Activation Exploit (Loader) is that it's impossible to guarantee the integrity of the system, as many such come laden with malware embedded, and the hack is effectively a rootkit interposing itself between OS and BIOS, so it may be almost impossible to ensure the system is clean.
That's why we always recommend a reformat/reinstall in such cases.

Genuine Win7 licenses are getting rare everywhere nowadays, since MS effectively stopped selling them a year ago.

You can try purchasing a GGOK - but be aware that while it's a Retail license, it's restricted to use only on the affected machine, and cannot be transferred or put on a new motherboard.
https://www.microsoft.com/en-us/piracy/knowthefacts/legalizationsolutions.aspx


PLease attempt validation at www.microsoft.com/genuine/validate - it may pass because of the hack, but the hack may also be discovered, and if so, you'll be offered the kit.

 

[nostradamus77]

Thanks, this is helpful. Will below allow me to "legalize" my Win7 through GGOK? And by doing so will it allow to "repair" my Windows to allow online updates?

Would it be easier/cheaper for me to "just" buy a Windows 8.1, which retail quite cheap these days. And then I install it on-top of my Windows 7? Would this work?

Would both options allow me to get rid of potential malware? Any chance to get rid of the exploit?

And last but not least - I will eventually buy a new computer. Would like to have a Chinese vendors do it for me rather than assembling all the components myself. How could I make sure to have a genuine copy of Win7 or Win8.1?

 

[nostradamus77]

Unfortunately, it failed given me error code "Update installation failed. Error information: 0x80072EE2". Any idea?

 

[NoelDP]

0x80072EE2 errors are usually transient - they are networking errors possibly because of a bad connection, or a firewall or proxy setting.
In this case it could be a function of the hack
Let's have a bit of a closer look at the system....
Follow the instructions here to create the SF BSOD file - but just upload the file here, and I'll take a look and see if there's anything obvious that needs attention.

EDIT: - forgot the link! http://www.sevenforums.com/bsod-help-support/96879-blue-screen-death-bsod-posting-instructions.html

 

[nostradamus77]

Can I send it to you by email? Not sure what I am disclosing about my system when I am posting it openly in this forum?

 

[NoelDP]

There's nothing confidential in the SF BSOD files - it's merely a collection of logs and error data.
You can always delete it once I've got it

 

[nostradamus77]

Great, here we go... Thanks for any insights you may have.

 

[NoelDP]

There are a lot of errors in the System event log saying that the drive P: is corrupted - you should run CHKDSK P: /R to fix that.
Oddly, the last event logged in that is dated 26th August - which possibly indicates some form of corruption in either the file itself, or the service.
The Application event log is OK - but shows a number of errors....
Open an Elevated Command Prompt and run the following command
fsutil resource setautoreset true c:\

wait for it to complete, and then reboot


Please run a full CHKDSK and SFC scan....

Click on Start > All Programs > Accessories

Right-click on the Command Prompt entry

Select Run as Administrator and accept the UAC prompt - the ElevatedCommand Prompt window should pop up.

At the Command prompt, type

CHKDSK C: /R

and hit the Enter key.

You will be told that the drive is locked,

and the CHKDSK will run at he next boot - hit the Y key, press Enter, and then reboot.



The CHKDSK will take a few hours depending on the size of the drive,so be patient!

After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -

then run the SFC.



SFC -System File Checker -Instructions

Click on Start > All Programs > Accessories

Right-click on the Command Prompt entry

Select Run as Administrator and accept the UAC prompt - the ElevatedCommand Prompt window should pop up.

At the Command prompt, type

SFC /SCANNOW

and hit the Enter key

Wait for the scan to finish - make a note of any error messages -and then reboot.

Copy the CBS.log file created(C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate itdirectly) and then compress the copy and attach it to your reply.

Post a new MGADiag report with details of any error messagesencountered.

 

[nostradamus77]

Thanks, this is very weird though as I have replaced drive P many months ago. Actually, it does not even exist anymore. I am a bit hesitant to run chkdsk on my system disk C - made some bad experiences before doing so, which led to drive failure or other things broken. I know that this is not supposed to happen, but seen many online posts that it is indeed an issue with chkdsk.

Any other suggestion to troubleshoot?

 

[NoelDP]

You can ignore the P: drive CHKDSK then

CHKDSK will only cause problems where the disk is already failing badly, as it does stress it a little. Assuming the drive is in a reasonable state, then it can do no harm, and may do a lot of good.

SFC is essential - it may tell us which of the many Loaders has been used, which may then allow us to uninstall it properly, and check for remaining nasties.

(Are there any strange folders in the C: drive root? - another possible clue to the loader)

I have to go out now - back later.

 

[nostradamus77]

PLease attempt validation at www.microsoft.com/genuine/validate - it may pass because of the hack, but the hack may also be discovered, and if so, you'll be offered the kit.

I did another attempt when stopping some other things that I was running and also using a VPN. This time, I got a different error message: "This Update is not applicable to your computer".

Other thoughts?

 

[nostradamus77]

Thanks, here we go with the log file. Thanks in advance for any thoughts you may have.

 

[NoelDP]

Ouch - this isn't good

2013-10-20 19:59:31, Info                  CSI    [EMAIL="00000004@2013/10/20:11:59:31.666"]00000004@2013/10/20:11:59:31.666[/EMAIL] PopulateComponentFamiliesKey - Begin
2013-10-20 19:59:41, Error                 CSI    00000005 (F) STATUS_OBJECT_NAME_NOT_FOUND #1278636# from Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey(flg = 0, key = {provider=NULL, handle=0}, da = (KEY_READ|KEY_WOW64_64KEY), oa = @0xc0e210->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[164]"\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_Microsoft-windows-a..es-interface-router_31bf3856ad364e35_none_f2dccc14f607b91"; a:(OBJ_CASE_INSENSITIVE)}, disp = Unmapped disposition: 12641752 (0x00c0e5d8))[gle=0xd0000034]
2013-10-20 19:59:41, Error                 CSI    [EMAIL="00000006@2013/10/20:11:59:41.476"]00000006@2013/10/20:11:59:41.476[/EMAIL] (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(3676): Error STATUS_OBJECT_NAME_NOT_FOUND originated in function Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey expression: (null)
[gle=0x80004005]
2013-10-20 19:59:41, Error                 CSI    00000007 (F) STATUS_OBJECT_NAME_NOT_FOUND #1278635# from Windows::Rtl::SystemImplementation::CKey::OpenExistingKey(f = 0, da = (KEY_READ), oa = @0xc0e6d0, key = NULL, disp = (null))[gle=0xd0000034]
2013-10-20 19:59:41, Info                  CBS    NonStart: Failed to get store. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2013-10-20 19:59:41, Info                  CBS    Failed to ensure no startup processing was required. [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2013-10-20 19:59:41, Info                  CBS    Failed during startup processing, continuing with Trusted Installer execution [HRESULT = 0x80070002 - ERROR_FILE_NOT_FOUND]
2013-10-20 19:59:41, Info                  CBS    Startup processing thread terminated normally
2013-10-20 19:59:44, Info                  CSI    [EMAIL="00000008@2013/10/20:11:59:44.369"]00000008@2013/10/20:11:59:44.369[/EMAIL] PopulateComponentFamiliesKey - Begin
2013-10-20 19:59:54, Error                 CSI    00000009 (F) STATUS_OBJECT_NAME_NOT_FOUND #2557289# from Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey(flg = 0, key = {provider=NULL, handle=0}, da = (KEY_READ|KEY_WOW64_64KEY), oa = @0xdecb00->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[164]"\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\Winners\amd64_Microsoft-windows-a..es-interface-router_31bf3856ad364e35_none_f2dccc14f607b91"; a:(OBJ_CASE_INSENSITIVE)}, disp = Unmapped disposition: 14601928 (0x00decec8))[gle=0xd0000034]
2013-10-20 19:59:54, Error                 CSI    [EMAIL="0000000a@2013/10/20:11:59:54.253"]0000000a@2013/10/20:11:59:54.253[/EMAIL] (F) d:\win7sp1_gdr\base\wcp\sil\merged\ntu\ntsystem.cpp(3676): Error STATUS_OBJECT_NAME_NOT_FOUND originated in function Windows::Rtl::SystemImplementation::DirectRegistryProvider::SysOpenKey expression: (null)
[gle=0x80004005]
2013-10-20 19:59:54, Error                 CSI    0000000b (F) STATUS_OBJECT_NAME_NOT_FOUND #2557288# from Windows::Rtl::SystemImplementation::CKey::OpenExistingKey(f = 0, da = (KEY_READ), oa = @0xdecfc0, key = NULL, disp = (null))[gle=0xd0000034]

You have some registry corruption present.
Your best bet is to attempt a System Restore back to a time before the system started misbehaving - assuming it's not much more than a couple of weeks ago.

other than that, we'll have to start playing in the registry, which is not much fun

 

[nostradamus77]

Thanks for bringing the news - though it is bad news...

Unfortunately, I am having the update issue since day-1, so I doubt rolling back to an earlier version will do any good.

I can imagine that it will be painful to do a manual attempt to repair the registry. Is there any quick fix that I may at least try to see whether it repairs it.

Is this a sign of malware, a broken disk, or others?

 

[NoelDP]

It could be damaged media or perhaps faulty RAM.
Test the hard drive with the (HD) manufacturer's test utility and the RAM with MemTest86+ (www.memtest.org).

 

[nostradamus77]

It is not a ram issue. I have tested and all is great. Having said this, I have changed ram a few months back as it was faulty. Actually, when I had installed Win7 on this machine, it was installed with faulty ram. Can this error still be a legacy from this? HD is also ok. Any other ideas what to do to fix the registry corruption?

 

[NoelDP]

Certainly, installing an OS when you have faulty RAM could cause this type of problem.

You may find it better to do a repair install - or even a clean install, if you don't have much else on the system yet.
See here for the instructions for a repair.... http://www.sevenforums.com/tutorials/3413-repair-install.html?ltr=R