Error "This copy of Windows is not genuine".

[dayron422]

I have read several threads regarding this error message, but the solutions seemed varied. I found a Trojan on my system that I removed but the damage was done. How can I return to a valid version of Windows 7 as this is definitely valid. I ran a MGADiag as it seems to give the indicators but I can't read it. Please help!

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
 
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-QCPVQ-KHRB8-RMV82
Windows Product Key Hash: +Rj3N34NLM2JqoBO/OzgzTZXgbY=
Windows Product ID: 00359-OEM-8992687-00095
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {5E28A2D3-06BF-4233-8A1D-F114D600B727}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120503-2030
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
 
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
 
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
 
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
 
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Enterprise 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-8009_E2AD56EA-766-2ee7_E2AD56EA-148-80004005_16E0B333-89-80004005_B4D0AA8B-1029-80004005
 
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Users\Michelle Weatherby\AppData\Local\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
 
File Scan Data-->
 
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{5E28A2D3-06BF-4233-8A1D-F114D600B727}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-RMV82</PKey><PID>00359-OEM-8992687-00095</PID><PIDType>2</PIDType><SID>S-1-5-21-3562556381-2389667567-2771975133</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Studio 1749</Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A04</Version><SMBIOSVersion major="2" minor="6"/><Date>20100422000000.000000+000</Date></BIOS><HWID>53C23C07018400FC</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL </OEMID><OEMTableID>CL09 </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>9FE67E03EA3DD86</Val><Hash>eQO63rqSEW/PLOje2+ZUSZK8VeY=</Hash><Pid>89388-707-1022691-65214</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 
 
Spsys.log Content: 0x80070002
 
Licensing Data-->
Software licensing service version: 6.1.7601.17514
 
Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800095-02-1033-7600.0000-1952010
Installation ID: 009072954301812684946345756254473376852470101804853241
Processor Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88338[/URL]
Machine Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88339[/URL]
Use License URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88341[/URL]
Product Key Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88340[/URL]
Partial Product Key: RMV82
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 10/2/2012 10:37:25 AM
 
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 7:13:2012 16:48
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
 
 
HWID Data-->
HWID Hash Current: NgAAAAIAAgABAAEAAQACAAAAAwABAAEAonZo93cWJEWaUcasYoIovBCxYj06OHhnfq767Vxd
 
OEM Activation 1.0 Data-->
N/A
 
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
ACPI Table Name    OEMID Value    OEMTableID Value
APIC            PTLTD              APIC 
FACP            INTEL         CALPELLA
HPET            INTEL         CALPELLA
BOOT            PTLTD         $SBFTBL$
MCFG            INTEL         CALPELLA
OSFR            DELL         DELL 
SLIC            DELL         CL09 
SSDT            PmRef        CpuPm

 

[NoelDP]

There is nothing amiss in your report - are you still seeing the non-genuine messages??
Please attempt validation at www.microsoft.com/genuine/validate using Internet Explorer.

Your Office installation, though, is probably non-genuine unless you acquired it through your employer or college.

 

[dayron422]

I ran went to the windows site and it is valid but I rebooted and received the same "build 7601. The copy of Windows is not genuine" during boot but it didn't remain there as it did before. The boot process now takes a REALLY long time (1 -2 hours) and I just got a message "Failed to connect to a windows service" apparently unable to connect to "System Event Notification Service". Did the Trojan do permanent damage to my system. Still waiting to get it booted to a state where I can run another diagnostic.

 

[NoelDP]

This sounds as if you may have been severly infested with a Trojan - possibly Sirefef.
I would recommend backing up your data to external media now, and then doing a reformat and reinstall from the Recovery media - see your manual for instructions.

 

[dayron422]

According to AVG, it was "Trojan horse Generic 27.BFMF". I have Carbonite so my crucial files are safe, but is there a way to restore it without having to do a hard reset? I don't haven't any restore points set.

 

[NoelDP]

It's safest to reformat - although I can't find anything sensible on the weg about this particular variant.
See what malwarebytes has to say - do all the following in Safe Mode with Networking.


Please download and install Malwarebytes Anti-malware (free version) from www.malwarebytes.org - UNtick 'Enable free trial of MBAM PRO' at the end of the installation - and update it, then run a full scan in your main account, and Quick scans in any other user accounts.

Delete everything it finds

 

[Joan Archer]

I'd follow Noels suggestion, you would then be sure that the Trojan was gone. Restore points are not the same as doing a Recovery it's possible your restore points could have all been wiped out via the infections anyway so wouldn't have helped you.

You say your files are safe, in that case do the reformat and restore, do you have a recovery partition or a set of disc's from the Manufacturer ?

 

[dayron422]

I'm currently going through my 200 gb of pics, and video to make sure I'm backed up to Carbonite. Interestingly I found the recovery disc from Dell for this laptop and it says XP service pack 3 but I paid for and am running Windows 7. I think I owe Dell a phone call.

I ran the malwarebytes program and it found 3 adware which were removed.

 

[edwar]

I'm currently going through my 200 gb of pics, and video to make sure I'm backed up to Carbonite. Interestingly I found the recovery disc from Dell for this laptop and it says XP service pack 3 but I paid for and am running Windows 7. I think I owe Dell a phone call.

I ran the malwarebytes program and it found 3 adware which were removed.

If your system came with Windows 7 installed then there is a Del Utility to create a REAL Win 7 DVD or ISO to burn to DVD or thumb drive. Dell Data Recovery 2 or Dell Backup & Recovery.

 

[Golden]

but I paid for and am running Windows 7.

Hi,

I agree with others here, you should wipe your disk and perform a clean installation. If you follow this tutorial carefully, you will see that you can download a Windows 7 ISO to perform your install with, without having to wait on Dell:

http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

Regards,
Golden

 

[edwar]

I'm currently going through my 200 gb of pics, and video to make sure I'm backed up to Carbonite. Interestingly I found the recovery disc from Dell for this laptop and it says XP service pack 3 but I paid for and am running Windows 7. I think I owe Dell a phone call.

I ran the malwarebytes program and it found 3 adware which were removed.

What does the COA sticker say as to what OS came installed on it from Dell. That sticker is either on the side or back of the computer if a desktop or on the bottom or in the battery compartment if a Notebook.

Could be that XP SP3 CD you found is from an older Dell computer?

 

[Layback Bear]

Just a reminder. Any thing you have backed up on what ever external device. Cloud or otherwise may also be infected. Make sure it clean before installing it on your new Windows 7 install.

 

[dayron422]

Thanks for your advice everyone. I will follow the tutorial to get my Windows 7 back. I am almost done backing-up files and will clean install later today. You've all been very helpful.

 

[NoelDP]

Good Luck!

 

[dayron422]

Thanks for all your advice everyone. I wiped my hard drive and used the Dell Factory Restore which put the Windows 7 back on. Everything is running fast and Carbonite has almost completely restored my 200 gb of files.

However, I have had 3 blue screen crashes since the restore that never occurred before. I would attach a crash log but I don't know where its located. Should I restore again? It seems a shame since Carbonite has been going non-stop to restore me. Is Carbonite causing the problem?