Solved Genuine Advantage issue

[DavidS]

This is almost brand new work computer. It is about 3 months old.

The PC ran perfectly fine for about 1-2 months. About 3 weeks ago we started receiving the genuine activation screen.

Our IT has attempted to validate it online (several times) and it takes the validation fine and confirms it is validated. Within a day or so it starts to throw up the genuine advantage screen again.

Below is the MGA report. Any assistance would be awesome. I am extremely limited on what I can install on this PC for trying to resolve this.

The original OS on this was Windows 8. IBM or the shipper installs our image (Windows7) onto the PC before shipping to us.

Thanks,

David

I also found this in the CBS log.

2013-10-17 12:24:24, Info                  CSI    00000032 [SR] Verify complete
2013-10-17 12:24:24, Info                  CSI    00000033 [SR] Repairing 1 components
2013-10-17 12:24:24, Info                  CSI    00000034 [SR] Beginning Verify and Repair transaction
2013-10-17 12:24:24, Info                  CSI    00000035 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.7601.17514_none_5dc908a6fd144a83\slui.exe do not match actual file [l:16{8}]"slui.exe" :
  Found: {l:32 b:KbG6TMN0neM3ruj/BBo1+ZFDV/wkGWknSYBX+12/4vw=} Expected: {l:32 b:y2+q+f+8kaTzBqldRHLuI3FckbBs5ZOU1qXCOk9LlHY=}
2013-10-17 12:24:24, Info                  CSI    00000036 [SR] Cannot repair member file [l:16{8}]"slui.exe" of Microsoft-Windows-Security-SPP-UX, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-10-17 12:24:24, Info                  CSI    00000037 Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.7601.17514_none_5dc908a6fd144a83\slui.exe do not match actual file [l:16{8}]"slui.exe" :
  Found: {l:32 b:KbG6TMN0neM3ruj/BBo1+ZFDV/wkGWknSYBX+12/4vw=} Expected: {l:32 b:y2+q+f+8kaTzBqldRHLuI3FckbBs5ZOU1qXCOk9LlHY=}
2013-10-17 12:24:24, Info                  CSI    00000038 [SR] Cannot repair member file [l:16{8}]"slui.exe" of Microsoft-Windows-Security-SPP-UX, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2013-10-17 12:24:24, Info                  CSI    00000039 [SR] This component was referenced by [l:198{99}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~x86~~6.1.7601.17514.WindowsFoundationDelivery"
2013-10-17 12:24:25, Info                  CSI    0000003a Hashes for file member \??\C:\Windows\System32\slui.exe do not match actual file [l:16{8}]"slui.exe" :
  Found: {l:32 b:KbG6TMN0neM3ruj/BBo1+ZFDV/wkGWknSYBX+12/4vw=} Expected: {l:32 b:y2+q+f+8kaTzBqldRHLuI3FckbBs5ZOU1qXCOk9LlHY=}
2013-10-17 12:24:25, Info                  CSI    0000003b Hashes for file member \SystemRoot\WinSxS\x86_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.7601.17514_none_5dc908a6fd144a83\slui.exe do not match actual file [l:16{8}]"slui.exe" :
  Found: {l:32 b:KbG6TMN0neM3ruj/BBo1+ZFDV/wkGWknSYBX+12/4vw=} Expected: {l:32 b:y2+q+f+8kaTzBqldRHLuI3FckbBs5ZOU1qXCOk9LlHY=}
2013-10-17 12:24:25, Info                  CSI    0000003c [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\Windows\System32"\[l:16{8}]"slui.exe"; source file in store is also corrupted
2013-10-17 12:24:25, Info                  CSI    0000003d Repair results created:
POQ 3 starts:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE22
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-*****-*****-H33D2
Windows Product Key Hash: Tq24kYqwT+RhkWSsC/r/tNLr2+Q=
Windows Product ID: 55041-011-1418304-86946
Windows Product ID Type: 6
Windows License Type: Volume MAK
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {7BE08F9C-6508-4390-8908-9BB98E925787}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.9.42.0
Signed By: Microsoft
Product Name: Windows 7 Professional
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.130828-1532
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Professional Edition 2003 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\slui.exe[6.1.7601.17514], Hr = 0x800b0100
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{7BE08F9C-6508-4390-8908-9BB98E925787}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-BBBBB</PKey><PID>55041-011-1418304-86946</PID><PIDType>6</PIDType><SID>S-1-5-21-3038940248-1809484214-3910411663</SID><SYSTEM><Manufacturer>LENOVO</Manufacturer><Model>5100C2U</Model></SYSTEM><BIOS><Manufacturer>LENOVO</Manufacturer><Version>9ZKT36AUS</Version><SMBIOSVersion major="2" minor="7"/><Date>20130226000000.000000+000</Date></BIOS><HWID>C9A23F07018400F2</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>LENOVO</OEMID><OEMTableID>TC-9Z   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90110409-6000-11D3-8CFE-0150048383C9}"><LegitResult>100</LegitResult><Name>Microsoft Office Professional Edition 2003</Name><Ver>11</Ver><Val>8E25C6D3C374502</Val><Hash>rwXx3PUlaihtED/ay+7VFRE5MiA=</Hash><Pid>73931-641-5849754-57631</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="11" Result="100"/><App Id="16" Version="11" Result="100"/><App Id="18" Version="11" Result="100"/><App Id="19" Version="11" Result="100"/><App Id="1A" Version="11" Result="100"/><App Id="1B" Version="11" Result="100"/><App Id="44" Version="11" Result="100"/></Applications></Office></Software></GenuineResults>  
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, VOLUME_MAK channel
Activation ID: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 55041-00172-011-141830-03-1033-7601.0000-2772013
Installation ID: 012420877990416064854012095692622432543152539353168482
Processor Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88338[/URL]
Machine Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88339[/URL]
Use License URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88341[/URL]
Product Key Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88340[/URL]
Partial Product Key: H33D2
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 10/17/2013 12:26:12 PM
Windows Activation Technologies-->
HrOffline: 0x8004FE22
HrOnline: N/A
HealthStatus: 0x0000000000000800
Event Time Stamp: 10:17:2013 12:24
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
 
HWID Data-->
HWID Hash Current: LgAAAAEAAQABAAIAAAACAAAAAQABAAEAeqh4a3pnCLJE6xxDznCKmzzaejKGWw==
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name OEMID Value OEMTableID Value
  APIC   LENOVO  TC-9Z   
  FACP   LENOVO  TC-9Z   
  HPET   LENOVO  TC-9Z   
  MCFG   LENOVO  TC-9Z   
  FPDT   LENOVO  TC-9Z   
  TCPA   LENOVO  TC-9Z   
  SLIC   LENOVO  TC-9Z   
  MSDM   LENOVO  TC-9Z   
  BGRT   LENOVO  TC-9Z   
  SSDT   LENOVO  TC-9Z   
  SSDT   LENOVO  TC-9Z   
  IVRS   LENOVO  TC-9Z   
  CRAT   LENOVO  TC-9Z

 

[NoelDP]

This machine originally shipped with Win8 installed?

The installed Product Key is an MAK Key for Windows 7 Pro (common in company installs)

The problem is the result of the following error...

Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration

This is often the result of mistaken use of registry cleaners/optimisers/destroyers (pick any one)



To confirm thatthe problem is what I think it is, please run the following commands in anElevated Command Prompt window and post the results.


REG QUERY HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5AA}/S

REG QUERY HKLM\SOFTWARE\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5AA} /S

REG QUERY HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5AA}/S



Here are some instructions to make lifeeasier

1) To open anElevated Command Prompt Window (the ECP window), click on Start, All Programs,Accessories – then right-click on Command Prompt, and select Run asAdministrator. Accept the UAC prompt.

2) To run thecommands easier, highlight the block of commands, and right-click on thehighlight – select Copy. In the CP Window, click on the black/white icon at topleft – select Paste. The commands will run but may not complete the lastcommand, so hit the Enter Key once.

3) To copy theresults... click on the Black/White icon in the top left, and select Edit...'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to pasteit into your response.

 

[DavidS]

Noel,

Attached are the results of your request.

We received the computer with Windows 7 and our company image already on it. The system restore discs are windows 8. All of the stores I have been to recently the IBM restore discs are windows 8.


I am not aware of any registry cleaners, optimizers or destroyers ever being installed on this PC. I checked all registry keys for this type of entry as well as Program Files and see nothing like that.

I am the only person which uses this PC and know for sure I haven't used any of them on it. It is a possibility our IT department ran something remotely, but I have never known for them to do that before.

C:\Windows\system32>REG QUERY HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{EE57495
7-4077-4AD6-8658-327C2C86C5AA}/S
ERROR: The system was unable to find the specified registry key or value.
C:\Windows\system32>
C:\Windows\system32>REG QUERY HKLM\SOFTWARE\Classes\TypeLib\{EE574957-4077-4AD6-
8658-327C2C86C5AA} /S
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5A
A}\1.0
    (Default)    REG_SZ    SPPUI 1.0 Type Library
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5A
A}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5A
A}\1.0\0\win32
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\slui.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5A
A}\1.0\FLAGS
    (Default)    REG_SZ    0
 
C:\Windows\system32>
C:\Windows\system32>REG QUERY HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{EE57495
7-4077-4AD6-8658-327C2C86C5AA}/S
ERROR: The system was unable to find the specified registry key or value.

 

[NoelDP]

Well - at least we seem to have found the cause - my problem is that the combination of errors is unusual..

Can I ask which idiot in your company decided to image their machines with a 32-bit system, when the machines are plainly capable of 64-bit?
(feel free to quote me!)

I'll try and come back with a fix - but it could be tomorrow evening before I have time
Shout if you haven't heard in 48 hours!

 

[DavidS]

PRIORITY NOTE: I applied your technique off of a post someone did on the ms.com board. Since I completed this I haven't seen the WGA screen reappear. I will post tomorrow as to whether this is resolved.

Credit Noel Paton:
1) Click Start button.
2) Type: CMD.exe into the 'Search programs and files' field
3) Right-Click on CMD.exe and select Run as Administrator
4) Type: net stop sppsvc (It may ask you if you are sure, select yes)
Note: the Software Protection service may not be running, this is ok.
5) Type: cd %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform
6) Type: rename tokens.dat tokens.bar
7) Type: cd %windir%\system32
8) Type: net start sppsvc
9) Type: slui.exe
10) After a couple of seconds Windows Activation dialog will appear. You may be asked to re-activate and/or re-enter your product key or Activation may occur automatically.

I was informed long ago the reason for the 32 v 64 was a cost saving factor. Many of the pieces of software we use for the gate system or monitoring have not been updated to 64 bit, or the company is obsolete. Some of them we have to run in Windows Virtual PC to get them to even run.

I was told a $ number to update the software or get a new license for the 64 bit version for the several hundred stores would be in the few million range.

I appreciate your assistance with this.

David

 

[NoelDP]

Someone in your company was telling porkies

MS charges no more for 64-bit licenses than for 32-bit.

99+% of 32-bit apps will run happily (with perhaps a tweak or two) in a 64-bit system. The major exception to this would be apps which attempt direct access to hardware, or have unsigned drivers (which amounts to the same thing)

There are a very limited number of 32-bit apps which cannot run in 64-bit (AutoCAD is one - but they will provide a 64-bit installer for free, if I understand their system properly!)

I hate to say this - but shoot the messenger :devil: Someone was almost certainly too lazy to do the work required for proper testing (or to be less harsh, they weren't given the budget! )

The Licensing Store repair that you quote will almost certainly NOT work in your instance, because the error in the report is much more than the inbuilt repair system can cope with. The good news is that it won't do any harm!

 

[DavidS]

You were correct Noel. I still have the WGA issue.

David

 

[NoelDP]

OK - and I have to admit to having confused myself here since the output from the command I gave you is perfectly normal for a 32-bit machine, which means that we're going to have to dig a bit deeper for a cause/solution.


Please downloadand save the CheckSUR tool from http://support.microsoft.com/kb/947821

(you'll need tolook in the details for Windows 7, downloading from the Microsoft DownloadCenter)



Run it - The toolcan take anywhere from 5 mins to a couple of hours to run (or 'Install')depending on how much it has to do, and may exit silently - it may appear tofreeze for most of that time, but be patient.

The result islogged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file



Then zip theCheckSUR.log and attach it in your reply.

If that shows clear (and even if it doesn't) -


Please run a full CHKDSK and SFC scan....



Click on Start > All Programs > Accessories

Right-click on the Command Prompt entry

Select Run as Administrator and accept the UAC prompt - the ElevatedCommand Prompt window should pop up.



At the Command prompt, type



CHKDSK C: /R



and hit the Enter key.

You will be told that the drive is locked,

and the CHKDSK will run at he next boot - hit the Y key, pressEnter, and then reboot.



The CHKDSK will take a few hours depending on the size of the drive,so be patient!



After the CHKDSK has run, Windows should boot normally (possiblyafter a second auto-reboot) -

then run the SFC.



SFC -System File Checker -Instructions

Click on Start > All Programs > Accessories

Right-click on the Command Prompt entry

Select Run as Administrator and accept the UAC prompt - the ElevatedCommand Prompt window should pop up.



At the Command prompt, type



SFC /SCANNOW



and hit the Enter key



Wait for the scan to finish - make a note of any error messages -and then reboot.





Copy the CBS.log file created(C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate itdirectly) and then compress the copy and attach it to your reply


Post a new MGADiag report with details of any error messagesencountered.

 

[DavidS]

Requested Updates

I attached all the reports you wanted in the zip.

I had to attach the MGA Report in a PDF, inside the zip. I received the following error when trying to perform the copy function: Failed to create output files, hr = 0x80070002. Please contact support.

David

 

[NoelDP]

That error is common but it usually still copy/pastes ok.
I'll come back eith an analysis later ( in the pub now )

 

[DavidS]

In caelum cerevisiae est nullum, Itaque hic bibemus illum!
In heaven there's no beer, that's why we drink it here!

 

[NoelDP]

Aka - rtfm ?

 

[NoelDP]

Thanks for the translation!

You have some severe corruption present. 450+ files are corrupt

I think your best option is going to be a repair install.

See here for instructions...

http://www.sevenforums.com/tutorials/3413-repair-install.html?ltr=R

 

[DavidS]

I appreciate your assistance on this. I will contact our IT and let them do their thing.

Be well my friend.

David

 

[NoelDP]

Good luck with it!