Solved Genuine OS?? How to find product key

[copiman]

I was asked to get rid of viruses on a PC. When I booted the PC I get a pop Windows Activation box telling me "Windows is not genuine". When I go to system there is not an activation area in it. Its gone. The person who owns it said it was put on about 3 years ago and the non genuine pop up began a few months back. This person I feel is trustworthy. The PC was badly infected. Could the malware cause this? Anyway, can someone take a look at the Diagnostic output and let me know if its genuine and how to resolve this?


Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
Windows Product ID: 00359-OEM-8992687-00006
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {F284C355-A982-4B19-946A-ACBC41929236}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000000
Build lab: 7601.win7sp1_ldr.170913-0600
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 103 Blocked VLK
Microsoft Office Enterprise 2007 - 103 Blocked VLK
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\npwatweb.dll[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\watux.exe[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\watweb.dll[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7600.16385], Hr = 0x800b0100

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{F284C355-A982-4B19-946A-ACBC41929236}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-4136267983-583667314-3466051221</SID><SYSTEM><Manufacturer>GATEWAY </Manufacturer><Model>T3990 </Model></SYSTEM><BIOS><Manufacturer>Intel Corp.</Manufacturer><Version>BF86510A.15A.0085.P20.0412152353</Version><SMBIOSVersion major="2" minor="3"/><Date>20041215000000.000000+000</Date></BIOS><HWID>DA5A3A07018400FC</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>103</Result><Products><Product GUID="{90120000-0030-0000-0000-0000000FF1CE}"><LegitResult>103</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>84B9C24ED082586</Val><Hash>tyiZ/dcb+zqWe0jHG65uncl8TX8=</Hash><Pid>89388-707-0366501-65548</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="103"/><App Id="16" Version="12" Result="103"/><App Id="18" Version="12" Result="103"/><App Id="19" Version="12" Result="103"/><App Id="1A" Version="12" Result="103"/><App Id="1B" Version="12" Result="103"/><App Id="44" Version="12" Result="103"/><App Id="A1" Version="12" Result="103"/><App Id="BA" Version="12" Result="103"/></Applications></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Input Error: Can not find script file "C:\Windows\system32\slmgr.vbs".

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: N/A
HealthStatus: 0x0000000000000000
Event Time Stamp: N/A
ActiveX: Not Registered - 0x80040154
Admin Service: Not Registered - 0x80040154
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MgAAAAIABAABAAEAAAABAAAAAQABAAEAJJTQx7wghqriEzTZ9Ofix7z15OhaU1JgkOg=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC GATEWA 04DT043
FACP GATEWA 04DT043
ASF! LEGEND I865PASF
WDDT INTEL OEMWDDT

 

[torchwood]

Hi Copiman,

according to that report the system is non genuine

Its a Gateway comp with a Bios date of 2004 Way to early for W7 and the key thats on the system is for a Factory produced version, not built until 2009.
Further backed up by the fact it only has a Vista marker edition and no SLIC Table

The Office Enterprise is also non genuine - going to a blocked license server

The virus probobly broke the exploit in use

I suspect if you can read the COA sticker its for Vista

The only way to go is to purchase a new licence, not cheap nowadays and buying off the Net is not a good idea.


Roy

 

[copiman]

Thanks Roy. It originally had XP on it. The COA sticker for XP is on the back of the tower. Some computer shop loaded 7 I was told. Anyway, I will take the PC back to the owner. I can't help a non-legit OS. He really needs to just by a new PC. Specs on this one are soooooo low.

By the way, is there a place you can direct me to so I can learn how to interpret the diagnostic report? I'm about to graduate from tech school in computer and network support and have been learning a lot on my own as well as help from the forums.

Thank you for your help.

Robert