Not genuine messages; error 0x80070426

[rjbarter]

Hello,

After my ACER with Windows 7 Home premium 64bit (from Staples) worked fine for about a year I am having trouble with 'not genuine' errors.

Prior to the errors, there were some problems over a couple days near the end of March where I found Avast AV was not running, I switched between a couple of different anti-virus programs, and also switched from a wired connection to a TP-link USB wifi stick that had some driver trouble. One morning (still near the end of March) the computer would not start and kicked into Startup repair which did not find anything. From here I selected to do a system repair and everything has been fine since except for the 'not genuine' errors. I vaguely recall an activation step or a activation popup on a later start up but believe (if I did) that I skipped it. I am now running AVG antivirus and been running Malwarebytes and there have no virus/malware problems.

The 'not genuine' errors now tend to occur once a week, usually after a Windows Update, then seem to go away for a few days (Computer->Properties->Windows Activation show status okay with the product id). A few days later when Windows Update runs then the 'not genuine' errors start again.

Below are TWO MGADiag reports. The first I ran when the most recent error popped up and the second was after I ran CHKDSK C: /R & SFC /SCANNOW (neither showed any issues).

In the event viewer I see plenty of 'The Software Protection service failed to start. 0x80070002 6.1.7601.17514' errors:
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
<EventID Qualifiers="49152">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2012-05-14T11:27:43.000000000Z" />
<EventRecordID>14127</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>cabot</Computer>
<Security />
</System>
- <EventData>
<Data>0x80070002</Data>
<Data>6.1.7601.17514</Data>
</EventData>
</Event>


Any ideas how to resolve this 'not genuine' issue?
Thanks




Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE21
Cached Online Validation Code: N/A, hr = 0xc0000022
Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
Windows Product ID: 00359-OEM-8992687-00006
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {9C04E0BC-CFA5-498A-9B76-ABE5AAC949DF}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120330-1504
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 100 Genuine
Microsoft Office Enterprise 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{9C04E0BC-CFA5-498A-9B76-ABE5AAC949DF}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-666869935-4054190426-1461873846</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire M5811</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>P01-A3</Version><SMBIOSVersion major="2" minor="6"/><Date>20091231000000.000000+000</Date></BIOS><HWID>794E3D07018400FC</HWID><UserLCID>1009</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Atlantic Standard Time(GMT-04:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>165E2B6FFCDAED0</Val><Hash>YOwJQ/4MkbPKMb+TMakYHxDzpdo=</Hash><Pid>81599-872-0905016-65072</Pid><PidType>1</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.
Error: 0x80070426

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0001000000000000
Event Time Stamp: 4:29:2012 16:51
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered Service: sppsvc


HWID Data-->
HWID Hash Current: MAAAAAEAAAABAAEAAgACAAAAAgABAAEA6GHkZ4SxUmkAa/hzCsqkwL6kCBkHh1xd

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC ACRSYS APIC1639
FACP ACRSYS FACP1639
HPET ACRSYS OEMHPET
MCFG ACRSYS OEMMCFG
SLIC ACRSYS ACRPRDCT
OEMB ACRSYS OEMB1639
GSCI ACRSYS GMCHSCI
AWMI ACRSYS OEMB1639
SSDT DpgPmm CpuPm


--------------------
--------------------
--------------------
After chkdsk & sfc:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE21
Cached Online Validation Code: N/A, hr = 0xc0000022
Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
Windows Product ID: 00359-OEM-8992687-00006
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {9C04E0BC-CFA5-498A-9B76-ABE5AAC949DF}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120330-1504
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 100 Genuine
Microsoft Office Enterprise 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{9C04E0BC-CFA5-498A-9B76-ABE5AAC949DF}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-666869935-4054190426-1461873846</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire M5811</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>P01-A3</Version><SMBIOSVersion major="2" minor="6"/><Date>20091231000000.000000+000</Date></BIOS><HWID>794E3D07018400FC</HWID><UserLCID>1009</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Atlantic Standard Time(GMT-04:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>165E2B6FFCDAED0</Val><Hash>YOwJQ/4MkbPKMb+TMakYHxDzpdo=</Hash><Pid>81599-872-0905016-65072</Pid><PidType>1</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.
Error: 0x80070426

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0001000000000000
Event Time Stamp: 5:14:2012 05:36
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered Service: sppsvc


HWID Data-->
HWID Hash Current: MAAAAAEAAAABAAEAAgACAAAAAgABAAEA6GHkZ4SxUmkAa/hzCsqkwL6kCBkHh1xd

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC ACRSYS APIC1639
FACP ACRSYS FACP1639
HPET ACRSYS OEMHPET
MCFG ACRSYS OEMMCFG
SLIC ACRSYS ACRPRDCT
OEMB ACRSYS OEMB1639
GSCI ACRSYS GMCHSCI
AWMI ACRSYS OEMB1639
SSDT DpgPmm CpuPm

 

[NoelDP]

You have a number of issues.
1) You have an error message often associated with disk/file corruption
2) Your Software Protection Service is not running
3) you have a Volume Licensed version of Office 2007 installed.

You seem to have already checked for sorruption problems - but you haven't specified what the results of either the CHKDS or the SFC were.
Please do so - and also the results of the following.....
Click on Start
in the Search box, type
SERVICES.MSC
and hit the Enter key - accept the UAC prompt if you get one.
Look in the console for the Software Protection service, right-click on it and select Properties.
make sure that the Startup Type is set to Automatic (Delayed Start), and click Apply.

Try starting the service now - do you get an error message? Does it start? does it almost immediately stop again?
Post back with your results, and a new MGADiag report.

If it doesn't start, then please do the following...
Please open an Elevated (Administrator) Command Prompt window and use the following commands....

net start sppsvc
sc qc sppsvc
sc queryex sppsvc
sc qprivs sppsvc
sc qsidtype sppsvc
sc sdshow sppsvc


Here are some instructions to maike life easier
1) To open an Elevated Command Prompt Window (the CP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.

2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Windows, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.

3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

 

[rjbarter]

The chkdsk output I found in event viewer is pasted below and the SFC details can be found in the attached file.


Checking file system on C:
The type of the file system is NTFS.
Volume label is Acer.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
Cleaning up instance tags for file 0x1889c.
Cleaning up instance tags for file 0x1fffa.
353280 file records processed. File verification completed.
643 large file records processed. 0 bad file records processed. 0 EA records processed. 92 reparse records processed. CHKDSK is verifying indexes (stage 2 of 5)...
417226 index entries processed. Index verification completed.
0 unindexed files scanned. 0 unindexed files recovered. CHKDSK is verifying security descriptors (stage 3 of 5)...
353280 file SDs/SIDs processed. Cleaning up 1090 unused index entries from index $SII of file 0x9.
Cleaning up 1090 unused index entries from index $SDH of file 0x9.
Cleaning up 1090 unused security descriptors.
Security descriptor verification completed.
31974 data files processed. CHKDSK is verifying Usn Journal...
35299816 USN bytes processed. Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
353264 files processed. File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
68180896 free clusters processed. Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

958831615 KB total disk space.
685505596 KB in 155747 files.
117772 KB in 31975 indexes.
0 KB in bad sectors.
484659 KB in use by the system.
65536 KB occupied by the log file.
272723588 KB available on disk.

4096 bytes in each allocation unit.
239707903 total allocation units on disk.
68180897 allocation units available on disk.

Internal Info:
00 64 05 00 56 dd 02 00 66 49 05 00 00 00 00 00 .d..V...fI......
9d 86 00 00 5c 00 00 00 00 00 00 00 00 00 00 00 ....\...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

 

[NoelDP]

The chkdsk and SFC results look fine - any results from the service tests yet?

 

[rjbarter]

I checked the Software Protection Properties in Services and Startup Type is set to Automatic (Delayed Start) already.

When I try to start Software Protection it stops after a few seconds with the error: "Windows could not start the Software Protection service on the Local Computer. Error2: The System cannot find the file specified." Here is the MGADiag report I ran afterwards:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE21
Cached Online Validation Code: N/A, hr = 0xc0000022
Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
Windows Product ID: 00359-OEM-8992687-00006
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {9C04E0BC-CFA5-498A-9B76-ABE5AAC949DF}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120330-1504
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 100 Genuine
Microsoft Office Enterprise 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{9C04E0BC-CFA5-498A-9B76-ABE5AAC949DF}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-666869935-4054190426-1461873846</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire M5811</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>P01-A3</Version><SMBIOSVersion major="2" minor="6"/><Date>20091231000000.000000+000</Date></BIOS><HWID>794E3D07018400FC</HWID><UserLCID>1009</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Atlantic Standard Time(GMT-04:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0030-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>165E2B6FFCDAED0</Val><Hash>YOwJQ/4MkbPKMb+TMakYHxDzpdo=</Hash><Pid>81599-872-0905016-65072</Pid><PidType>1</PidType></Product></Products><Applications><App Id="15" Version="12" Result="100"/><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="19" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="44" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/><App Id="BA" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.
Error: 0x80070426

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0001000000000000
Event Time Stamp: 5:14:2012 05:36
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered Service: sppsvc


HWID Data-->
HWID Hash Current: MAAAAAEAAAABAAEAAgACAAAAAgABAAEA6GHkZ4SxUmkAa/hzCsqkwL6kCBkHh1xd

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC ACRSYS APIC1639
FACP ACRSYS FACP1639
HPET ACRSYS OEMHPET
MCFG ACRSYS OEMMCFG
SLIC ACRSYS ACRPRDCT
OEMB ACRSYS OEMB1639
GSCI ACRSYS GMCHSCI
AWMI ACRSYS OEMB1639
SSDT DpgPmm CpuPm



Here is the output from the CP commands:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>net start sppsvc
The Software Protection service is starting.
The Software Protection service could not be started.

A system error has occurred.

System error 2 has occurred.

The system cannot find the file specified.


C:\Windows\system32>
C:\Windows\system32>sc qc sppsvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: sppsvc
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START (DELAYED)
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\sppsvc.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Software Protection
DEPENDENCIES : RpcSs
SERVICE_START_NAME : NT AUTHORITY\NetworkService

C:\Windows\system32>sc queryex sppsvc

SERVICE_NAME: sppsvc
TYPE : 10 WIN32_OWN_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 2 (0x2)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>sc qprivs sppsvc
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: sppsvc
PRIVILEGES : SeAuditPrivilege
: SeChangeNotifyPrivilege
: SeCreateGlobalPrivilege
: SeImpersonatePrivilege

C:\Windows\system32>sc qsidtype sppsvc
[SC] QueryServiceConfig2 SUCCESS

SERVICE_NAME: sppsvc
SERVICE_SID_TYPE: UNRESTRICTED

C:\Windows\system32>sc sdshow sppsvc

DA;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO
CRRC;;;IU)(A;;CCLCSWRPLOCRRC;;;SU)(A;;LCRP;;;AU)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCW
DWO;;;WD)

C:\Windows\system32>

 

[NoelDP]

All the output there looks normal,.please run thefollowing commands, and post the results.

icacls c:\windows\system32\sppsvc.exe
icacls c:\windows\system32\en-US\sppsvc.exe.mui
dir C:\Windows\ServiceProfiles\NetworkService /s /ah
DIR C:\Windows\ServiceProfiles\NetworkService
reg query HKU\S-1-5-20

 

[rjbarter]

Output from the third command was too big so I had to redirect it to the attached file. The others are below:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>icacls c:\windows\system32\sppsvc.exe
c:\windows\system32\sppsvc.exe NT SERVICE\TrustedInstallerF)
BUILTIN\AdministratorsRX)
NT AUTHORITY\SYSTEMRX)
BUILTIN\UsersRX)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>icacls c:\windows\system32\en-US\sppsvc.exe.mui
c:\windows\system32\en-US\sppsvc.exe.mui NT SERVICE\TrustedInstallerF)
BUILTIN\AdministratorsRX)
NT AUTHORITY\SYSTEMRX)
BUILTIN\UsersRX)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>




Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>DIR C:\Windows\ServiceProfiles\NetworkService
Volume in drive C is Acer
Volume Serial Number is B2F2-0EAC

Directory of C:\Windows\ServiceProfiles\NetworkService

23/04/2012 09:17 AM <DIR> .
23/04/2012 09:17 AM <DIR> ..
14/07/2009 01:45 AM <DIR> Desktop
14/07/2009 01:45 AM <DIR> Documents
14/07/2009 01:45 AM <DIR> Downloads
14/07/2009 01:45 AM <DIR> Favorites
14/07/2009 01:45 AM <DIR> Links
14/07/2009 01:45 AM <DIR> Music
14/07/2009 01:45 AM <DIR> Pictures
14/07/2009 01:45 AM <DIR> Saved Games
14/07/2009 01:45 AM <DIR> Videos
0 File(s) 0 bytes
11 Dir(s) 335,390,347,264 bytes free

C:\Windows\system32>reg query HKU\S-1-5-20

HKEY_USERS\S-1-5-20\AppEvents
HKEY_USERS\S-1-5-20\Console
HKEY_USERS\S-1-5-20\Control Panel
HKEY_USERS\S-1-5-20\Environment
HKEY_USERS\S-1-5-20\EUDC
HKEY_USERS\S-1-5-20\Keyboard Layout
HKEY_USERS\S-1-5-20\Network
HKEY_USERS\S-1-5-20\Printers
HKEY_USERS\S-1-5-20\Software
HKEY_USERS\S-1-5-20\System

C:\Windows\system32>

 

[rjbarter]

Been over 3 days now - unlikely previous times the problem did not go away after a few restarts. Previously the activation status would go back to okay and all would be okay for a week or more.

 

[NoelDP]

Sorry - I was sure I'd responded to this last night!! (but my email crashed so I may have gotten distracted)
There is a mass of files in an unexpected location - C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Media Player\Art Cache\LocalMLS
which is apparently caused by the workings of WMP networking - Windows 7 keeps on writing thousands of jpg files on - Microsoft Answers

The rest of the data looks normal.
Certainly, the file I was expecting to have problems, doesn't seem to (14/05/2012 10:56 AM 524,288 ntuser.dat), and there's not other indications of problems that I can see.

please run the following command - it may help us to see what's wrong...

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppsvc /s

post the results

 

[rjbarter]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppsvc /s

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppsvc
DisplayName REG_SZ @%SystemRoot%\system32\sppsvc.exe,-101
ImagePath REG_EXPAND_SZ %SystemRoot%\system32\sppsvc.exe
Description REG_SZ @%SystemRoot%\system32\sppsvc.exe,-100
ObjectName REG_SZ NT AUTHORITY\NetworkService
ErrorControl REG_DWORD 0x1
Start REG_DWORD 0x2
DelayedAutoStart REG_DWORD 0x1
Type REG_DWORD 0x10
DependOnService REG_MULTI_SZ RpcSs
ServiceSidType REG_DWORD 0x1
RequiredPrivileges REG_MULTI_SZ SeAuditPrivilege\0SeChangeNotifyPrivil
ege\0SeCreateGlobalPrivilege\0SeImpersonatePrivilege
FailureActions REG_BINARY 80510100000000000000000003000000140000000100
0000C0D4010001000000E09304000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppsvc\Security
Security REG_BINARY 01001480A0000000AC000000140000003000000002001C0001
00000002801400FF010F00010100000000000100000000020070000500000000001400FD01020001
010000000000051200000000001800FF010F0001020000000000052000000020020000000014009D
010200010100000000000504000000000014009D0102000101000000000005060000000000140014
00000001010000000000050B000000010100000000000512000000010100000000000512000000


C:\Windows\system32>

 

[NoelDP]

that's perfectly normal.
We'll have to keep looking then....

please run the following command

DIR C:\Windows /AH /S

All I need from that is the number of files found at the end - it should be somewhere below 500. If it's much higher then we may have a pointer.

reg query HKU\S-1-5-20 /s
please upload the results from that

dir C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform /s
dir C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform /s /ah
dir C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform /s /ar
dir C:\Windows\ServiceProfiles\NetworkService /ar /s

post the results of the above

dir C:\Windows /ar /s

I only need the number of files count from that

 

[rjbarter]

DIR C:\Windows /AH /S

gave

Total Files Listed:
1212 File(s) 139,639,047 bytes
493 Dir(s) 592,063,967,232 bytes free


reg query HKU\S-1-5-20 /s

see reg_q_HKU.txt


dir C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform /s

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>dir C:\Windows\ServiceProfiles\NetworkService\AppData\Roamin
g\Microsoft\SoftwareProtectionPlatform /s
Volume in drive C is Acer
Volume Serial Number is B2F2-0EAC

Directory of C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsof
t\SoftwareProtectionPlatform

05/05/2012 08:54 PM <DIR> .
05/05/2012 08:54 PM <DIR> ..
14/07/2009 01:46 AM <DIR> Cache
05/05/2012 08:54 PM 7,113,171 tokens.dat
1 File(s) 7,113,171 bytes

Directory of C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsof
t\SoftwareProtectionPlatform\Cache

14/07/2009 01:46 AM <DIR> .
14/07/2009 01:46 AM <DIR> ..
05/05/2012 09:05 PM 149,424 cache.dat
1 File(s) 149,424 bytes

Total Files Listed:
2 File(s) 7,262,595 bytes
5 Dir(s) 592,059,486,208 bytes free



dir C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform /s /ah

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>dir C:\Windows\ServiceProfiles\NetworkService\AppData\Roamin
g\Microsoft\SoftwareProtectionPlatform /s /ah
Volume in drive C is Acer
Volume Serial Number is B2F2-0EAC
File Not Found


dir C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform /s /ar

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>dir C:\Windows\ServiceProfiles\NetworkService\AppData\Roamin
g\Microsoft\SoftwareProtectionPlatform /s /ar
Volume in drive C is Acer
Volume Serial Number is B2F2-0EAC
File Not Found


dir C:\Windows\ServiceProfiles\NetworkService /ar /s

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>dir C:\Windows\ServiceProfiles\NetworkService /ar /s
Volume in drive C is Acer
Volume Serial Number is B2F2-0EAC

Directory of C:\Windows\ServiceProfiles\NetworkService

14/07/2009 01:45 AM <DIR> Desktop
14/07/2009 01:45 AM <DIR> Documents
14/07/2009 01:45 AM <DIR> Downloads
14/07/2009 01:45 AM <DIR> Favorites
14/07/2009 01:45 AM <DIR> Links
14/07/2009 01:45 AM <DIR> Music
14/07/2009 01:45 AM <DIR> Pictures
14/07/2009 01:45 AM <DIR> Videos
0 File(s) 0 bytes

Directory of C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsof
t\Windows

14/07/2009 01:45 AM <DIR> Recent
14/07/2009 01:45 AM <DIR> SendTo
14/07/2009 01:45 AM <DIR> Start Menu
0 File(s) 0 bytes

Directory of C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsof
t\Windows\Recent

14/07/2009 01:45 AM <DIR> .
14/07/2009 01:45 AM <DIR> ..
0 File(s) 0 bytes

Directory of C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsof
t\Windows\SendTo

14/07/2009 01:45 AM <DIR> .
14/07/2009 01:45 AM <DIR> ..
0 File(s) 0 bytes

Directory of C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsof
t\Windows\Start Menu

14/07/2009 01:45 AM <DIR> .
14/07/2009 01:45 AM <DIR> ..
0 File(s) 0 bytes

Directory of C:\Windows\ServiceProfiles\NetworkService\Desktop

14/07/2009 01:45 AM <DIR> .
14/07/2009 01:45 AM <DIR> ..
0 File(s) 0 bytes

Directory of C:\Windows\ServiceProfiles\NetworkService\Documents

14/07/2009 01:45 AM <DIR> .
14/07/2009 01:45 AM <DIR> ..
0 File(s) 0 bytes

Directory of C:\Windows\ServiceProfiles\NetworkService\Downloads

14/07/2009 01:45 AM <DIR> .
14/07/2009 01:45 AM <DIR> ..
0 File(s) 0 bytes

Directory of C:\Windows\ServiceProfiles\NetworkService\Favorites

14/07/2009 01:45 AM <DIR> .
14/07/2009 01:45 AM <DIR> ..
0 File(s) 0 bytes

Directory of C:\Windows\ServiceProfiles\NetworkService\Links

14/07/2009 01:45 AM <DIR> .
14/07/2009 01:45 AM <DIR> ..
0 File(s) 0 bytes

Directory of C:\Windows\ServiceProfiles\NetworkService\Music

14/07/2009 01:45 AM <DIR> .
14/07/2009 01:45 AM <DIR> ..
0 File(s) 0 bytes

Directory of C:\Windows\ServiceProfiles\NetworkService\Pictures

14/07/2009 01:45 AM <DIR> .
14/07/2009 01:45 AM <DIR> ..
0 File(s) 0 bytes

Directory of C:\Windows\ServiceProfiles\NetworkService\Videos

14/07/2009 01:45 AM <DIR> .
14/07/2009 01:45 AM <DIR> ..
0 File(s) 0 bytes

Total Files Listed:
0 File(s) 0 bytes
33 Dir(s) 592,059,506,688 bytes free


dir C:\Windows /ar /s

Total Files Listed:
1154 File(s) 3,293,799,701 bytes
282 Dir(s) 592,059,453,440 bytes free

 

[NoelDP]

I'd forgotten how big the HKU Key are!
The only odd things I can see from the other posted data are
1) that the cache file hasn't been updated - I think it's supposed to update every boot.
The last time it updated was 5/5 - does that date ring any bells?,
2) the number of files in the first response - which appears huge, but if you take into account the 470-odd files from WMP, may not be that big.
My live system has 1239 folders there, so that number isn't unusual.



please run the following command s
ICACLS C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache
ICACLS C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat

this should tell us if the problem is with permissions here.

 

[rjbarter]

ICACLS C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>ICACLS C:\Windows\ServiceProfiles\NetworkService\AppData\Roa
ming\Microsoft\SoftwareProtectionPlatform\Cache
C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProt
ectionPlatform\Cache NT AUTHORITY\SYSTEMOI)(CI)(F)

BUILTIN\AdministratorsOI)(CI)(F)

NT SERVICE\sppsvcOI)(CI)(R,W,D)

EveryoneOI)(CI)(R)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>



ICACLS C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>ICACLS C:\Windows\ServiceProfiles\NetworkService\AppData\Roa
ming\Microsoft\SoftwareProtectionPlatform\Cache
C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProt
ectionPlatform\Cache NT AUTHORITY\SYSTEMOI)(CI)(F)

BUILTIN\AdministratorsOI)(CI)(F)

NT SERVICE\sppsvcOI)(CI)(R,W,D)

EveryoneOI)(CI)(R)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>

 

[NoelDP]

That looks OK, also. - I'm beginning to run out of ideas here
Often the problem with a System Error 2 is that the NetworkService is misconfigured or missing entirely - that appears not to be what's happening here.

That being the case, then I really have no alternative than to suggest a repair install

 

[rjbarter]

1) that the cache file hasn't been updated - I think it's supposed to update every boot.
The last time it updated was 5/5 - does that date ring any bells?,

Adobe Reader 9.5.1 - CPSID_83708 installed. I recall that there was a message a few weeks ago about either Adobe reader or flash not installing. The event log looks okay.

uTorrent 3.1.3 and AVG 212 also updated on 5/5 but there are no errors in the event log.

I noticed I started to get "The Software Protection service failed to start. 0x80070002" on 5/4 which carried on into 5/5. That evening it started okay ("The Software Protection service has completed licensing status check.") and then all was okay until after Windows update ran 5/12.

 

[rjbarter]

That looks OK, also. - I'm beginning to run out of ideas here
Often the problem with a System Error 2 is that the NetworkService is misconfigured or missing entirely - that appears not to be what's happening here.

That being the case, then I really have no alternative than to suggest a repair install

I'll try uninstalling some stuff first to see if that makes a difference.

I only have the Acer Recovery Disks I had to create when I first setup by PC. If I go the repair install route, do I have to download and use the W7 SP1 ISO as shown here:
http://www.sevenforums.com/tutorials/3413-repair-install.html

Thanks

 

[NoelDP]

I'll try uninstalling some stuff first to see if that makes a difference.

I only have the Acer Recovery Disks I had to create when I first setup by PC. If I go the repair install route, do I have to download and use the W7 SP1 ISO as shown here:
http://www.sevenforums.com/tutorials/3413-repair-install.html

Thanks

Yep - I'd have pointed you at the tutorial if you hadn't already found it.
Recovery disks normally will only wipe the drive, and yours would be an RTM release anyhow.

I noticed I started to get "The Software Protection service failed to start. 0x80070002" on 5/4 which carried on into 5/5. That evening it started okay ("The Software Protection service has completed licensing status check.") and then all was okay until after Windows update ran 5/12.

It does sound as if the inability to update the cache is related - I'm just not sure how.....
Lets have a look elsewhere in the registry

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /S

You'll need to upload that - it runs to 26KB on a default install!
(this is an area I've not been into before - so it'll take a while to make any sense. Feel free to carry on with a repair install in the meantime!)

 

[rjbarter]

reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /S

attached only 10.5kb

 

[NoelDP]

There's not differences from my default install (My file is the same size as yours when I use the command line, rather than export from regedit!)

....back into hunt mode......
catch you later.