Suddenly Windows 7 is not genuine

[NoelDP]

It's a manufacturer's install, Jacee - OEM_SLP Key

 

[NoelDP]

Hi Jacee,
I got my copy of windows with my sony laptop when I bought it, 8 month ago.

Hi Tom982,

Shall I run your command

"REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag" /s > %USERPROFILE%\Desktop\tom982.txt"

or is it not recommended?

Thank you for your help guys.

Valerie

Leave it for the moment - someone found a potential sinner

Please run the following command and post the output - note that this is ALL ONE LINE! (so copy/paste is kinda essential!)

REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\EventClasses\{FAF53CC4-BD73-4E36-83F1-2B23F46E513E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}

...or

[B]REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805fc79216}\EventClasses\{FAF53CC4-BD73-4E36-83F1-2B23F46E513E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}[/B]

 

[elimak]

All right!

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>REG QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\
{26c409cc-ae86-11d1-b616-00805fc79216}\EventClasses\{FAF53CC4-BD73-4E36-83F1-2B2
3F46E513E}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-00000
0000000}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EventSystem\{26c409cc-ae86-11d1-b616-00805
fc79216}\EventClasses\{FAF53CC4-BD73-4E36-83F1-2B23F46E513E}-{00000000-0000-0000
-0000-000000000000}-{00000000-0000-0000-0000-000000000000}
Active REG_DWORD 0x1
EventClassID REG_SZ {FAF53CC4-BD73-4E36-83F1-2B23F46E513E}
EventClassName REG_SZ VssEvent
OwnerSID REG_SZ S-1-5-18
TypeLib REG_EXPAND_SZ %systemroot%\system32\EVENTCLS.DLL
AllowInprocActivation REG_DWORD 0xffffffff
FireInParallel REG_DWORD 0x0
EventClassPartitionID REG_SZ {00000000-0000-0000-0000-000000000000}
EventClassApplicationID REG_SZ {00000000-0000-0000-0000-000000000000}


C:\Windows\system32>

 

[NoelDP]

No joy - that's the correct settings.

Please run the following commands and post the results

Net Start EventSystem
SC QC EventSystem
SC QUERYEX EventSystem

 

[elimak]

There it is:

C:\Windows\system32>Net Start EventSystem
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.


C:\Windows\system32>SC QC EventSystem
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: EventSystem
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k LocalService
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : COM+ Event System
DEPENDENCIES : rpcss
SERVICE_START_NAME : NT AUTHORITY\LocalService

C:\Windows\system32>SC QUERYEX EventSystem

SERVICE_NAME: EventSystem
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 1168
FLAGS :

C:\Windows\system32>

 

[NoelDP]

That's normal as well -
Please run Tom's command now, and attach the file to your reply.

 

[elimak]

Ok, I attached the txt file

 

[NoelDP]

VERY interesting - looks like Tom was right!

Please run the following command, and attach the file in the same way.....

[B]REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\VSS\Diag" /s > %USERPROFILE%\Desktop\ndp01.txt[/B]

The we can see if there's a handy backup of the missing data

 

[elimak]

ok, here it is

 

[NoelDP]

Please also open Regedit and CAREFULLY navigate to the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag Key
right-click on it and select Permissions
What permissions exist, and for who??

 

[elimak]

I right-clicked Diag and I see that:
Administrator and System has Full control and read

Is it the right folder to check? I don't have "Diag Key"

 

[NoelDP]

That's the one

I think we may have found the cause
Now I'll have to work out what we can do about it - there are a LOT of permissions missing!
Please go back there, and click on the Advanced button - expand the listing so you can see all of it, and then take a snapshot and attach it to your reply.
Also click on the Owner tab - who is the current owner?

 

[elimak]

Ok, this is the permission screenshot

and the Owner is SYSTEM

 

[NoelDP]

Ah - so it's not the permissions that are the problem! - that's all normal so far as I can tell.

Perhaps if we look at one of the affected subkeys?

Navigate to
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\VSS\Diag\ASR Writer

look at the detailed permissions and post another snapshot

Have you ever had any third-party backup software installed? (perhaps Norton?)

 

[elimak]

There is no ASR Writer in the Diag folder.
I uninstalled some extra features added by Sony. I think this is probably what messed up the registry.

 

[NoelDP]

Ah - I coulda sworn i saw it in the output list?

Sony shouldn't be so graceless as to totally screw the machine just because you didn't like their bloatware

We can always add missing subkeys - but I'm unsure what values and data should be in them, as the two systems I've looked at had differing ones.

I'll do some research and see if we can come up with the 'proper' way to do things.

In the meantime, though - try downloading this little program http://updates.macrium.com/reflect/utilities/vssfixx64.exe and running it (as Administrator).

then reboot, and run VSSAdmin List Writers again - post the results

 

[elimak]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>VSSAdmin List Writers
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2005 Microsoft Corp.


C:\Windows\system32>

 

[NoelDP]

Oh well, it was worth a try
....back to the drawing board - I have to go out now, so probably won't get back to you until tomorrow - shout if you haven't heard from me by this time tomorrow!

 

[elimak]

Ok, thanks again for your help
Have a good day!

 

[tom982]

Hi elimak,

I don't have the ASR Writer key either, so it might be a third party thing that Noel has Could you try repeating Noel's instructions, but for this key:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\WMI Writer

This is a Windows one

Tom