Windows 7 giving WAT not running genuine windows message

NoelDP · Jan 18, 2013

That doesn't look too bad - but it's only a /F scan, so doesn't check for bad sectors
the /R scan will check every sector on the disk, so will take longer.

jaycul2k · Jan 18, 2013

Nod, I realized after I posted. I DID run a full chkdsk /R that returned 1 file change, but it was in the repair console, and might not have been logged. Currently running another one anyway.

jaycul2k · Jan 18, 2013

Okay, here you go, log from chkdsk /r

Code:

Log Name:      Application
Source:        Microsoft-Windows-Wininit
Date:          1/18/2013 4:59:08 PM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Jason-PC
Description:


Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.

A disk check has been scheduled.
Windows will now check the disk.                         

CHKDSK is verifying files (stage 1 of 5)...
  293120 file records processed.                                         

File verification completed.
  1022 large file records processed.                                   

  0 bad file records processed.                                     

  2 EA records processed.                                           

  60 reparse records processed.                                      

CHKDSK is verifying indexes (stage 2 of 5)...
  359524 index entries processed.                                        

Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered.                                      

CHKDSK is verifying security descriptors (stage 3 of 5)...
  293120 file SDs/SIDs processed.                                        

Cleaning up 150 unused index entries from index $SII of file 0x9.
Cleaning up 150 unused index entries from index $SDH of file 0x9.
Cleaning up 150 unused security descriptors.
Security descriptor verification completed.
  33203 data files processed.                                           

CHKDSK is verifying Usn Journal...
  37075616 USN bytes processed.                                            

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
  293104 files processed.                                                

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
  115041785 free clusters processed.                                        

Free space verification is complete.
Windows has checked the file system and found no problems.

 717173397 KB total disk space.
 256481544 KB in 172978 files.
    104744 KB in 33204 indexes.
         0 KB in bad sectors.
    419969 KB in use by the system.
     65536 KB occupied by the log file.
 460167140 KB available on disk.

      4096 bytes in each allocation unit.
 179293349 total allocation units on disk.
 115041785 allocation units available on disk.

Internal Info:
00 79 04 00 71 25 03 00 9e aa 05 00 00 00 00 00  .y..q%..........
7c 02 00 00 3c 00 00 00 00 00 00 00 00 00 00 00  |...<...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-01-18T21:59:08.000000000Z" />
    <EventRecordID>8893</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>Jason-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>

Checking file system on C:
The type of the file system is NTFS.
Volume label is OS.

A disk check has been scheduled.
Windows will now check the disk.                         

CHKDSK is verifying files (stage 1 of 5)...
  293120 file records processed.                                         

File verification completed.
  1022 large file records processed.                                   

  0 bad file records processed.                                     

  2 EA records processed.                                           

  60 reparse records processed.                                      

CHKDSK is verifying indexes (stage 2 of 5)...
  359524 index entries processed.                                        

Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered.                                      

CHKDSK is verifying security descriptors (stage 3 of 5)...
  293120 file SDs/SIDs processed.                                        

Cleaning up 150 unused index entries from index $SII of file 0x9.
Cleaning up 150 unused index entries from index $SDH of file 0x9.
Cleaning up 150 unused security descriptors.
Security descriptor verification completed.
  33203 data files processed.                                           

CHKDSK is verifying Usn Journal...
  37075616 USN bytes processed.                                            

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
  293104 files processed.                                                

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
  115041785 free clusters processed.                                        

Free space verification is complete.
Windows has checked the file system and found no problems.

 717173397 KB total disk space.
 256481544 KB in 172978 files.
    104744 KB in 33204 indexes.
         0 KB in bad sectors.
    419969 KB in use by the system.
     65536 KB occupied by the log file.
 460167140 KB available on disk.

      4096 bytes in each allocation unit.
 179293349 total allocation units on disk.
 115041785 allocation units available on disk.

Internal Info:
00 79 04 00 71 25 03 00 9e aa 05 00 00 00 00 00  .y..q%..........
7c 02 00 00 3c 00 00 00 00 00 00 00 00 00 00 00  |...<...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
  </EventData>
</Event>

NoelDP · Jan 18, 2013

Not as bad as I feared - there are no signs of any bad sectors present, so the disk appears to be in reasonable shape, physically.
I have to be honest at this point and admit that I have no idea where to look for a solution - most of those files aren't mentioned by name in the registry, and my skills aren't up to the task of tracing them without that to help.

Having said that, many times, the error codes we see there are the result of the backup files missing, and there is one error that is a little more specific than the rest, so it may give us a clue....

please run the following commands in an Elevated Command Prompt window and post the results.

REG QUERY HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5AA} /S
REG QUERY HKLM\SOFTWARE\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5AA} /S
REG QUERY HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5AA} /S

jaycul2k · Jan 18, 2013

Here you go

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\windows\system32>REG QUERY HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{EE57495
7-4077-4AD6-8658-327C2C86C5AA} /S

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{EE574957-4077-4AD6-8658
-327C2C86C5AA}\1.0
    (Default)    REG_SZ    SPPUI 1.0 Type Library

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{EE574957-4077-4AD6-8658
-327C2C86C5AA}\1.0\0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{EE574957-4077-4AD6-8658
-327C2C86C5AA}\1.0\0\win32
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\slui.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{EE574957-4077-4AD6-8658
-327C2C86C5AA}\1.0\FLAGS
    (Default)    REG_SZ    0


C:\windows\system32>REG QUERY HKLM\SOFTWARE\Classes\TypeLib\{EE574957-4077-4AD6-
8658-327C2C86C5AA} /S

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5A
A}\1.0
    (Default)    REG_SZ    SPPUI 1.0 Type Library

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5A
A}\1.0\0

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5A
A}\1.0\0\win32
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\slui.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EE574957-4077-4AD6-8658-327C2C86C5A
A}\1.0\FLAGS
    (Default)    REG_SZ    0


C:\windows\system32>REG QUERY HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{EE57495
7-4077-4AD6-8658-327C2C86C5AA} /S

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{EE574957-4077-4AD6-8658
-327C2C86C5AA}\1.0
    (Default)    REG_SZ    SPPUI 1.0 Type Library

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{EE574957-4077-4AD6-8658
-327C2C86C5AA}\1.0\0

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{EE574957-4077-4AD6-8658
-327C2C86C5AA}\1.0\0\win32
    (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\slui.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{EE574957-4077-4AD6-8658
-327C2C86C5AA}\1.0\FLAGS
    (Default)    REG_SZ    0


C:\windows\system32>

NoelDP · Jan 18, 2013

That all looks normal to me
Let's check the permissions on the related files

Please run the following command, and post the results.

ICACLS C:\Windows\slui.* /T

jaycul2k · Jan 18, 2013

Might have something here...

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\windows\system32>ICACLS C:\Windows\slui.* /T
C:\Windows\CSC\slui.*: Access is denied.
Successfully processed 0 files; Failed processing 1 files

C:\windows\system32>

NoelDP · Jan 18, 2013

Interesting -
Please run the following commands, and post the results...

DIR C:\Windows\CSC
ICACLS C:\Windows\CSC

My copy of Windows has no such folder - but it's the storage folder for Offline Files, but I have no idea what the proper permissions for it should be (I'll have to have a play tomorrow)

jaycul2k · Jan 18, 2013

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\windows\system32>DIR C:\Windows\CSC
 Volume in drive C is OS
 Volume Serial Number is F6D4-E1A8

 Directory of C:\Windows\CSC

File Not Found

C:\windows\system32>ICACLS C:\Windows\CSC
C:\Windows\CSC: Access is denied.
Successfully processed 0 files; Failed processing 1 files

C:\windows\system32>

jaycul2k · Jan 18, 2013

And for s&g. here are the results after I forced windows to give me ownership...

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\windows\system32>dir c:\windows\csc
 Volume in drive C is OS
 Volume Serial Number is F6D4-E1A8

 Directory of c:\windows\csc

07/17/2012  12:14 AM    <DIR>          .
07/17/2012  12:14 AM    <DIR>          ..
07/17/2012  12:14 AM    <DIR>          v2.0.6
               0 File(s)              0 bytes
               3 Dir(s)  469,064,450,048 bytes free

C:\windows\system32>dir c:\windows\csc\v2.0.6
 Volume in drive C is OS
 Volume Serial Number is F6D4-E1A8

 Directory of c:\windows\csc\v2.0.6

07/17/2012  12:14 AM    <DIR>          .
07/17/2012  12:14 AM    <DIR>          ..
07/17/2012  12:14 AM    <DIR>          namespace
07/17/2012  12:14 AM                64 pq
07/17/2012  12:14 AM                 4 sm
07/17/2012  12:14 AM    <DIR>          temp
               2 File(s)             68 bytes
               4 Dir(s)  469,064,450,048 bytes free

C:\windows\system32>dir c:\windows\csc\v2.0.6\namespace
 Volume in drive C is OS
 Volume Serial Number is F6D4-E1A8

 Directory of c:\windows\csc\v2.0.6\namespace

07/17/2012  12:14 AM    <DIR>          .
07/17/2012  12:14 AM    <DIR>          ..
               0 File(s)              0 bytes
               2 Dir(s)  469,064,450,048 bytes free

C:\windows\system32>dir c:\windows\csc\v2.0.6\temp
 Volume in drive C is OS
 Volume Serial Number is F6D4-E1A8

 Directory of c:\windows\csc\v2.0.6\temp

07/17/2012  12:14 AM    <DIR>          .
07/17/2012  12:14 AM    <DIR>          ..
07/17/2012  12:14 AM                 0 ea-{1c04a2f6-cfce-11e1-8d37-f04da26a2abb}

               1 File(s)              0 bytes
               2 Dir(s)  469,064,450,048 bytes free

C:\windows\system32>

jaycul2k · Jan 18, 2013

And...

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\windows\system32>icalcs c:\windows\csc
'icalcs' is not recognized as an internal or external command,
operable program or batch file.

C:\windows\system32>icacls c:\windows\csc
c:\windows\csc BUILTIN\Administrators:(OI)(CI)(F)
               Jason-PC\Jason:(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>icacls c:\windows\csc\v2.0.6
c:\windows\csc\v2.0.6 BUILTIN\Administrators:(I)(OI)(CI)(F)
                      Jason-PC\Jason:(I)(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>icacls c:\windows\csc\v2.0.6\namespace
c:\windows\csc\v2.0.6\namespace BUILTIN\Administrators:(I)(OI)(CI)(F)
                                Jason-PC\Jason:(I)(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>icacls c:\windows\csc\v2.0.6\temp
c:\windows\csc\v2.0.6\temp BUILTIN\Administrators:(I)(OI)(CI)(F)
                           Jason-PC\Jason:(I)(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>

NoelDP · Jan 18, 2013

OK - that's obviously a problem (I managed to find a VM where Offline folders were enabled eventually)

The permissions on the CSC folder need to be adjusted....

but first, please check the permissions on the Windows folder
ICACLS C:\Windows

please also check the Owner of the Windows folder - it should be "NT SERVICE\TrustedInstaller"

jaycul2k · Jan 18, 2013

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\windows\system32>icacls c:\windows
c:\windows NT SERVICE\TrustedInstaller:(F)
           NT SERVICE\TrustedInstaller:(CI)(IO)(F)
           NT AUTHORITY\SYSTEM:(M)
           NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F)
           BUILTIN\Administrators:(M)
           BUILTIN\Administrators:(OI)(CI)(IO)(F)
           BUILTIN\Users:(RX)
           BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
           CREATOR OWNER:(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>

NoelDP · Jan 18, 2013

Good - at least that looks OK.

Open an Elevated Command Prompt, and run the following commands

TAKEOWN /F C:\Windows\CSC /A
ICACLS C:\Windows\CSC /reset
ICACLS C:\Windows\CSC
ICACLS C:\Windows\CSC\v2.0.6 /grant "NT AUTHORITY\SYSTEM"

F)

then run another MGADiag report

jaycul2k · Jan 18, 2013

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\windows\system32>takeown /F C:\Windows\CSC /A

SUCCESS: The file (or folder): "C:\Windows\CSC" now owned by the administrators
group.

C:\windows\system32>icacls c:\windows\csc /reset
processed file: c:\windows\csc
Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>icacls c:\windows\csc
c:\windows\csc NT SERVICE\TrustedInstaller:(I)(F)
               NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
               NT AUTHORITY\SYSTEM:(I)(F)
               NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
               BUILTIN\Administrators:(I)(F)
               BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
               BUILTIN\Users:(I)(RX)
               BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
               CREATOR OWNER:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>icacls c:\windows\csc\v2.0.6 /grant "NT AUTHORITY\SYSTEM":(F
)
processed file: c:\windows\csc\v2.0.6
Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-X92GV-V7DCV-P4K27
Windows Product Key Hash: aU2z1/fnhnLHmhBm699qYZT2E6s=
Windows Product ID: 00426-OEM-8992662-00400
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {DDC101A9-B226-4689-A1D7-515C8BCDB556}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120830-0333
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE; Win32)
Default Browser: C:\Users\Jason\AppData\Local\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\windows\system32\sppobjs.dll[6.1.7601.17514], Hr = 0x80092003
File Mismatch: C:\windows\system32\sppc.dll[6.1.7601.17514], Hr = 0x800b0100
File Mismatch: C:\windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003
File Mismatch: C:\windows\system32\slui.exe[6.1.7601.17514], Hr = 0x80092003
File Mismatch: C:\windows\system32\sppcomapi.dll[6.1.7601.17514], Hr = 0x800b0100
File Mismatch: C:\windows\system32\sppsvc.exe[6.1.7601.17514], Hr = 0x80092003
File Mismatch: C:\windows\system32\systemcpl.dll[6.1.7601.17514], Hr = 0x800b0100
File Mismatch: C:\windows\system32\user32.dll[6.1.7601.17514], Hr = 0x800b0100

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{DDC101A9-B226-4689-A1D7-515C8BCDB556}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-P4K27</PKey><PID>00426-OEM-8992662-00400</PID><PIDType>2</PIDType><SID>S-1-5-21-2048840114-538357040-3838390185</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>XPS L701X   </Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A07</Version><SMBIOSVersion major="2" minor="6"/><Date>20101224000000.000000+000</Date></BIOS><HWID>C36D3E07018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>QA09   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00178-926-600400-02-1033-7600.0000-0352011
Installation ID: 012602492244325031717991980271866560623823727730241592
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: P4K27
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 1/18/2013 10:01:43 PM

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x000000000000A8B0
Event Time Stamp: 1:17:2013 21:04
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppobjs.dll
Tampered File: %systemroot%\system32\sppc.dll|sppc.dll.mui
Tampered File: %systemroot%\system32\sppwinob.dll
Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration
Tampered File: %systemroot%\system32\sppcomapi.dll|sppcomapi.dll.mui
Tampered File: %systemroot%\system32\sppsvc.exe|sppsvc.exe.mui


HWID Data-->
HWID Hash Current: MAAAAAEAAQABAAEAAAACAAAAAwABAAEAHKIESaCzKn5OCpRhzp9a67CHPoQKcHZW

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name	OEMID Value	OEMTableID Value
  APIC			PTLTD 			 APIC  
  FACP			INTEL 		CALPELLA
  HPET			INTEL 		CALPELLA
  BOOT			PTLTD 		$SBFTBL$
  MCFG			INTEL 		CALPELLA
  SLIC			DELL  		QA09   
  OSFR			DELL  		DELL    
  ASF!			  CETP		    CETP
  SSDT			PmRef		CpuPm

NoelDP · Jan 18, 2013

...so that obviously wasn't the trigger

Back to the pinboard

Please run the following command, and post the results.

ICACLS C:\Windows\slui.* /T

jaycul2k · Jan 18, 2013

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\windows\system32>icacls c:\windows\slui.* /T
c:\windows\System32\slui.exe NT SERVICE\TrustedInstaller:(F)
                             BUILTIN\Administrators:(RX)
                             NT AUTHORITY\SYSTEM:(RX)
                             BUILTIN\Users:(RX)

c:\windows\System32\en-US\slui.exe.mui NT SERVICE\TrustedInstaller:(F)
                                       BUILTIN\Administrators:(RX)
                                       NT AUTHORITY\SYSTEM:(RX)
                                       BUILTIN\Users:(RX)

c:\windows\System32\LogFiles\WMI\RtBackup\slui.*: Access is denied.
Successfully processed 2 files; Failed processing 1 files

C:\windows\system32>

NoelDP · Jan 19, 2013

Ah - the more traditional RtBackup wall now

This frequently appears - I don't know why - but doesn't seem to normally affect the rest of the system
Please work around this one, by running the following commands.

ICACLS C:\Windows\winsxs\slui.* /T
ICACLS C:\Windows\System32\Logfiles\WMI
ICACLS C:\Windows\System32\Logfiles\WMI\RtBackup

(the second one may give another error - if so, please have a look to see who is the Owner, then run the command again, but do NOT change the owner or permissions!)

jaycul2k · Jan 19, 2013

Code:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\windows\system32>icacls c:\windows\winsxs\slui.* /T
c:\windows\winsxs\amd64_microsoft-windows-s..ty-spp-ux.resources_31bf3856ad364e3
5_6.1.7600.16385_en-us_54dae2e5153375ce\slui.exe.mui NT SERVICE\TrustedInstaller
:(F)

                                                     BUILTIN\Administrators:(RX)


                                                     NT AUTHORITY\SYSTEM:(RX)

                                                     BUILTIN\Users:(RX)

c:\windows\winsxs\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.7
600.16385_none_b7b69062b883381f\slui.exe NT SERVICE\TrustedInstaller:(F)

                                         BUILTIN\Administrators:(RX)

                                         NT AUTHORITY\SYSTEM:(RX)

                                         BUILTIN\Users:(RX)

c:\windows\winsxs\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_6.1.7
601.17514_none_b9e7a42ab571bbb9\slui.exe NT SERVICE\TrustedInstaller:(F)

                                         BUILTIN\Administrators:(RX)

                                         NT AUTHORITY\SYSTEM:(RX)

                                         BUILTIN\Users:(RX)

Successfully processed 3 files; Failed processing 0 files

C:\windows\system32>icacls c:\windows\System32\Logfiles\WMI
c:\windows\System32\Logfiles\WMI NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                                 NT AUTHORITY\LOCAL SERVICE:(OI)(CI)(F)
                                 NT AUTHORITY\NETWORK SERVICE:(OI)(CI)(F)
                                 BUILTIN\Administrators:(OI)(CI)(F)
                                 BUILTIN\Performance Log Users:(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>icacls c:\windows\System32\Logfiles\WMI\RtBackup
c:\windows\System32\Logfiles\WMI\RtBackup NT AUTHORITY\SYSTEM:(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

C:\windows\system32>

NoelDP · Jan 19, 2013

All of that looks normal
Reviewing the thread, I notice that I didn't get to see the CheckSUR report - please post the C:\Windows\logs\CBS\Checksur.log file

Windows 7 giving WAT not running genuine windows message

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Three-Toed Sloth

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer