Solved Windows 7 suddenly 'not genuine'

timh

New member
Local time
3:54 AM
Messages
14
I have an older workstation, bought with Vista, and upgraded to Win7 Ultimate. Upgrade was bought via the MS store several years ago (I occasionally get coupons from work to buy stuff). I don't use this box all that much but the other day I went to patch it and it told me that my copy wasn't genuine. The error I get after having it try to is that some files are damaged or missing. Not really interested in rebuilding this box from scratch though I guess that's an option. Below is the output from MGADiag. I'm guessing that my issue is this "Tampered File: %systemroot%\system32\drivers\spsys.sys". I ran SFC which did not find any integrity violations. Am I down to copying this file over from elsewhere? Is this file unique per system or to a version of Windows 7? I have access to other systems but not to win7 32bit. My upgrade media is buried somewhere so may not be easily found.

Thanks!
Tim

Code:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-R67QQ-FVRHP-RTWPQ
Windows Product Key Hash: 5VG8JXYk5mJ3Apowk8gf75ZWYZU=
Windows Product ID: 00426-292-6704362-85743
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {999B0C14-B4FC-4070-A315-7AC80282BDE2}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.140303-2144
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: 2.0.48.0
OGAExec.exe Signed By: Microsoft
OGAAddin.dll Signed By: Microsoft
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Standard 2007 - 100 Genuine
OGA Version: Registered, 2.0.48.0
Signed By: Microsoft
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-b01a_E2AD56EA-766-0_E2AD56EA-148-80004005_16E0B333-89-80004005_B4D0AA8B-1029-80004005
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{999B0C14-B4FC-4070-A315-7AC80282BDE2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-RTWPQ</PKey><PID>00426-292-6704362-85743</PID><PIDType>5</PIDType><SID>S-1-5-21-367005675-1604576647-2706173860</SID><SYSTEM><Manufacturer>Dell Inc</Manufacturer><Model>Dimension E521</Model></SYSTEM><BIOS><Manufacturer>Dell Inc</Manufacturer><Version>1.1.4 </Version><SMBIOSVersion major="2" minor="4"/><Date>20061209000000.000000+000</Date></BIOS><HWID>7FA03907018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>bMk    </OEMTableID></OEM><GANotification><File Name="OGAAddin.dll" Version="2.0.48.0"/></GANotification></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0012-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Standard 2007</Name><Ver>12</Ver><Val>901B47A3201FF0C</Val><Hash>HvOn6d5l4EDglSP4cDMPwGHHlMA=</Hash><Pid>81607-902-8968713-64126</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00170-292-670436-00-1033-7600.0000-3392009
Installation ID: 015445376991638962682430117474827122295592476543846370
Processor Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88338[/URL]
Machine Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88339[/URL]
Use License URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88341[/URL]
Product Key Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88340[/URL]
Partial Product Key: RTWPQ
License Status: Licensed
Remaining Windows rearm count: 5
Trusted time: 10/5/2014 12:03:27 PM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000010000
Event Time Stamp: 10:5:2014 11:58
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\drivers\spsys.sys

HWID Data-->
HWID Hash Current: LAAAAAEAAAABAAEAAgABAAAAAQABAAEAeqi2nDqlqkdYdFbKXN4m2qiMjrY=
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x0
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name OEMID Value OEMTableID Value
  APIC   DELL    bMk    
  FACP   DELL    bMk    
  HPET   DELL    bMk    
  BOOT   DELL    bMk    
  MCFG   DELL    bMk    
  SLIC   DELL    bMk
 

My Computer My Computer

At a glance

Windows 7 Ultimate x32
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dell
OS
Windows 7 Ultimate x32
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\drivers\spsys.sys


Please follow the Windows Update Posting Instructions and post the requested data
If the file is too large (8MB compressed), remove the older CBSPersist cab files until the final file is below the limit - you can always post them separately after zipping them. (the forum doesn't allow the upload of bare CAB files, for a number of reasons)
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Hi Noel, Thansk, for the reply. I thought I followed the instructions for Windows Genuine and Activation Issues. What part am I missing? I see in the Windows Update instructions, logs are requested which is different from the instructions I read for my issue. I'm happy to post whatever will help, just want to make sure we're all on the same page is all.
 

My Computer My Computer

At a glance

Windows 7 Ultimate x32
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dell
OS
Windows 7 Ultimate x32
It's just that the WU instructions should give me the details I need to see exactly what's going wrong. Mgadiag thells me some stuff but the rest of the data may point to a quick fix.
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
ok, sure thing. I'll grab that log info when I get home tonight, looks like that will be the middle of the night for you. Is it dangerous for me to swap out the spsys.sys file from another Win7 computer?
 

My Computer My Computer

At a glance

Windows 7 Ultimate x32
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dell
OS
Windows 7 Ultimate x32
Possibly - it msy not be the file itself but registry values that are the problem. Please don't try fixing it yourself just yet.
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Okay, here's the zipped CBS log directory. I'm running the SURT tool as well. I'll post if the results when I have it.
 

My Computer My Computer

At a glance

Windows 7 Ultimate x32
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dell
OS
Windows 7 Ultimate x32
The SURT install stated that it completed successfully.
 

My Computer My Computer

At a glance

Windows 7 Ultimate x32
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dell
OS
Windows 7 Ultimate x32
I don't see the CheckSUR.log file? please post that, as it looks as if there's damage that it may have recorded and/or fixed.
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Here's the log. Doesn't look like there's much there.
 

My Computer My Computer

At a glance

Windows 7 Ultimate x32
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dell
OS
Windows 7 Ultimate x32
You're right - no clues there! :(
Back to the CBS files...

The error I spotted there was this one...
Code:
2014-10-06 03:04:00, Info                  CBS    Failed to persist package: Package_1_for_KB2937610~31bf3856ad364e35~x86~~6.1.1.3. [HRESULT = 0x8e5e03fe - JET_errDiskIO]
2014-10-06 03:04:00, Info                  CBS    Failed to update states and store all resolved packages. [HRESULT = 0x8e5e03fe - JET_errDiskIO]
2014-10-06 03:04:00, Info                  CSI    0000000c@2014/10/6:10:04:00.468 CSI Transaction @0xc3f6010 destroyed
2014-10-06 03:04:00, Info                  CBS    Perf: Resolve chain complete.
2014-10-06 03:04:00, Info                  CBS    Failed to resolve execution chain. [HRESULT = 0x8e5e03fe - JET_errDiskIO]
2014-10-06 03:04:00, Error                 CBS    Failed to process single phase execution. [HRESULT = 0x8e5e03fe - JET_errDiskIO]


I think this means that the update database is corrupted - if that's the case then this should help:

Open and Elevated Command Prompt and run the following commands


NET STOP CRYPTSVC
esentutl /p %systemroot%\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
NET START CRYPTSVC


WAIT 10 minutes after the command prompt has returned, then reboot - post a new MGADiag report, and the results of the following commands...


SC QC SPLDR
SC QC SPPSVC
SC QC SPSYS
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
The esentutl repair completed. Waiting 10 minutes then rebooted.

Results of the three commands are:

C:\Windows\system32>SC QC SPLDR
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: SPLDR
TYPE : 1 KERNEL_DRIVER
START_TYPE : 0 BOOT_START
ERROR_CONTROL : 3 CRITICAL
BINARY_PATH_NAME :
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Security Processor Loader Driver
DEPENDENCIES :
SERVICE_START_NAME :

C:\Windows\system32>SC QC SPPSVC
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: SPPSVC
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START (DELAYED)
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\sppsvc.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Software Protection
DEPENDENCIES : RpcSs
SERVICE_START_NAME : NT AUTHORITY\NetworkService

C:\Windows\system32>SC QC SPSYS
[SC] OpenService FAILED 1060:
The specified service does not exist as an installed service.

C:\Windows\system32>

New MGADiag report below.

Code:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-R67QQ-FVRHP-RTWPQ
Windows Product Key Hash: 5VG8JXYk5mJ3Apowk8gf75ZWYZU=
Windows Product ID: 00426-292-6704362-85743
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {999B0C14-B4FC-4070-A315-7AC80282BDE2}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.140303-2144
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: 2.0.48.0
OGAExec.exe Signed By: Microsoft
OGAAddin.dll Signed By: Microsoft
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Standard 2007 - 100 Genuine
OGA Version: Registered, 2.0.48.0
Signed By: Microsoft
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-b01a_E2AD56EA-766-0_E2AD56EA-148-80004005_16E0B333-89-80004005_B4D0AA8B-1029-80004005
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{999B0C14-B4FC-4070-A315-7AC80282BDE2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-RTWPQ</PKey><PID>00426-292-6704362-85743</PID><PIDType>5</PIDType><SID>S-1-5-21-367005675-1604576647-2706173860</SID><SYSTEM><Manufacturer>Dell Inc</Manufacturer><Model>Dimension E521</Model></SYSTEM><BIOS><Manufacturer>Dell Inc</Manufacturer><Version>1.1.4 </Version><SMBIOSVersion major="2" minor="4"/><Date>20061209000000.000000+000</Date></BIOS><HWID>7F2C3007018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>bMk    </OEMTableID></OEM><GANotification><File Name="OGAAddin.dll" Version="2.0.48.0"/></GANotification></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0012-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Standard 2007</Name><Ver>12</Ver><Val>901B47A3201FF0C</Val><Hash>HvOn6d5l4EDglSP4cDMPwGHHlMA=</Hash><Pid>81607-902-8968713-64126</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00170-292-670436-00-1033-7600.0000-3392009
Installation ID: 015445376991638962682430117474827122295592476543846370
Processor Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88338[/URL]
Machine Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88339[/URL]
Use License URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88341[/URL]
Product Key Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88340[/URL]
Partial Product Key: RTWPQ
License Status: Licensed
Remaining Windows rearm count: 5
Trusted time: 10/8/2014 9:19:32 PM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000010040
Event Time Stamp: 10:5:2014 11:58
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
Tampered File: %systemroot%\system32\drivers\spsys.sys

HWID Data-->
HWID Hash Current: LAAAAAEAAAABAAEAAgABAAAAAQABAAEAeqi2nDqlqkdYdFbKXN4m2qiMjrY=
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x0
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name OEMID Value OEMTableID Value
  APIC   DELL    bMk    
  FACP   DELL    bMk    
  HPET   DELL    bMk    
  BOOT   DELL    bMk    
  MCFG   DELL    bMk    
  SLIC   DELL    bMk
 

My Computer My Computer

At a glance

Windows 7 Ultimate x32
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dell
OS
Windows 7 Ultimate x32
That gives us a little more data to work with...
Code:
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
Tampered File: %systemroot%\system32\drivers\spsys.sys
The output from the commands is normal.


Open Event Viewer
click on the Windows logs entry in the left pane to expand it.
Now click on the Application entry - wait while it loads.
Click on 'File' in the menu bar and select Save...
Save the file as Appevt.evtx
Repeat for the System log
then zip both, and upload them.
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Hi Noel,
Thanks for your continued help with this. Glanced through the logs, attached, and there's some events in the app log regarding activation health check failures. Saw some NTFS corruption errors in the system log back a few days as well. I suppose that could be the root cause of this.

Thanks,
Tim
 

My Computer My Computer

At a glance

Windows 7 Ultimate x32
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dell
OS
Windows 7 Ultimate x32
The NTFS problem seems to have started on 2nd October.

It seems to relate to ShadowCopy, though - and I'm not sure how. Perhaps best to do a full CHKDSK and see if it finds anything significant.


Please run a full CHKDSK and SFC scan....
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.
At the Command prompt, type
CHKDSK C: /R
and hit the Enter key.
You will be told that the drive is locked, and the CHKDSK will run at the next boot - hit the Y key, and then reboot.
The CHKDSK will take a few hours depending on the size of the drive, so be patient!
After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot)

Run a new MGADiag report and post the result
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Didn't see anything in the chkdsk in the first four phases. I didn't watch it through the free space check as that took hours to complete. SFC ran without errors. MGADiag results below.

Code:
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-R67QQ-FVRHP-RTWPQ
Windows Product Key Hash: 5VG8JXYk5mJ3Apowk8gf75ZWYZU=
Windows Product ID: 00426-292-6704362-85743
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {999B0C14-B4FC-4070-A315-7AC80282BDE2}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.140303-2144
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: 2.0.48.0
OGAExec.exe Signed By: Microsoft
OGAAddin.dll Signed By: Microsoft
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Standard 2007 - 100 Genuine
OGA Version: Registered, 2.0.48.0
Signed By: Microsoft
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-b01a_E2AD56EA-766-0_E2AD56EA-148-80004005_16E0B333-89-80004005_B4D0AA8B-1029-80004005
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{999B0C14-B4FC-4070-A315-7AC80282BDE2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-RTWPQ</PKey><PID>00426-292-6704362-85743</PID><PIDType>5</PIDType><SID>S-1-5-21-367005675-1604576647-2706173860</SID><SYSTEM><Manufacturer>Dell Inc</Manufacturer><Model>Dimension E521</Model></SYSTEM><BIOS><Manufacturer>Dell Inc</Manufacturer><Version>1.1.4 </Version><SMBIOSVersion major="2" minor="4"/><Date>20061209000000.000000+000</Date></BIOS><HWID>7FB03307018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>bMk    </OEMTableID></OEM><GANotification><File Name="OGAAddin.dll" Version="2.0.48.0"/></GANotification></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0012-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Standard 2007</Name><Ver>12</Ver><Val>901B47A3201FF0C</Val><Hash>HvOn6d5l4EDglSP4cDMPwGHHlMA=</Hash><Pid>81607-902-8968713-64126</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00170-292-670436-00-1033-7600.0000-3392009
Installation ID: 015445376991638962682430117474827122295592476543846370
Processor Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88338[/URL]
Machine Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88339[/URL]
Use License URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88341[/URL]
Product Key Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88340[/URL]
Partial Product Key: RTWPQ
License Status: Licensed
Remaining Windows rearm count: 5
Trusted time: 10/10/2014 7:36:25 AM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000010040
Event Time Stamp: 10:9:2014 03:46
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
Tampered File: %systemroot%\system32\drivers\spsys.sys

HWID Data-->
HWID Hash Current: LAAAAAEAAAABAAEAAgABAAAAAQABAAEAeqi2nDqlqkdYdFbKXN4m2qiMjrY=
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x0
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name OEMID Value OEMTableID Value
  APIC   DELL    bMk    
  FACP   DELL    bMk    
  HPET   DELL    bMk    
  BOOT   DELL    bMk    
  MCFG   DELL    bMk    
  SLIC   DELL    bMk
 

My Computer My Computer

At a glance

Windows 7 Ultimate x32
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dell
OS
Windows 7 Ultimate x32
I'm having problems trying to work out why MGADiag is seeing these files as being tampered, when SFC says they aren't - it could be that it's actually the registry entries relating to them are broken....
Let's have a look...

Open an Elevated Command Prompt, and run the following commands...
Code:
REG LOAD HKLM\COMPONENTS C:\Windows\System32\config\COMPONENTS
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft-windows-security-spp-clientext_31bf3856ad364e35_none_fec4df291f9d1095" >> "%userprofile%\desktop\sppcext.txt"
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft-windows-s..clientext.resources_31bf3856ad364e35_en-us_1b9f68ef6e329c88" >> "%userprofile%\desktop\sppcext.txt"
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-security-spp-clientext_31bf3856ad364e35_none_5ae37aacd7fa81cb" >> "%userprofile%\desktop\sppcext.txt"
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-s..clientext.resources_31bf3856ad364e35_en-us_77be047326900dbe" >> "%userprofile%\desktop\sppcext.txt"
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-security-spp-clientext_31bf3856ad364e35_6.1.7600.16385_none_cc9d4bf812728aae" >> "%userprofile%\desktop\sppcext.txt"
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-s..clientext.resources_31bf3856ad364e35_6.1.7600.16385_en-us_66198be54f309f23" >> "%userprofile%\desktop\sppcext.txt"
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-security-spp-clientext_31bf3856ad364e35_6.1.7600.16385_none_28bbe77bcacffbe4" >> "%userprofile%\desktop\sppcext.txt"
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-s..clientext.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c2382769078e1059" >> "%userprofile%\desktop\sppcext.txt"
REG UNLOAD HKLM\COMPONENTS
 
.


Here are some instructions to make life easier :)
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.

This will create a file 'sppcext.txt' on your desktop - please attach that file to your reply, and we'll see if there's a problem somewhere there.
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Here you go
 

My Computer My Computer

At a glance

Windows 7 Ultimate x32
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dell
OS
Windows 7 Ultimate x32
Also, looks like it couldn't find some of the keys. Results of the commands is below.

Code:
C:\temp>REG LOAD HKLM\COMPONENTS C:\Windows\System32\config\COMPONENTS
The operation completed successfully.
C:\temp>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.
7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft-windows-sec
urity-spp-clientext_31bf3856ad364e35_none_fec4df291f9d1095" >> "%userprofile%\de
sktop\sppcext.txt"
C:\temp>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.
7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft-windows-s..
clientext.resources_31bf3856ad364e35_en-us_1b9f68ef6e329c88" >> "%userprofile%\d
esktop\sppcext.txt"
C:\temp>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.
7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-s
ecurity-spp-clientext_31bf3856ad364e35_none_5ae37aacd7fa81cb" >> "%userprofile%\
desktop\sppcext.txt"
ERROR: The system was unable to find the specified registry key or value.
C:\temp>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.
7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-s
..clientext.resources_31bf3856ad364e35_en-us_77be047326900dbe" >> "%userprofile%
\desktop\sppcext.txt"
ERROR: The system was unable to find the specified registry key or value.
C:\temp>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_micr
osoft-windows-security-spp-clientext_31bf3856ad364e35_6.1.7600.16385_none_cc9d4b
f812728aae" >> "%userprofile%\desktop\sppcext.txt"
C:\temp>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_micr
osoft-windows-s..clientext.resources_31bf3856ad364e35_6.1.7600.16385_en-us_66198
be54f309f23" >> "%userprofile%\desktop\sppcext.txt"
C:\temp>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_mi
crosoft-windows-security-spp-clientext_31bf3856ad364e35_6.1.7600.16385_none_28bb
e77bcacffbe4" >> "%userprofile%\desktop\sppcext.txt"
ERROR: The system was unable to find the specified registry key or value.
C:\temp>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_mi
crosoft-windows-s..clientext.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c23
82769078e1059" >> "%userprofile%\desktop\sppcext.txt"
ERROR: The system was unable to find the specified registry key or value.
C:\temp>REG UNLOAD HKLM\COMPONENTS
The operation completed successfully.
 

My Computer My Computer

At a glance

Windows 7 Ultimate x32
Computer type
PC/Desktop
Computer Manufacturer/Model Number
Dell
OS
Windows 7 Ultimate x32
That's not too surprising - many of the Keys won't exist if the OS was installed using SP1 media, or the Cleanup tool has been used to remove backup files.

It'll take me a while to figure out what's really wrong here (if anything!)

back tomorrow!
 

My Computer My Computer

At a glance

Win 7 x64 Home Premium (and x86 VirtualBox VM...i3 370M/i7 6500U8GB - finally :)/8GBit's an i3, dude!/dual Intel&nVidia
Computer type
Laptop
Computer Manufacturer/Model Number
Asus K52F or Lenovo B51-80
OS
Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
CPU
i3 370M/i7 6500U
Motherboard
Asus/Lenovo
Memory
8GB - finally :)/8GB
Graphics Card(s)
it's an i3, dude!/dual Intel&nVidia
Sound Card
onboard
Monitor(s) Displays
15.6" built-in
Screen Resolution
1366x768/1920x1080
Hard Drives
750GB Seagate internal
Sundry external drives attached to other computers on the local network
1TB SSD on the Lenovo
PSU
n/a
Internet Speed
as much as I can get - usually on a dongle/phone, so <1MB/s
Antivirus
MSE/Defender
Browser
IE11/12/Edge/Chrome/FF(if I must)
Back
Top