Windows Not Genuine thread Error 0x8004fe21

[nick4279]

i get a little note in the right bottom corner saying that it isent genuine
how do i get it to stop because i can use my pc alright

 

[nick4279]

here is the report:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE21
Cached Online Validation Code: N/A, hr = 0xc0000022
Windows Product Key: *****-*****-73CQT-WMF7J-3Q6C9
Windows Product Key Hash: KaFG+RmurcM3ZxzWyfEP9WtPUJw=
Windows Product ID: 00359-OEM-8992687-00010
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {B3BD1CCE-64EF-4FAC-9854-8BA9C2B55545}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120830-0333
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 114 Blocked VLK 2
Microsoft Office Professional Edition 2003 - 114 Blocked VLK 2
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Users\Nicklas\AppData\Local\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{B3BD1CCE-64EF-4FAC-9854-8BA9C2B55545}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-3Q6C9</PKey><PID>00359-OEM-8992687-00010</PID><PIDType>2</PIDType><SID>S-1-5-21-4017667749-3749410221-484684498</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>HP Pavilion dv6 Notebook PC</Model></SYSTEM><BIOS><Manufacturer>Hewlett-Packard</Manufacturer><Version>F.13</Version><SMBIOSVersion major="2" minor="6"/><Date>20100914000000.000000+000</Date></BIOS><HWID>A1123207018400FE</HWID><UserLCID>0406</UserLCID><SystemLCID>0406</SystemLCID><TimeZone>Rom, normaltid(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-MPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>114</Result><Products><Product GUID="{90110409-6000-11D3-8CFE-0150048383C9}"><LegitResult>114</LegitResult><Name>Microsoft Office Professional Edition 2003</Name><Ver>11</Ver><Val>59D1605114E3500</Val><Hash>vfZmaSmFPIYrLWTcZSZErUQg+Fo=</Hash><Pid>73931-640-0000106-57512</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="11" Result="114"/><App Id="16" Version="11" Result="114"/><App Id="18" Version="11" Result="114"/><App Id="19" Version="11" Result="114"/><App Id="1A" Version="11" Result="114"/><App Id="1B" Version="11" Result="114"/><App Id="44" Version="11" Result="114"/></Applications></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
På en computer, der kører en ikke-kerne-version af Microsoft Windows, skal du køre 'slui.exe 0x2a 0x80070426' for at få vist fejlteksten.
Fejl: 0x80070426

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0001000000000000
Event Time Stamp: 12:29:2012 20:20
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered Service: sppsvc


HWID Data-->
HWID Hash Current: MAAAAAEAAQABAAEAAAACAAAAAwABAAEAonYivejKMCn0YjYxYj1ClKok7LJ6KnZW

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC HPQOEM SLIC-MPC
FACP HPQOEM SLIC-MPC
HPET HPQOEM SLIC-MPC
BOOT HPQOEM SLIC-MPC
MCFG HPQOEM SLIC-MPC
WDAT HPQOEM SLIC-MPC
ASF! HPQOEM SLIC-MPC
SLIC HPQOEM SLIC-MPC
ASPT HPQOEM SLIC-MPC
SSDT PmRef CpuPm

i have a hp pavilion dv6 i have had it for about half a year now and it began to show the little note in the right bottom corner iam running microsoft security essentials it started showing the note when i updated to window build 7601 then it began giving me note about i was running false windows but iam not i bought my pc from the store and it already had window 7 home premium and the pc was brand new so please help

ps iam from denmark so please dont use too many abbreviations

 

[nick4279]

and here are the results of the following commands:
REG QUERY HKLM\SYSTEM\CurrentControlSet\services\spldr /S
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR /S
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SLSVC
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SPPSVC

just as you asked
REG QUERY HKLM\SYSTEM\CurrentControlSet\services\spldr /S:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\spldr
DisplayName REG_SZ Security Processor Loader Driver
ErrorControl REG_DWORD 0x3
Start REG_DWORD 0x0
Type REG_DWORD 0x1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\spldr\Enum
0 REG_SZ Root\LEGACY_SPLDR\0000
Count REG_DWORD 0x1
NextInstance REG_DWORD 0x1

REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR /S: error Invalid syntax.

REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SLSVC: ERROR: The system could not find the specified registry key or value.

REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SPPSVC: ERROR: The system could not find the specified registry key or value.

 

[NoelDP]

There's something odd there - you should NOT have got that response form the commands I posted (in any reasonable system)
Please try again and COPY/PASTE the answers to your response.

 

[nick4279]

ok but it is in danish

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\services\spldr /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\spldr
DisplayName REG_SZ Security Processor Loader Driver
ErrorControl REG_DWORD 0x3
Start REG_DWORD 0x0
Type REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\spldr\Enum
0 REG_SZ Root\LEGACY_SPLDR\0000
Count REG_DWORD 0x1
NextInstance REG_DWORD 0x1

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPL
DR /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR
NextInstance REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000
Service REG_SZ spldr
Legacy REG_DWORD 0x1
ConfigFlags REG_DWORD 0x400
Class REG_SZ LegacyDriver
ClassGUID REG_SZ {8ECC055D-047F-11D1-A537-0000F8753ED1}
DeviceDesc REG_SZ Security Processor Loader Driver
Capabilities REG_DWORD 0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000\Control
ActiveService REG_SZ spldr

REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SLSVC: ERROR The system could not find the specified registry key or value.

REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SPPSVC: ERROR The system could not find the specified registry key or value.

it still says error on the last two

ps i just translated it for you ^^

 

[NoelDP]

No need for translation, but thanks, anyway - and the last two should produce an error. They are there because I have seen systems where the values exist for some reason (they shouldn't).

That all looks normal.

The report indicates a tampered sppsvc service - usually, in combination with the other errors, that indicates that the spldr driver isn't loading, but in this case it seems that it's a little different.
we'll have to look more closely at the sppsvc and see if we can work out what the problem is.

Please open an Elevated Command Prompt, and run the following commands - post the results.



net start sppsvc
sc qc sppsvc
sc queryex sppsvc
sc qprivs sppsvc
sc qsidtype sppsvc
sc sdshow sppsvc

 

[nick4279]

C:\Windows\system32>net start sppsvc
Tjenesten Softwarebeskyttelse starter.
Tjenesten Softwarebeskyttelse kunne ikke startes.

Der opstod en systemfejl.

Systemfejlen 5 opstod.

Adgang nægtet.


C:\Windows\system32>sc qc sppsvc
[SC] QueryServiceConfig LYKKEDES

SERVICE_NAME: sppsvc
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START (DELAYED)
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\sppsvc.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Softwarebeskyttelse
DEPENDENCIES : RpcSs
SERVICE_START_NAME : NT AUTHORITY\NetworkService

C:\Windows\system32>sc queryex sppsvc

SERVICE_NAME: sppsvc
TYPE : 10 WIN32_OWN_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 5 (0x5)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>sc qprivs sppsvc
[SC] QueryServiceConfig2 LYKKEDES

SERVICE_NAME: sppsvc
RETTIGHEDER : SeAuditPrivilege
: SeChangeNotifyPrivilege
: SeCreateGlobalPrivilege
: SeImpersonatePrivilege

C:\Windows\system32>sc qsidtype sppsvc
[SC] QueryServiceConfig2 LYKKEDES

SERVICE_NAME: sppsvc
SERVICE_SID_TYPE: UBEGRÆNSET

C:\Windows\system32>sc sdshow sppsvc

DA;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPLO
CRRC;;;IU)(A;;CCLCSWRPLOCRRC;;;SU)(A;;LCRP;;;AU)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCW
DWO;;;WD)

C:\Windows\system32>

there you go the first command failed i think

 

[NoelDP]

Yeah - System Error 5 (0x80070005 - Access Denied)

This is usually the result of 'massive corruption' either of the registry or the files - often as a result of malware.


Please run a full CHKDSK and SFC scan....

Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

CHKDSK C: /R

and hit the Enter key.
You will be told that the drive is locked,
and the CHKDSK will run at he next boot - hit the Y key, press Enter, and then reboot.

The CHKDSK will take a few hours depending on the size of the drive, so be patient!

After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) -
then run the SFC.

SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.

At the Command prompt, type

SFC /SCANNOW

and hit the Enter key

Wait for the scan to finish - make a note of any error messages - and then reboot.


Copy the CBS.log file created (C:\Windows\Logs\CBS\CBS.log) to your desktop (you can't manipulate it directly) and then compress the copy and attach it to your reply

Post a new MGADiag report with details of any error messages encountered.

 

[nick4279]

the cbs.log file is to big it dont fit in

 

[nick4279]

here is the report and i have put the cbs log file in the zip so dont mind my last reply

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE21
Cached Online Validation Code: N/A, hr = 0xc0000022
Windows Product Key: *****-*****-73CQT-WMF7J-3Q6C9
Windows Product Key Hash: KaFG+RmurcM3ZxzWyfEP9WtPUJw=
Windows Product ID: 00359-OEM-8992687-00010
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {B3BD1CCE-64EF-4FAC-9854-8BA9C2B55545}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.120830-0333
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 114 Blocked VLK 2
Microsoft Office Professional Edition 2003 - 114 Blocked VLK 2
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Users\Nicklas\AppData\Local\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{B3BD1CCE-64EF-4FAC-9854-8BA9C2B55545}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-3Q6C9</PKey><PID>00359-OEM-8992687-00010</PID><PIDType>2</PIDType><SID>S-1-5-21-4017667749-3749410221-484684498</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>HP Pavilion dv6 Notebook PC</Model></SYSTEM><BIOS><Manufacturer>Hewlett-Packard</Manufacturer><Version>F.13</Version><SMBIOSVersion major="2" minor="6"/><Date>20100914000000.000000+000</Date></BIOS><HWID>A1123207018400FE</HWID><UserLCID>0406</UserLCID><SystemLCID>0406</SystemLCID><TimeZone>Rom, normaltid(GMT+01:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-MPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>114</Result><Products><Product GUID="{90110409-6000-11D3-8CFE-0150048383C9}"><LegitResult>114</LegitResult><Name>Microsoft Office Professional Edition 2003</Name><Ver>11</Ver><Val>59D1605114E3500</Val><Hash>vfZmaSmFPIYrLWTcZSZErUQg+Fo=</Hash><Pid>73931-640-0000106-57512</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="11" Result="114"/><App Id="16" Version="11" Result="114"/><App Id="18" Version="11" Result="114"/><App Id="19" Version="11" Result="114"/><App Id="1A" Version="11" Result="114"/><App Id="1B" Version="11" Result="114"/><App Id="44" Version="11" Result="114"/></Applications></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
På en computer, der kører en ikke-kerne-version af Microsoft Windows, skal du køre 'slui.exe 0x2a 0x80070426' for at få vist fejlteksten.
Fejl: 0x80070426

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0001000000000000
Event Time Stamp: 1:5:2013 23:12
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered Service: sppsvc


HWID Data-->
HWID Hash Current: MAAAAAEAAQABAAEAAAACAAAAAwABAAEAonYivejKMCn0YjYxYj1ClKok7LJ6KnZW

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC HPQOEM SLIC-MPC
FACP HPQOEM SLIC-MPC
HPET HPQOEM SLIC-MPC
BOOT HPQOEM SLIC-MPC
MCFG HPQOEM SLIC-MPC
WDAT HPQOEM SLIC-MPC
ASF! HPQOEM SLIC-MPC
SLIC HPQOEM SLIC-MPC
ASPT HPQOEM SLIC-MPC
SSDT PmRef CpuPm

 

[NoelDP]

The CBS log is clear
You appear to have used DISM, on 31/12 - can I ask what for?
There are actually three SFC logs in the file - all are apparently clear.


Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Method 2)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and attach it to your reply..

 

[nick4279]

here is the CheckSUR log and the CheckSUR.persist. i just put em in one zip i hope it is okay

 

[NoelDP]

You appear to have re-started the tool? - the first run was clear anyhow.

Let's check some of the peripheral services that the SPPSVC uses....

Open an Elevated Command Prompt, and run the following commands - post the results.

NET START EVENTLOG
NET START EVENTSYSTEM
NET START VSS
NET START WUAUSERV
NET START BFE
NET START BITS

 

[nick4279]

there is one that said it got activated else the others said they already are running here is the result of the commands:
C:\Windows\system32>NET START EVENTLOG
Den anmodede tjeneste er allerede blevet startet.

Der er mere hjælp til rådighed, hvis du taster NET HELPMSG 2182.


C:\Windows\system32>NET START EVENTSYSTEM
Den anmodede tjeneste er allerede blevet startet.

Der er mere hjælp til rådighed, hvis du taster NET HELPMSG 2182.


C:\Windows\system32>NET START VSS
Tjenesten Øjebliksbillede af diskenhed starter.
Tjenesten Øjebliksbillede af diskenhed er startet.


C:\Windows\system32>NET START WUAUSERV
Den anmodede tjeneste er allerede blevet startet.

Der er mere hjælp til rådighed, hvis du taster NET HELPMSG 2182.


C:\Windows\system32>NET START BFE
Den anmodede tjeneste er allerede blevet startet.

Der er mere hjælp til rådighed, hvis du taster NET HELPMSG 2182.


C:\Windows\system32>NET START BITS
Den anmodede tjeneste er allerede blevet startet.

Der er mere hjælp til rådighed, hvis du taster NET HELPMSG 2182.


C:\Windows\system32>

 

[NoelDP]

Please open an Elevated Command Prompt, and run the following commands - post the results

REG QUERY HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{e23b33b0-c8c9-472c-a5f9-f2bdfea0f156} /S
REG QUERY HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\Performance\Resolvers
REG QUERY "HKLM\SYSTEM\CurrentControlSet\services\eventlog\Application\Software Protection Platform Service"
REG QUERY "HKLM\SYSTEM\CurrentControlSet\services\eventlog\Key Management Service\KmsRequests"
REG QUERY HKLM\SYSTEM\CurrentControlSet\Control\WMI
REG QUERY HKLM\SYSTEM\CurrentControlSet\services\sppsvc /S


That's most of the Registry's direct references to the SPPSVC and its executable

 

[nick4279]

here is the results:

C:\Windows\system32>REG QUERY HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WIN
EVT\Publishers\{e23b33b0-c8c9-472c-a5f9-f2bdfea0f156} /S

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{
e23b33b0-c8c9-472c-a5f9-f2bdfea0f156}
(Standard) REG_SZ Microsoft-Windows-Security-SPP
ResourceFileName REG_EXPAND_SZ %windir%\system32\sppsvc.exe
MessageFileName REG_EXPAND_SZ %windir%\system32\sppsvc.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{
e23b33b0-c8c9-472c-a5f9-f2bdfea0f156}\ChannelReferences
Count REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{
e23b33b0-c8c9-472c-a5f9-f2bdfea0f156}\ChannelReferences\0
(Standard) REG_SZ Microsoft-Windows-Security-SPP/Perf
Id REG_DWORD 0x10
Flags REG_DWORD 0x0


C:\Windows\system32>REG QUERY HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Dia
gnostics\Performance\Resolvers

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\Perform
ance\Resolvers
SystemBinariesList REG_EXPAND_SZ win32k.sys:winlogon.exe:EXPLORER.EXE:
CSRSS.Exe:dwm.exe:logon.scr:logonui.exe:lsass.exe:lsm.exe:ntkrpamp.exe:ntoskrnl.
exe:RUNDLL32.EXE:services.exe:sppsvc.exe:smss.exe:spoolsv.exe:svchost.exe:tasken
g.exe:WinInit.exe:WISPTIS.EXE:dllhost.exe:dllhst3g.exe:cscript.exe:mmc.exe:msiex
ec.exe:upnpcont.exe:wscript.exe:WUDFHost.exe:dfsvc.exe:dfsvc.exe:fdbs.exe:ntfsbs
.exe:memdiag.exe:NETFXSBS10.exe:applaunch.exe:aspnet_compiler.exe:aspnet_regbrow
sers.exe:aspnet_regiis.exe:aspnet_regsql.exe:aspnet_state.exe:aspnet_wp.exe:casp
ol.exe:csc.exe:CVTRES.EXE:dfsvc.exe:dw20.exe:IEExec.exe:ilasm.exe:InstallUtil.ex
e:jsc.exe:MSBuild.exe:mscorsvw.exe:ngen.exe:RegAsm.exe::RegSvcs.exe:vbc.exe:Trus
tedInstaller.exe:Aurora.scr:AutoChk.Exe:AUTOFMT.EXE:CHKDSK.EXE:CHKNTFS.EXE:conse
nt.exenPUnattend.exenPutil.exe:RacAgent.exe:fsquirt.exe:Uninst.exe:updateWmc
.exe:wmdc.exe:wmdsync.exe:mofcomp.exe:ScrCons.exe:smi2smir.exe:unsecapp.exe:wbem
test.exe:winmgmt.exe:wmic.exe:bfsvc.exe:Twunk_16.exe:Twunk_32.exe:wuauclt.exe:ws
qmcons.exe:sapisvr.exe:WinSAT.exe2phost.exe:SearchProtocolHost.exe:WerFault.ex
e:drvinst.exe:ehshell.exe:UI0Detect.exe:ehtray.exe:HelpPane.exe:mrt.exe:SearchFi
lterHost.exe:mobsync.exe:Narrator.exe:SLUI.exe:taskmgr.exeresentationSettings.
exe:vds.exe:sdclt.exe:irftp.exeFDWiz.exe:SndVol.exe:makecab.exe:msfeedssync.ex
e:unregmp2.exeeviceProperties.exe:rstrui.exe:MdRes.exe:netsh.exerintui.exe:m
cupdate.exe:4mmdat.sys:61883.sys:ACPI.sys:amdk7.sys:amdk8.sys:ASYNCMAC.SYS:atapi
.sys:AVC.SYS:cdfs.sys:cdrom.sys:circlass.sys:cmbatt.sys:crusoe.sys:CSC.Sys:dc21x
4vm.sys:disk.sys:dot4.sys:dot4usb.sys:drmkaud.sys:ecache.sys:fdc.sys:floppy.sys:
hdaudbus.sys:HDAudio.sys:HIDBTH.SYS:HIDIR.SYS:i8042prt.sys:intelppm.sys:irenum.S
YS:IRSIR.SYS:kbdclass.sys:kbdhid.sys:LOOP.SYS:mf.sys:monitor.sys:mouclass.sys:mo
uhid.sys:msisadrv.sys:msiscsi.sys:NDISWAN.SYS:nsiproxy.syshci1394.sysci.sys:
pciide.sysowerfil.sysrocessr.sys:rasl2tp.sys:raspppoe.sys:RASPPTP.SYS:RDPCDD
.SYS:rfcomm.sys:sbp2port.sys:sdbus.sys:serenum.sys:serial.sys:sermouse.sys:sffdi
sk.sys:sffp_mmc.sys:smbios.sys:swenum.sys:tdx.sys:termdd.sys:tpm.sys:tunmp.sys:t
unnel.sys:umbus.sys:update.sys:usb8023.sys:USBAudio.sys:USBCCGP.SYS:usbcir.sys:U
SBEHCI.sys:usbhub.sys:USBOHCI.sys:usbprint.sys:USBUHCI.sys:viac7.sys:wacompen.sy
s:wceusbsh.sys:winusb.sys:ws2ifsl.sys:xnacc.sys
ExpirationDays REG_DWORD 0x5a


C:\Windows\system32>REG QUERY "HKLM\SYSTEM\CurrentControlSet\services\eventlog\A
pplication\Software Protection Platform Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\Softwa
re Protection Platform Service
EventMessageFile REG_EXPAND_SZ %windir%\system32\sppsvc.exe
TypesSupported REG_DWORD 0x7
ProviderGuid REG_SZ {E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}


C:\Windows\system32>REG QUERY "HKLM\SYSTEM\CurrentControlSet\services\eventlog\K
ey Management Service\KmsRequests"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Key Management Ser
vice\KmsRequests
EventMessageFile REG_EXPAND_SZ %windir%\system32\sppsvc.exe
TypesSupported REG_DWORD 0x7
ProviderGuid REG_SZ {E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}


C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Control\WMI

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\services\sppsvc /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sppsvc
DisplayName REG_SZ @%SystemRoot%\system32\sppsvc.exe,-101
ImagePath REG_EXPAND_SZ %SystemRoot%\system32\sppsvc.exe
Description REG_SZ @%SystemRoot%\system32\sppsvc.exe,-100
ObjectName REG_SZ NT AUTHORITY\NetworkService
ErrorControl REG_DWORD 0x1
Start REG_DWORD 0x2
DelayedAutoStart REG_DWORD 0x1
Type REG_DWORD 0x10
DependOnService REG_MULTI_SZ RpcSs
ServiceSidType REG_DWORD 0x1
RequiredPrivileges REG_MULTI_SZ SeAuditPrivilege\0SeChangeNotifyPrivil
ege\0SeCreateGlobalPrivilege\0SeImpersonatePrivilege
FailureActions REG_BINARY 80510100000000000000000003000000140000000100
0000C0D4010001000000E09304000000000000000000

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\sppsvc\Security
Security REG_BINARY 01001480A0000000AC000000140000003000000002001C0001
00000002801400FF010F00010100000000000100000000020070000500000000001400FD01020001
010000000000051200000000001800FF010F0001020000000000052000000020020000000014009D
010200010100000000000504000000000014009D0102000101000000000005060000000000140014
00000001010000000000050B000000010100000000000512000000010100000000000512000000


C:\Windows\system32>

 

[NoelDP]

Those all look perfectly normal to me.
I suspect that it may be a permissions thing in the registry - and it's beyond my current skills/knowledge to fix that.
I suspect that the only cure is going to be either a repair install or a clean install.

 

[nick4279]

ok ty for trying to help hope i havent wasted your time well kan you keep an eye on here for a day or two so i can tell you if the problem is solved i will let you know but in general your are the best i have tried so many forums where they didnt even care about me there could go like a week before they answered a question but you answer almost emidietly and i just wanted to let you know

 

[NoelDP]

I see all new posts to the forum, so if you come back, I'll know
Good luck!