Windows Seven, No Longer genuine (Sfc /Scannow probably caused it).

[Secrios]

After sucessfully removing a lot of viruses with malwarebytes and manual cleaning.

I trying to fix the lsp by running an /SFC Scannow on the cmd; but when it was finished it said it successfully repaired a lode of files.

After a reboot, I find that my Avast, internet, lsp are all still busted and to make things worse my windows seven is no longer genuine.

My current theory is that the repair messed up an aspect of the registry spectacularly.

A repair guy is coming round my place soon but until then, it would be a great help if I knew exactly what I was dealing with.

What is the cause of the problem and how can I fix it?

(PS, I don't know if malwarebytes deleted some valuable registry when cleaning the viruses).

 

[Ranger4]

Hi Secrios, welcome to Windows Seven Forums.

You mentioned you did a lot of manual cleaning, did you use one of the many 3rd party registry cleaners available, if so could you post back the name of it, as some of them are renowned for wrecking the registry.

 

[NoelDP]

Please follow this tutorial and post an MGADiag report - then we can see what the problem is.

http://www.sevenforums.com/windows-...ne-activation-issue-posting-instructions.html

Ignore errors produced when clicking on the Copy button - they simply mean that the tool could not create the backup files for some reason. The data is still copied to the clipboard for pasting to your response.

Please also state the Version and Edition of Windows quoted on your COA sticker (if you have one) on the case of your machine (or inside the battery compartment), but do NOT quote the Key on the sticker!
https://www.microsoft.com/en-gb/howtotell/Hardware.aspx#PCPurchase

 

[Secrios]

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 50
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-8GJTF-HKDQJ-MHMGB
Windows Product Key Hash: vKAW4gN06xGkUUQ7eInTf80oZos=
Windows Product ID: 00426-OEM-9154333-63054
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {24ADAE68-242B-468F-8C6B-71ECE1614403}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.150525-0603
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: N/A, hr=0x80070002
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{24ADAE68-242B-468F-8C6B-71ECE1614403}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-MHMGB</PKey><PID>00426-OEM-9154333-63054</PID><PIDType>3</PIDType><SID>S-1-5-21-3271321859-3749807997-2683241164</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>1207 </Version><SMBIOSVersion major="2" minor="5"/><Date>20110304000000.000000+000</Date></BIOS><HWID>D3D43407018400F4</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0xC004F012' to display the error text.
Error: 0xC004F012

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 8:15:2015 12:31
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: QAAAAAEABAABAAEAAwAFAAAAAgABAAEA1gTwyaxwRryMJoQ0aGVuifAACoDueDAHNHNQGn72Bumf+DomTuaCKA==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC 030411 APIC1101
FACP 030411 FACP1101
HPET 030411 OEMHPET
MCFG 030411 OEMMCFG
OEMB 030411 OEMB1101
OSFR 030411 OEMOSFR
SSDT DpgPmm CpuPm

I checked the back of the pc and it is a windows 7 ultimate.

As for your question on cleaning software, it was a mixture of Avast, cc cleaner and malwarebytes. The quar files are gone btw.

 

[NoelDP]

The news is not good
The errors in your report tend to indicate that there is fairly major corruption.
However let's see what we can do about it.
Please follow the windows update poting instructions and post the requested data.

 

[Secrios]

The news is not good
The errors in your report tend to indicate that there is fairly major corruption.
However let's see what we can do about it.
Please follow the windows update poting instructions and post the requested data.

Whats windows update poting?

 

[NoelDP]

Sorry.. on the phone atm...
Windows Update Postig Instructions - in the stickie threads at the forum section list

 

[Secrios]

Sorry.. on the phone atm...
Windows Update Postig Instructions - in the stickie threads at the forum section list

I downloaded that update thing and I am now waiting for it to finish. I hope it is not stuck.

 

[Secrios]

Ok I have installed that weird update thing, now what?

 

[NoelDP]

Follow the instructions. ...

 

[Secrios]

Follow the instructions. ...

I installed the hotfix update, but I am unable to connect to the internet to install the rest. Am I supposed to jump to the sfc scannow phase?

 

[Secrios]

Follow the instructions. ...

CBS.ZIP: CBS Sec - MovieMowDown's Sta.sh

Update Fail - MovieMowDown's Sta.sh

 

[NoelDP]

The first SFC scan fixed a couple of problems which would have affected your internet connection - the second found nothing to fix.
You didn't post all the requested logs - I need to see the CheckSUR.log file, at least.

 

[Secrios]

The first SFC scan fixed a couple of problems which would have affected your internet connection - the second found nothing to fix.
You didn't post all the requested logs - I need to see the CheckSUR.log file, at least.

This zip contains a special archive I made for before the computer was ruined. It has the cbs with all the info of what it touched and the checksur. CBS Before - MovieMowDown's Sta.sh

If you need the most up to date sur after the pc was ruined let me know.

 

[NoelDP]

CheckSUR found no problems - the report is dated 2015-08-27 19:20 (which is after your first post here?)

In view of the history, lets have a look at permissions....
Open an Elevated Command Prompt, and run the following commands

ICACLS C:\Windows
ICACLS C:\Windows\System32
ICACLS C:\Windows\SysWOW64
ICACLS C:\Windows\winsxs

Post the results
Once you've posted the results,
run the following commands

NETSH WINSOCK RESET
NETSH WINHTTP RESET

reboot
post another MGADiag report.

 

[Secrios]

CheckSUR found no problems - the report is dated 2015-08-27 19:20 (which is after your first post here?)

In view of the history, lets have a look at permissions....
Open an Elevated Command Prompt, and run the following commands

ICACLS C:\Windows
ICACLS C:\Windows\System32
ICACLS C:\Windows\SysWOW64
ICACLS C:\Windows\winsxs

Post the results
Once you've posted the results,
run the following commands

NETSH WINSOCK RESET
NETSH WINHTTP RESET

reboot
post another MGADiag report.

The Sur was the one that came with the cbs that ruined the computer. I have a more up to date one if you want that. I'n the mean time I will be posting the commands.

 

[Secrios]

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>ICACLS C:\Windows
C:\Windows NT SERVICE\TrustedInstallerF)
NT SERVICE\TrustedInstallerCI)(IO)(F)
NT AUTHORITY\SYSTEMM)
NT AUTHORITY\SYSTEMOI)(CI)(IO)(F)
BUILTIN\AdministratorsM)
BUILTIN\AdministratorsOI)(CI)(IO)(F)
BUILTIN\UsersRX)
BUILTIN\UsersOI)(CI)(IO)(GR,GE)
CREATOR OWNEROI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\WINDOWS\SYSTEM32
C:\WINDOWS\SYSTEM32 NT SERVICE\TrustedInstallerF)
NT SERVICE\TrustedInstallerCI)(IO)(F)
NT AUTHORITY\SYSTEMM)
NT AUTHORITY\SYSTEMOI)(CI)(IO)(F)
BUILTIN\AdministratorsM)
BUILTIN\AdministratorsOI)(CI)(IO)(F)
BUILTIN\UsersRX)
BUILTIN\UsersOI)(CI)(IO)(GR,GE)
CREATOR OWNEROI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\WINDOWS\SYSWOW64
C:\WINDOWS\SYSWOW64 NT SERVICE\TrustedInstallerF)
NT SERVICE\TrustedInstallerCI)(IO)(F)
NT AUTHORITY\SYSTEMM)
NT AUTHORITY\SYSTEMOI)(CI)(IO)(F)
BUILTIN\AdministratorsM)
BUILTIN\AdministratorsOI)(CI)(IO)(F)
BUILTIN\UsersRX)
BUILTIN\UsersOI)(CI)(IO)(GR,GE)
CREATOR OWNEROI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\WINDOWS\WINSXS
C:\WINDOWS\WINSXS NT SERVICE\TrustedInstallerOI)(CI)(F)
BUILTIN\AdministratorsOI)(CI)(RX)
NT AUTHORITY\SYSTEMOI)(CI)(RX)
BUILTIN\UsersOI)(CI)(RX)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>ICACLS C:\Windows
C:\Windows NT SERVICE\TrustedInstallerF)
NT SERVICE\TrustedInstallerCI)(IO)(F)
NT AUTHORITY\SYSTEMM)
NT AUTHORITY\SYSTEMOI)(CI)(IO)(F)
BUILTIN\AdministratorsM)
BUILTIN\AdministratorsOI)(CI)(IO)(F)
BUILTIN\UsersRX)
BUILTIN\UsersOI)(CI)(IO)(GR,GE)
CREATOR OWNEROI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\WINDOWS\SYSTEM32
C:\WINDOWS\SYSTEM32 NT SERVICE\TrustedInstallerF)
NT SERVICE\TrustedInstallerCI)(IO)(F)
NT AUTHORITY\SYSTEMM)
NT AUTHORITY\SYSTEMOI)(CI)(IO)(F)
BUILTIN\AdministratorsM)
BUILTIN\AdministratorsOI)(CI)(IO)(F)
BUILTIN\UsersRX)
BUILTIN\UsersOI)(CI)(IO)(GR,GE)
CREATOR OWNEROI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\WINDOWS\SYSWOW64
C:\WINDOWS\SYSWOW64 NT SERVICE\TrustedInstallerF)
NT SERVICE\TrustedInstallerCI)(IO)(F)
NT AUTHORITY\SYSTEMM)
NT AUTHORITY\SYSTEMOI)(CI)(IO)(F)
BUILTIN\AdministratorsM)
BUILTIN\AdministratorsOI)(CI)(IO)(F)
BUILTIN\UsersRX)
BUILTIN\UsersOI)(CI)(IO)(GR,GE)
CREATOR OWNEROI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>ICACLS C:\WINDOWS\WINSXS
C:\WINDOWS\WINSXS NT SERVICE\TrustedInstallerOI)(CI)(F)
BUILTIN\AdministratorsOI)(CI)(RX)
NT AUTHORITY\SYSTEMOI)(CI)(RX)
BUILTIN\UsersOI)(CI)(RX)

Successfully processed 1 files; Failed processing 0 files

C:\Windows\system32>

Netsh - MovieMowDown's Sta.sh

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 50
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-8GJTF-HKDQJ-MHMGB
Windows Product Key Hash: vKAW4gN06xGkUUQ7eInTf80oZos=
Windows Product ID: 00426-OEM-9154333-63054
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {24ADAE68-242B-468F-8C6B-71ECE1614403}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.150525-0603
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: N/A, hr=0x80070002
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{24ADAE68-242B-468F-8C6B-71ECE1614403}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-MHMGB</PKey><PID>00426-OEM-9154333-63054</PID><PIDType>3</PIDType><SID>S-1-5-21-3271321859-3749807997-2683241164</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>1207 </Version><SMBIOSVersion major="2" minor="5"/><Date>20110304000000.000000+000</Date></BIOS><HWID>D3D43407018400F4</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0xC004F012' to display the error text.
Error: 0xC004F012

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 8:15:2015 12:31
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: QAAAAAEABAABAAEAAwAFAAAAAgABAAEA1gTwyaxwRryMJoQ0aGVuifAACoDueDAHNHNQGn72Bumf+DomTuaCKA==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC 030411 APIC1101
FACP 030411 FACP1101
HPET 030411 OEMHPET
MCFG 030411 OEMMCFG
OEMB 030411 OEMB1101
OSFR 030411 OEMOSFR
SSDT DpgPmm CpuPm

 

[NoelDP]

All the permissions look normal.

Let's try something simple...
Recreate the Licensing Store
Go to Start > All Programs > Accessories
Right-Click on Command Prompt and select Run as Administrator - accept the UAC prompt
Run the following commands in the Command Prompt window, using the Enter key at the end of each

net stop sppsvc
(wait until the service has stopped before entering the following lines)

CD %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform
REN tokens.dat tokens.bar
net start sppsvc
slui.exe

After a couple of seconds the Windows Activation dialog will appear.
You may be asked to re-activate and/or re-enter your product key, or Activation may occur automatically.
If you are asked for your Key, use the one on the COA sticker on the machine's case

Reboot and Post back with a new MGADiag report.

(Note: the Line 'CD %win......\SoftwareProtectionPlatform' is all on one line - it may be broken in the Forum listing)

 

[Secrios]

I'll do that when I get back home.

 

[Secrios]

All the permissions look normal.

Let's try something simple...
Recreate the Licensing Store
Go to Start > All Programs > Accessories
Right-Click on Command Prompt and select Run as Administrator - accept the UAC prompt
Run the following commands in the Command Prompt window, using the Enter key at the end of each

net stop sppsvc
(wait until the service has stopped before entering the following lines)

CD %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform
REN tokens.dat tokens.bar
net start sppsvc
slui.exe

After a couple of seconds the Windows Activation dialog will appear.
You may be asked to re-activate and/or re-enter your product key, or Activation may occur automatically.
If you are asked for your Key, use the one on the COA sticker on the machine's case

Reboot and Post back with a new MGADiag report.

(Note: the Line 'CD %win......\SoftwareProtectionPlatform' is all on one line - it may be broken in the Forum listing)

I'm having trouble putting the commands in, I don't know when one begins and another ends. Also I looked in the folder and there is no .bar I think.