Windows7 SP1 not genuine every time after restarting

NoelDP · 09 Jun 2014

OMG! - you should have come back sooner!
I'll review the thread and come back to you later.

bacoksai · 10 Jun 2014

NoelDP said:

OMG! - you should have come back sooner!
I'll review the thread and come back to you later.

I was waiting for your reply, and totally forget about it until the activation period has expired few days ago
hahaha

NoelDP · 22 Jun 2014

I suspect that I know what the problem is - but it's not good news.
It appears that you may have an Activation Exploit installed which is interfering with the proper Activation process.

Activation Exploits sometimes work by locking the registry to an activated state and not allowing the system to properly check it. Some work in other ways..
It is likely that in this case the Exploit is malfunctioning because of being partially broken by an update.

How do I know you have an Activation Exploit?
Look at the last section of your MGADiag report

Code:

 
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name OEMID Value OEMTableID Value
  APIC PTLTD APIC  
  FACP INTEL CRESTLNE
  HPET INTEL CRESTLNE
  BOOT PTLTD $SBFTBL$
  MCFG INTEL CRESTLNE
  SLIC DELL  QA09   
  OSFR DELL  DELL    
  SSDT PmRef CpuPm
  SSDT PmRef CpuPm
  SSDT PmRef CpuPm

The Marker version 20001 wasn't release until the release of Windows 7 in very late July 2009 - but your BIOS is dated early July, which means that so far as I know there is no possible way for it to be valid. Therefore a software emulation (the Activation Exploit) must be present.

There are a number of problems that this is likely to cause.
1) Activation Exploits frequently come with malware embedded which can render the system vulnerable to hacking.
2) There are a number of variants of such exploits, and it's very difficult to establish which exact one is in use - which makes removing them very difficult.

The recommendation therefore would have to be to reformat and reinstall using genuine media and Key.
A potential option is a repair install - but this won't necessarily remove all of the exploit.

However - this may be worth a try....

Best way to fix it now (since we don't know which version of RemoveWAT was used) is to run WATFix....

Download WATFix - make sure that you UNTICK the box for the 'download manager, and click on the link on the left of the page, not the big shiny button on the right (which is an ad for the download manager!!) - and use that - extract the .exe file, and run it, then reboot.

Post back with another MGADiag report, and we'll then see what we can do.

bacoksai · 22 Jun 2014

beginning the system scan now, I'll post back when it finished

bacoksai · 22 Jun 2014

MGADiag report after reboot
*note: usually there's a writing on the bottom left of the screen
windows 7
build 7601
test mode
but now this has somehow gone

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-74XYM-BH4JX-XM76F
Windows Product Key Hash: KeYfcvXg/a1Q01x73+f8IL/JC4Y=
Windows Product ID: 00359-112-0000007-85881
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {3391C58C-A7B2-4C54-84E5-5A510EDA94B2}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.140303-2144
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 103 Blocked VLK
Microsoft Office Enterprise 2007 - 103 Blocked VLK
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\npwatweb.dll[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\watux.exe[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\watweb.dll[Hr = 0x80070003]

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{3391C58C-A7B2-4C54-84E5-5A510EDA94B2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-XM76F</PKey><PID>00359-112-0000007-85881</PID><PIDType>5</PIDType><SID>S-1-5-21-1503906676-1030530248-19712569</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Studio 1555</Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A07</Version><SMBIOSVersion major="2" minor="5"/><Date>20090703000000.000000+000</Date></BIOS><HWID>5BDC3307018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>SE Asia Standard Time(GMT+07:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>QA09   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>103</Result><Products><Product GUID="{90120000-0030-0000-0000-0000000FF1CE}"><LegitResult>103</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>ACD7202654E586</Val><Hash>fFic3JgCreGGRxyF8uMWB4R4Jcg=</Hash><Pid>89388-707-1528066-65536</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="103"/><App Id="16" Version="12" Result="103"/><App Id="18" Version="12" Result="103"/><App Id="19" Version="12" Result="103"/><App Id="1A" Version="12" Result="103"/><App Id="1B" Version="12" Result="103"/><App Id="44" Version="12" Result="103"/><App Id="A1" Version="12" Result="103"/><App Id="BA" Version="12" Result="103"/></Applications></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: 2e7d060d-4714-40f2-9896-1e4f15b612ad
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00170-112-000000-00-1033-7601.0000-1742014
Installation ID: 021881012796509230183685327616941876213204606556872576
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: XM76F
License Status: Initial grace period
Time remaining: 24120 minute(s) (16 day(s))
Remaining Windows rearm count: 0
Trusted time: 6/23/2014 3:39:33 AM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 6:9:2014 20:59
ActiveX: Not Registered - 0x80040154
Admin Service: Not Registered - 0x80040154
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: OAAAAAIABAABAAEAAAACAAAAAwABAAEAeqjGWHcWfv7uVWxlJp5qC9TDxnCaiERJkzYAVcz+Rso=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name	OEMID Value	OEMTableID Value
  APIC			PTLTD 			 APIC  
  FACP			INTEL 		CRESTLNE
  HPET			INTEL 		CRESTLNE
  BOOT			PTLTD 		$SBFTBL$
  MCFG			INTEL 		CRESTLNE
  SLIC			DELL  		QA09   
  OSFR			DELL  		DELL    
  SSDT			PmRef		CpuPm
  SSDT			PmRef		CpuPm
  SSDT			PmRef		CpuPm

after activating windows

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-Y6RHM-4VWG8-DWM2F
Windows Product Key Hash: YVjk0286uCpeEupTpmA+L3o8hD8=
Windows Product ID: 00359-OEM-8882324-63459
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {3391C58C-A7B2-4C54-84E5-5A510EDA94B2}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.140303-2144
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 103 Blocked VLK
Microsoft Office Enterprise 2007 - 103 Blocked VLK
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\Windows\system32\wat\watadminsvc.exe[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\npwatweb.dll[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\watux.exe[Hr = 0x80070003]
File Mismatch: C:\Windows\system32\wat\watweb.dll[Hr = 0x80070003]

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{3391C58C-A7B2-4C54-84E5-5A510EDA94B2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-DWM2F</PKey><PID>00359-OEM-8882324-63459</PID><PIDType>3</PIDType><SID>S-1-5-21-1503906676-1030530248-19712569</SID><SYSTEM><Manufacturer>Dell Inc.</Manufacturer><Model>Studio 1555</Model></SYSTEM><BIOS><Manufacturer>Dell Inc.</Manufacturer><Version>A07</Version><SMBIOSVersion major="2" minor="5"/><Date>20090703000000.000000+000</Date></BIOS><HWID>5BDC3307018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>SE Asia Standard Time(GMT+07:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>QA09   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>103</Result><Products><Product GUID="{90120000-0030-0000-0000-0000000FF1CE}"><LegitResult>103</LegitResult><Name>Microsoft Office Enterprise 2007</Name><Ver>12</Ver><Val>ACD7202654E586</Val><Hash>fFic3JgCreGGRxyF8uMWB4R4Jcg=</Hash><Pid>89388-707-1528066-65536</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="12" Result="103"/><App Id="16" Version="12" Result="103"/><App Id="18" Version="12" Result="103"/><App Id="19" Version="12" Result="103"/><App Id="1A" Version="12" Result="103"/><App Id="1B" Version="12" Result="103"/><App Id="44" Version="12" Result="103"/><App Id="A1" Version="12" Result="103"/><App Id="BA" Version="12" Result="103"/></Applications></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: 9f83d90f-a151-4665-ae69-30b3f63ec659
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00176-823-263459-02-1033-7601.0000-1742014
Installation ID: 020876068732239532107964419494272362942016262323216485
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: DWM2F
License Status: Licensed
Remaining Windows rearm count: 0
Trusted time: 6/23/2014 3:45:59 AM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 6:9:2014 20:59
ActiveX: Not Registered - 0x80040154
Admin Service: Not Registered - 0x80040154
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: OAAAAAIABAABAAEAAAACAAAAAwABAAEAeqjGWHcWfv7uVWxlJp5qC9TDxnCaiERJkzYAVcz+Rso=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name	OEMID Value	OEMTableID Value
  APIC			PTLTD 			 APIC  
  FACP			INTEL 		CRESTLNE
  HPET			INTEL 		CRESTLNE
  BOOT			PTLTD 		$SBFTBL$
  MCFG			INTEL 		CRESTLNE
  SLIC			DELL  		QA09   
  OSFR			DELL  		DELL    
  SSDT			PmRef		CpuPm
  SSDT			PmRef		CpuPm
  SSDT			PmRef		CpuPm

*EDIT:
after activating windows and reboot, my windows is still genuine
I think this has fix the activation problem
but, I'll check and post back in a few days just to make sure

NoelDP · 22 Jun 2014

<crosses fingers> I won't hold my breath!

You should attempt validation at www.microsoft.com/genuine/validate and see what happens.

bacoksai · 22 Jun 2014

NoelDP said:

<crosses fingers> I won't hold my breath!

You should attempt validation at www.microsoft.com/genuine/validate and see what happens.

after clicking the "validate now" button, a pop up window appear "Download Required Windows Validation Components"
there is a download and continue button, but hitting the download button doesn't do anything???
tried in chrome and IE
if I hit the continue button, it says "Please wait for the install to complete and then click Continue or view the Troubleshooting tips."
confused...

NoelDP · 22 Jun 2014

OK - try this...

Install the KB971033 update from
the update from http://support.microsoft.com/kb/971033
Reboot.

Then try validation again.

bacoksai · 22 Jun 2014

NoelDP said:

OK - try this...

Install the KB971033 update from
the update from http://support.microsoft.com/kb/971033
Reboot.

Then try validation again.

here is what happened

NoelDP · 23 Jun 2014

Yay! Lookin' good :)

See how it goes...