Copy of Windows is not genuine (build 7601) message after avast update

GlennStauffer · 04 May 2014

We bought a new HP laptop with Win 7 Pro (64 bit) preinstalled in July 2013 from a reputable (I think) online dealer. I installed the free version of Avast and initially all was well, and bootup time was very quick. After about a month or 2, I was prompted to update Avast, which I did. Immediately 2 problems cropped up. First, bootup time became very painfully slow (sometimes up to 5 minutes or more before the computer is fully operational). Once it was booted up, it did not seem particularly slow anymore. Second, we began to get the message in the lower right that "copy of Windows is not genuine (build 7601)". This message shows up only occasionally (most of the time it does NOT appear), and it does not seem to have any noticeable effect (unless it is related to the slow bootup time). The screen shows our normal wallpaper. Reading somewhere that Avast may have caused the slow bootup time, I uninstalled Avast and instead installed the free version of AVG, which I still use. But both problems persist (slow bootup and occasional "windows not genuine" message). I believe my copy of Windows is genuine, but interestingly, the computer does not have a COA sticker, at least no that I can find. We also do not have Win 7 disk from MS (only from HP). I strongly suspect that Avast caused the problem, but I don't know how to fix it. Below is the MGADiag report.

Thanks!

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-788W3-H689G-6P6GT
Windows Product Key Hash: yr8OHoeXhbT4dc6MxGYjdAStSPY=
Windows Product ID: 00371-OEM-8992671-00008
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {C59B942F-E12F-4178-8BB4-F8B5D77C88D5}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130828-1532
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{C59B942F-E12F-4178-8BB4-F8B5D77C88D5}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-6P6GT</PKey><PID>00371-OEM-8992671-00008</PID><PIDType>2</PIDType><SID>S-1-5-21-881679867-334586099-1768572632</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>HP ProBook 4540s</Model></SYSTEM><BIOS><Manufacturer>Hewlett-Packard</Manufacturer><Version>68IRR Ver. F.40</Version><SMBIOSVersion major="2" minor="7"/><Date>20130129000000.000000+000</Date></BIOS><HWID>A3303207018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-MPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: 50e329f7-a5fa-46b2-85fd-f224e5da7764
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00178-926-700008-02-1033-7601.0000-2102013
Installation ID: 008242187911942454031770258481523625103384955361912331
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: 6P6GT
License Status: Licensed
Remaining Windows rearm count: 1
Trusted time: 5/2/2014 3:45:41 PM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 4:28:2014 17:00
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: LgAAAAEAAQABAAEAAAABAAAAAwABAAEA6GGWHn6HooFUOz6CnJY4bNy7lD2WYw==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name	OEMID Value	OEMTableID Value
  APIC			HPQOEM		17F6    
  FACP			HPQOEM		17F6    
  HPET			HPQOEM		17F6    
  MCFG			HPQOEM		17F6    
  ASF!			HPQOEM		17F6    
  SSDT			HPQOEM		SataAhci
  SSDT			HPQOEM		SataAhci
  SLIC			HPQOEM		SLIC-MPC
  MSDM			HPQOEM		SLIC-MPC
  FPDT			HPQOEM		17F6    
  BGRT			HPQOEM		17F6    
  SSDT			HPQOEM		SataAhci
  SSDT			HPQOEM		SataAhci

NoelDP · 07 May 2014

Your symptoms are typical of a race condition - most likely caused by a conflict between your AV and other software.
I would suggest uninstalling Avast completely, and running their cleanup tool.
What other AV's have been installed (even if not activated?) - most will come with a 'free' trial install of either Norton or McAfee, so it's worth running the removal tools for both.
Please do things in this order....

Download the McAfee removal tool from:

http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

Click Save, and save the file to a folder on your computer.
Navigate to the folder where you saved the file.
right-click on MCPR.exe and select 'Run as Administrator' to run the removal tool.

when complete, reboot.

Download the Norton Removal Tool from here https://www-secure.symantec.com/norton-support/jsp/help-solutions.jsp?lg=english&ct=united+states&docid=20080710133834EN&product=home&version=1&pvid=f-home

Close all other programs, then run the tool. When it's complete, reboot the machine whether it asks for it or not.

After the reboot, open an Elevated Command Prompt, and run the following command

NETSH WINSOCK RESET

You'll be advised to reboot - do so.

Now uninstall Avast - using the normal Control Panel uninstaller.

Then
Download the Avast removal utility from here http://www.avast.com/uninstall-utility
Follow the instructions for running it, and when complete, reboot the machine.

Allow it to settle down for 10 minutes or so, then reboot again and reinstall Avast and update it.

How is the boot speed now?

GlennStauffer · 08 May 2014

Thanks for your help. I really appreciate it.
I already had uninstalled Avast and installed AVG instead several months ago. I followed your steps otherwise, and also uninstalled AVG. I tried the Avast cleaner anyway, but it asked for the location where Avast files were stored, but the Avast folder already was gone from my earlier uninstall awhile ago. So I'm not sure if the Avast cleaner actually did anything.
But, with all AV software uninstalled (I thought), bootup seemed slightly faster. I reinstalled Avast, and immediately things got MUCH worse. First a window popped up telling me that there were 2 AVs installed (I guess MSE was the other?) Also, bootup times got VERY long, up to 10 minutes (usually longer) before the desktop icons even appeared. And then clicking on an icon before the bootup was complete seemingly resulted in "punishment" as it seemed to take even longer to boot!
Tonight the "Windows not genuine" message showed up again. I ran the NETSH WINSOCK RESET command again and uninstalled Avast. Now I have only MSE for AV software (I think), and the desktop icons appear very quickly upon booting. Unfortunately, it still takes quite awhile (5-10 minutes) before clicking on one of the icons (or the start button) actually does anything.
I will keep monitoring and report in a few days how bootup is going, and whether the "not genuine" maessage reappears.
Thanks again.

NoelDP · 09 May 2014

Ah - I may have misunderstood things a little. Sorry

AVG can also leave stuff behind. - and the residuals from any AV can interfere with the proper installation of a later one.
If you didn't already do so, run the Avast cleanup tool again, then run the 2012 and 2014 versions of the AVG Remover...

Download the AVG Remover from here
http://www.avg.com/us-en/utilities
Follow the instructions for running it, and then reboot the machine (whether it asks for it or not, and whether the program rebooted already or not).

Then uninstall MSE, reboot, and reinstall it - this should get rid of any residual corruption caused by possible left-overs.

See how the system behaves then

GlennStauffer · 09 May 2014

I'll have to do it when I get home....
I did run the 2014 version of AVG remover, but not the 2012 version. I'll do that this weekend. But before I ran the 2014 version, I first uninstalled AVG from the control panel. Running the remover then resulted in some error messages (I guess it tried to remove files it could no longer find).
Three questions in the meantime:
First, if I uninstall MSE from the control panel, will it leave residual?
Second, do you recommend reinstalling MSE again, or some other AV? I understand that MSE is "lightweight" compared to some other free AVs like Avast or AVG. I liked Avast when I first installed it several months ago, but am wary now that it might be a major resource hog (the setup file is >80 mb).
Third, the Avast cleanup tool asked for a location where the relevant files are located. But the folder called Avast is gone when the program is uninstalled from the control panel. What do I specify as the location? I did run the tool again last night and just put in "Program Files/Avast" even though the folder Avast lo longer existed (or was not visible?). The cleanup tool warned that files in the specified folder would be irretrievable deleted. Upon execution, it flashed a message about deleting something. But I am uncertain if it actually did anything.
Thanks again. I'm learning something.

NoelDP · 09 May 2014

MSE has a very light touch, and uninstalls cleaner than almost all of the others (even after running some of their removal tools, in some cases).

MSE's setup file is only about 10MB - but the definitions and engine download which starts its use is about 70MB last I looked. Nothing nowadays is going to be much smaller, simply because of the complexity of what it's fighting.