Windows 7: Windows Not Genuine error

firedrake1988 · 19 May 2014

Im having lots of trouble upgrading my system to 64 bit windows, this is just one of the problems.

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE21
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-HVWYH-MBXKP-W7CC3
Windows Product Key Hash: 35e9sO363nLS1jXQZWfSbi1AQ1w=
Windows Product ID: 00359-114-0991896-85122
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {F23FA5BB-B372-493D-84EC-5932BEA95EA9}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130828-1532
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\slcext.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\drivers\spsys.sys[6.1.7127.0], Hr = 0x80092003
File Mismatch: C:\Windows\system32\drivers\spldr.sys[6.1.7127.0], Hr = 0x80092003

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{F23FA5BB-B372-493D-84EC-5932BEA95EA9}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-W7CC3</PKey><PID>00359-114-0991896-85122</PID><PIDType>5</PIDType><SID>S-1-5-21-2593155633-956918059-1567395968</SID><SYSTEM><Manufacturer>MSI</Manufacturer><Model>MS-7693</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>V2.6</Version><SMBIOSVersion major="2" minor="7"/><Date>20131008000000.000000+000</Date></BIOS><HWID>12E03D07018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: 2e7d060d-4714-40f2-9896-1e4f15b612ad
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00170-114-099189-00-1033-7601.0000-1372014
Installation ID: 019832652832877450954954231002876846476415143363369025
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: W7CC3
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 5/19/2014 9:55:51 AM

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000010240
Event Time Stamp: 5:17:2014 21:43
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
Tampered File: %systemroot%\system32\drivers\spsys.sys


HWID Data-->
HWID Hash Current: MAAAAAEABAABAAEAAAABAAAAAQABAAEAln1ajyrA2oyAClTyEDOMaQCs/lVgu0Dp

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name	OEMID Value	OEMTableID Value
  APIC			ALASKA		A M I
  FACP			ALASKA		A M I
  HPET			ALASKA		A M I
  MCFG			ALASKA		A M I
  FPDT			ALASKA		A M I
  SSDT			AMD   		POWERNOW
  IVRS			AMD  		RD890S

NoelDP · 19 May 2014

You have a rare combination of errors.

Code:

File Scan Data-->
File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\slcext.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\drivers\spsys.sys[6.1.7127.0], Hr = 0x80092003
File Mismatch: C:\Windows\system32\drivers\spldr.sys[6.1.7127.0], Hr = 0x80092003

Please run a full CHKDSK and SFC scan....
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.
At the Command prompt, type
CHKDSK C: /R
and hit the Enter key.
You will be told that the drive is locked, and the CHKDSK will run at he next boot - hit the Y key, and then reboot.
The chkdsk will take a few hours depending on the size of the drive, so be patient!
After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot) - then run the SFC.
SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.
At the Command prompt, type
SFC /SCANNOW
and hit the Enter key
Wait for the scan to finish - make a note of any error messages - and then reboot.
Upload the CBS.log file (compressed, please!) to your OneDrive or DropBox Public folder, and post a link - also post a new MGADiag report.

firedrake1988 · 19 May 2014

https://onedrive.live.com/redir?resi...67FBCA1D%21129

OK there's the CBS.log no problems where found with the sfc

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE21
Cached Online Validation Code: N/A, hr = 0xc004f012
Windows Product Key: *****-*****-HVWYH-MBXKP-W7CC3
Windows Product Key Hash: 35e9sO363nLS1jXQZWfSbi1AQ1w=
Windows Product ID: 00359-114-0991896-85122
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {F23FA5BB-B372-493D-84EC-5932BEA95EA9}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130828-1532
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\Windows\system32\sppcext.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\slcext.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\drivers\spsys.sys[6.1.7127.0], Hr = 0x80092003
File Mismatch: C:\Windows\system32\drivers\spldr.sys[6.1.7127.0], Hr = 0x80092003

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{F23FA5BB-B372-493D-84EC-5932BEA95EA9}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-W7CC3</PKey><PID>00359-114-0991896-85122</PID><PIDType>5</PIDType><SID>S-1-5-21-2593155633-956918059-1567395968</SID><SYSTEM><Manufacturer>MSI</Manufacturer><Model>MS-7693</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>V2.6</Version><SMBIOSVersion major="2" minor="7"/><Date>20131008000000.000000+000</Date></BIOS><HWID>12E03D07018400FA</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: 2e7d060d-4714-40f2-9896-1e4f15b612ad
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00170-114-099189-00-1033-7601.0000-1372014
Installation ID: 019832652832877450954954231002876846476415143363369025
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: W7CC3
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 5/19/2014 3:44:56 PM

Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000010240
Event Time Stamp: N/A
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
Tampered File: %systemroot%\system32\slcext.dll|slcext.dll.mui
Tampered File: %systemroot%\system32\drivers\spsys.sys


HWID Data-->
HWID Hash Current: MAAAAAEABAABAAEAAAABAAAAAQABAAEAln1ajyrA2oyAClTyEDOMaQCs/lVgu0Dp

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name	OEMID Value	OEMTableID Value
  APIC			ALASKA		A M I
  FACP			ALASKA		A M I
  HPET			ALASKA		A M I
  MCFG			ALASKA		A M I
  FPDT			ALASKA		A M I
  SSDT			AMD   		POWERNOW
  IVRS			AMD  		RD890S

NoelDP · 20 May 2014

OK - that result was almost expected, as the error codes are more likely to be the result of registry problems.

Please download and save the CheckSUR tool from http://support.microsoft.com/kb/947821
(you'll need to look in the details for Windows 7, downloading from the Microsoft Download Center)

Run it - The tool can take anywhere from 5 mins to a couple of hours to run (or 'Install') depending on how much it has to do, and may exit silently - it may appear to freeze for most of that time, but be patient.
The result is logged in the C:\Windows\Logs\CBS\CheckSUR.log file - and an archive …\checksur.persist.log file

Then zip the CheckSUR.log and upload it to your reply

firedrake1988 · 20 May 2014

https://onedrive.live.com/redir?resi...67FBCA1D%21130

NoelDP · 20 May 2014

Nothing amiss there, either - this means that the problem almost certainly lies either in the registry or in permissions.
We'll have to see what we can find, the hard way.

Please open an Elevated COmmand Prompt, and run the following commands

DIR C:\Windows\sppcext.dll /S
ICACLS C:\Windows\System32\sppcext.dll
REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\spldr /S
REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\spsys
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR /S

Post the results.

Here are some instructions to make life easier :)
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

firedrake1988 · 20 May 2014

BTW thanks for your help so far. Here's the latest

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\Bug>DIR C:\Windows\sppcext.dll /S
Volume in drive C has no label.
Volume Serial Number is 5AE5-D46F

Directory of C:\Windows\System32

07/13/2009 06:41 PM 1,203,712 sppcext.dll
1 File(s) 1,203,712 bytes

Directory of C:\Windows\SysWOW64

07/13/2009 06:16 PM 1,111,552 sppcext.dll
1 File(s) 1,111,552 bytes

Directory of C:\Windows\winsxs\amd64_microsoft-windows-security-spp-clientext_3
1bf3856ad364e35_6.1.7600.16385_none_28bbe77bcacffbe4

07/13/2009 06:41 PM 1,203,712 sppcext.dll
1 File(s) 1,203,712 bytes

Directory of C:\Windows\winsxs\x86_microsoft-windows-security-spp-clientext_31b
f3856ad364e35_6.1.7600.16385_none_cc9d4bf812728aae

07/13/2009 06:16 PM 1,111,552 sppcext.dll
1 File(s) 1,111,552 bytes

Total Files Listed:
4 File(s) 4,630,528 bytes
0 Dir(s) 222,881,492,992 bytes free

C:\Users\Bug>ICACLS C:\Windows\System32\sppcext.dll
C:\Windows\System32\sppcext.dll NT SERVICE\TrustedInstaller

F)
BUILTIN\Administrators

RX)
NT AUTHORITY\SYSTEM

RX)
BUILTIN\Users

RX)

Successfully processed 1 files; Failed processing 0 files

C:\Users\Bug>REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\spldr /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\spldr
DisplayName REG_SZ Security Processor Loader Driver
ErrorControl REG_DWORD 0x3
Start REG_DWORD 0x0
Type REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\spldr\Enum
0 REG_SZ Root\LEGACY_SPLDR\0000
Count REG_DWORD 0x1
NextInstance REG_DWORD 0x1

C:\Users\Bug>REG QUERY HKLM\SYSTEM\CurrentControlSet\Services\spsys
ERROR: The system was unable to find the specified registry key or value.

C:\Users\Bug>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR
NextInstance REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000
Service REG_SZ spldr
Legacy REG_DWORD 0x1
ConfigFlags REG_DWORD 0x400
Class REG_SZ LegacyDriver
ClassGUID REG_SZ {8ECC055D-047F-11D1-A537-0000F8753ED1}
DeviceDesc REG_SZ Security Processor Loader Driver
Capabilities REG_DWORD 0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000\Control
ActiveService REG_SZ spldr

NoelDP · 20 May 2014

That all looks normal to me.
OPen an Elevated Command Prompt, and run the following commands.

DIR C:\Windows\sppcext.dll.mui /S
ICACLS C:\Windows\sppcext.dll.mui /T

post the results.

firedrake1988 · 20 May 2014

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\Bug>DIR C:\Windows\sppcext.dll.mui /S
Volume in drive C has no label.
Volume Serial Number is 5AE5-D46F

Directory of C:\Windows\System32\en-US

04/12/2011 01:17 AM 17,408 sppcext.dll.mui
1 File(s) 17,408 bytes

Directory of C:\Windows\SysWOW64\en-US

04/12/2011 01:17 AM 17,408 sppcext.dll.mui
1 File(s) 17,408 bytes

Directory of C:\Windows\winsxs\amd64_microsoft-windows-s..clientext.resources_3
1bf3856ad364e35_6.1.7600.16385_en-us_c2382769078e1059

04/12/2011 01:17 AM 17,408 sppcext.dll.mui
1 File(s) 17,408 bytes

Directory of C:\Windows\winsxs\x86_microsoft-windows-s..clientext.resources_31b
f3856ad364e35_6.1.7600.16385_en-us_66198be54f309f23

04/12/2011 01:17 AM 17,408 sppcext.dll.mui
1 File(s) 17,408 bytes

Total Files Listed:
4 File(s) 69,632 bytes
0 Dir(s) 222,883,553,280 bytes free

C:\Users\Bug>ICACLS C:\Windows\sppcext.dll.mui /T
C:\Windows\System32\en-US\sppcext.dll.mui NT SERVICE\TrustedInstaller

F)
BUILTIN\Administrators

RX)
NT AUTHORITY\SYSTEM

RX)
BUILTIN\Users

RX)

C:\Windows\System32\LogFiles\WMI\RtBackup\*: Access is denied.
Successfully processed 1 files; Failed processing 1 files

NoelDP · 20 May 2014

That also looks OK.
Puzzling! We don't often see this type of error not showing up fairly early in the discovery process

I think we'd better be looking for malware...

Please download and install Malwarebytes Anti-malware (free version) from http://www.malwarebytes.org/products/malwarebytes_free/ - UNtick 'Enable free trial of MBAM PRO' at the end of the installation - and update it, then run a full scan in your main account, and Quick scans in any other user accounts.

Delete everything it finds
Post a new MGADiag report.