This copy of Windows is not genuine, after several years of use.

henry b · 12 Jun 2014

Started the PC yesterday and got a message that my copy of Windows is not genuine, after several years of use. Have tried some steps I found online but generally come up with errors in activation (0x80070005). Last thing I did with the computer before this was install Comodo backup. Tried restoring to earlier backup but problem persists. Have tried Microsoft support but can never get through after extremely long waits. Any help?

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 50
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-C7PT6-T7Q43-37TWY
Windows Product Key Hash: BZGEh307IE7ot1Mc48A3z0U2VUM=
Windows Product ID: 00371-OEM-9044783-44686
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {444EA451-1599-42ED-BA99-F61698E15254}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.140303-2144
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{444EA451-1599-42ED-BA99-F61698E15254}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-37TWY</PKey><PID>00371-OEM-9044783-44686</PID><PIDType>3</PIDType><SID>S-1-5-21-1890358910-3633621195-848419343</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>2105</Version><SMBIOSVersion major="2" minor="6"/><Date>20111128000000.000000+000</Date></BIOS><HWID>9EA33707018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
C:\Windows\system32\slmgr.vbs(1333, 5) Microsoft VBScript runtime error: Permission denied

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0xC004C533
HealthStatus: 0x0000000000000000
Event Time Stamp: 6:12:2014 19:05
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MAAAAAEAAAABAAEAAgACAAAAAgABAAEAln1W6eK99lVqxKyL7LlQGkdVjgNapS5z

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            ALASKA        A M I
  FACP            ALASKA        A M I
  HPET            ALASKA        A M I
  MCFG            ALASKA        A M I
  SSDT            AMICPU        PROC

NoelDP · 13 Jun 2014

Licensing Data-->
C:\Windows\system32\slmgr.vbs(1333, 5) Microsoft VBScript runtime error: Permission denied

This can be caused by a number of things - top of the list is an over-zealous security application.

What AV is currently installed?
What other security software is installed?
What other AV's have EVER been installed on this machine?

henry b · 13 Jun 2014

I currently use Avast AV and Comodo Firewall. I also periodically scan with Spybot, Windows Defender, Superantispyware, Malwarebytes, and Spywareblaster, though none of those should be running any active protection.

NoelDP · 13 Jun 2014

Avast can cause this type of thing - rarely. Comodo I'm not familiar enough with to be able to comment, but the last time I attempted to sue it I really disliked it (a good few years ago now!).

The others can be ignored for the moment
Is Avast the only AV you've run since the last reformat?

Perhaps the Event logs will show what's happening...

Open Event Viewer
click on the Windows logs entry in the left pane to expand it.
Now click on the Application entry - wait while it loads.
Click on 'File' in the menu bar and select Save...
Save the file as Appevt.evtx
Repeat for the System log
then zip both, and upload them.

henry b · 13 Jun 2014

I can't remember if I had Norton AV and ZoneAlarm on this computer years ago. I don't think so, but it's been a while.

NoelDP · 14 Jun 2014

You appear to have a mess of problems in the Networking area.

Please open Device Manager
Click on the View option in the menu bar, and click on the Show hidden Devices option.
Now look for and uninstall/delete all entries with yellow triangles or red crosses.
Uninstall the following two devices (flagged or not!)
Intel(R) 82579V Gigabit Network Connection
Intel(R) 82583V Gigabit Network Connection

reboot and allow Windows to reinstall what it needs to - wait a few minutes and then reboot again.

Then open an Elevated Command Prompt, and run the following commands...

SC QUERYEX LanmanServer
SC QUERYEX srv
SC QUERYEX srv2
SC QUERYEX browser
SC QUERYEX fdphost
SC QUERYEX LanmanWorkstation

Here are some instructions to make life easier :)
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.

henry b · 14 Jun 2014

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>SC QUERYEX LanmanServer

SERVICE_NAME: LanmanServer
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 1324
FLAGS :

C:\Windows\system32>SC QUERYEX srv

SERVICE_NAME: srv
TYPE : 2 FILE_SYSTEM_DRIVER
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>SC QUERYEX srv2

SERVICE_NAME: srv2
TYPE : 2 FILE_SYSTEM_DRIVER
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>SC QUERYEX browser

SERVICE_NAME: browser
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 1324
FLAGS :

C:\Windows\system32>SC QUERYEX fdphost

SERVICE_NAME: fdphost
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 1264
FLAGS :

C:\Windows\system32>SC QUERYEX LanmanWorkstation

SERVICE_NAME: LanmanWorkstation
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 4 RUNNING
(STOPPABLE, PAUSABLE, IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 1132
FLAGS :

C:\Windows\system32>

NoelDP · 14 Jun 2014

?? they all look normal (now, at least)

How many entries did you have to remove?

Please run another MGADiag report, and post the new log

henry b · 14 Jun 2014

I removed the two Intel Gigabit Network Connections you indicated and a Portable Devices: F:\ (which I think corresponds to the printer's card slot). Nothing else had abnormal icons.

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 50
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-C7PT6-T7Q43-37TWY
Windows Product Key Hash: BZGEh307IE7ot1Mc48A3z0U2VUM=
Windows Product ID: 00371-OEM-9044783-44686
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {444EA451-1599-42ED-BA99-F61698E15254}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.140303-2144
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{444EA451-1599-42ED-BA99-F61698E15254}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-37TWY</PKey><PID>00371-OEM-9044783-44686</PID><PIDType>3</PIDType><SID>S-1-5-21-1890358910-3633621195-848419343</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>2105</Version><SMBIOSVersion major="2" minor="6"/><Date>20111128000000.000000+000</Date></BIOS><HWID>9EA33707018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
C:\Windows\system32\slmgr.vbs(1333, 5) Microsoft VBScript runtime error: Permission denied

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0xC004F022
HealthStatus: 0x0000000000000000
Event Time Stamp: 6:12:2014 22:07
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MAAAAAEAAAABAAEAAgACAAAAAgABAAEAln1W6eK99lVqxKyL7LlQGkdVjgNapS5z

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            ALASKA        A M I
  FACP            ALASKA        A M I
  HPET            ALASKA        A M I
  MCFG            ALASKA        A M I
  SSDT            AMICPU        PROC

NoelDP · 14 Jun 2014

OK- that's not changed the report...
Let's see what running a cleanup for your potential past AV's does...
Download the ZoneAlarm cleanup tool from http://download.zonealarm.com/bin/fr...load/clean.exe - run it, and follow any instructions, then reboot.

Download the Norton Removal Tool from here https://www-secure.symantec.com/norton-support/jsp/help-solutions.jsp?lg=english&ct=united+states&docid=20080710133834EN&product=home&version=1&pvid=f-home

Close all other programs, then run the tool. When it's complete, reboot the machine whether it asks for it or not.

After the reboot, open an Elevated Command Prompt, and run the following command

NETSH WINSOCK RESET

You'll be advised to reboot - do so.
then post another MGADiag report.