Windows 7 suddenly 'not genuine'

NoelDP · 08 Oct 2014

You're right - no clues there!

Back to the CBS files...

The error I spotted there was this one...

Code:

2014-10-06 03:04:00, Info                  CBS    Failed to persist package: Package_1_for_KB2937610~31bf3856ad364e35~x86~~6.1.1.3. [HRESULT = 0x8e5e03fe - JET_errDiskIO]
2014-10-06 03:04:00, Info                  CBS    Failed to update states and store all resolved packages. [HRESULT = 0x8e5e03fe - JET_errDiskIO]
2014-10-06 03:04:00, Info                  CSI    0000000c@2014/10/6:10:04:00.468 CSI Transaction @0xc3f6010 destroyed
2014-10-06 03:04:00, Info                  CBS    Perf: Resolve chain complete.
2014-10-06 03:04:00, Info                  CBS    Failed to resolve execution chain. [HRESULT = 0x8e5e03fe - JET_errDiskIO]
2014-10-06 03:04:00, Error                 CBS    Failed to process single phase execution. [HRESULT = 0x8e5e03fe - JET_errDiskIO]

I think this means that the update database is corrupted - if that's the case then this should help:

Open and Elevated Command Prompt and run the following commands

NET STOP CRYPTSVC
esentutl /p %systemroot%\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
NET START CRYPTSVC

WAIT 10 minutes after the command prompt has returned, then reboot - post a new MGADiag report, and the results of the following commands...

SC QC SPLDR
SC QC SPPSVC
SC QC SPSYS

timh · 08 Oct 2014

The esentutl repair completed. Waiting 10 minutes then rebooted.

Results of the three commands are:

C:\Windows\system32>SC QC SPLDR
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: SPLDR
TYPE : 1 KERNEL_DRIVER
START_TYPE : 0 BOOT_START
ERROR_CONTROL : 3 CRITICAL
BINARY_PATH_NAME :
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Security Processor Loader Driver
DEPENDENCIES :
SERVICE_START_NAME :

C:\Windows\system32>SC QC SPPSVC
[SC] QueryServiceConfig SUCCESS
SERVICE_NAME: SPPSVC
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START (DELAYED)
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\sppsvc.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Software Protection
DEPENDENCIES : RpcSs
SERVICE_START_NAME : NT AUTHORITY\NetworkService

C:\Windows\system32>SC QC SPSYS
[SC] OpenService FAILED 1060:
The specified service does not exist as an installed service.

C:\Windows\system32>

New MGADiag report below.

Code:

 
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-R67QQ-FVRHP-RTWPQ
Windows Product Key Hash: 5VG8JXYk5mJ3Apowk8gf75ZWYZU=
Windows Product ID: 00426-292-6704362-85743
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {999B0C14-B4FC-4070-A315-7AC80282BDE2}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.140303-2144
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: 2.0.48.0
OGAExec.exe Signed By: Microsoft
OGAAddin.dll Signed By: Microsoft
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Standard 2007 - 100 Genuine
OGA Version: Registered, 2.0.48.0
Signed By: Microsoft
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-b01a_E2AD56EA-766-0_E2AD56EA-148-80004005_16E0B333-89-80004005_B4D0AA8B-1029-80004005
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{999B0C14-B4FC-4070-A315-7AC80282BDE2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-RTWPQ</PKey><PID>00426-292-6704362-85743</PID><PIDType>5</PIDType><SID>S-1-5-21-367005675-1604576647-2706173860</SID><SYSTEM><Manufacturer>Dell Inc</Manufacturer><Model>Dimension E521</Model></SYSTEM><BIOS><Manufacturer>Dell Inc</Manufacturer><Version>1.1.4 </Version><SMBIOSVersion major="2" minor="4"/><Date>20061209000000.000000+000</Date></BIOS><HWID>7F2C3007018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>bMk    </OEMTableID></OEM><GANotification><File Name="OGAAddin.dll" Version="2.0.48.0"/></GANotification></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0012-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Standard 2007</Name><Ver>12</Ver><Val>901B47A3201FF0C</Val><Hash>HvOn6d5l4EDglSP4cDMPwGHHlMA=</Hash><Pid>81607-902-8968713-64126</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00170-292-670436-00-1033-7600.0000-3392009
Installation ID: 015445376991638962682430117474827122295592476543846370
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: RTWPQ
License Status: Licensed
Remaining Windows rearm count: 5
Trusted time: 10/8/2014 9:19:32 PM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000010040
Event Time Stamp: 10:5:2014 11:58
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
Tampered File: %systemroot%\system32\drivers\spsys.sys

HWID Data-->
HWID Hash Current: LAAAAAEAAAABAAEAAgABAAAAAQABAAEAeqi2nDqlqkdYdFbKXN4m2qiMjrY=
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x0
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name OEMID Value OEMTableID Value
  APIC   DELL    bMk    
  FACP   DELL    bMk    
  HPET   DELL    bMk    
  BOOT   DELL    bMk    
  MCFG   DELL    bMk    
  SLIC   DELL    bMk

NoelDP · 09 Oct 2014

That gives us a little more data to work with...

Code:

Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
Tampered File: %systemroot%\system32\drivers\spsys.sys

The output from the commands is normal.

Open Event Viewer
click on the Windows logs entry in the left pane to expand it.
Now click on the Application entry - wait while it loads.
Click on 'File' in the menu bar and select Save...
Save the file as Appevt.evtx
Repeat for the System log
then zip both, and upload them.

timh · 09 Oct 2014

Hi Noel,
Thanks for your continued help with this. Glanced through the logs, attached, and there's some events in the app log regarding activation health check failures. Saw some NTFS corruption errors in the system log back a few days as well. I suppose that could be the root cause of this.

Thanks,
Tim

NoelDP · 09 Oct 2014

The NTFS problem seems to have started on 2nd October.

It seems to relate to ShadowCopy, though - and I'm not sure how. Perhaps best to do a full CHKDSK and see if it finds anything significant.

Please run a full CHKDSK and SFC scan....
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.
At the Command prompt, type
CHKDSK C: /R
and hit the Enter key.
You will be told that the drive is locked, and the CHKDSK will run at the next boot - hit the Y key, and then reboot.
The CHKDSK will take a few hours depending on the size of the drive, so be patient!
After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot)

Run a new MGADiag report and post the result

timh · 10 Oct 2014

Didn't see anything in the chkdsk in the first four phases. I didn't watch it through the free space check as that took hours to complete. SFC ran without errors. MGADiag results below.

Code:

 
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-R67QQ-FVRHP-RTWPQ
Windows Product Key Hash: 5VG8JXYk5mJ3Apowk8gf75ZWYZU=
Windows Product ID: 00426-292-6704362-85743
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {999B0C14-B4FC-4070-A315-7AC80282BDE2}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.140303-2144
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: 2.0.48.0
OGAExec.exe Signed By: Microsoft
OGAAddin.dll Signed By: Microsoft
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Standard 2007 - 100 Genuine
OGA Version: Registered, 2.0.48.0
Signed By: Microsoft
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-b01a_E2AD56EA-766-0_E2AD56EA-148-80004005_16E0B333-89-80004005_B4D0AA8B-1029-80004005
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{999B0C14-B4FC-4070-A315-7AC80282BDE2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-RTWPQ</PKey><PID>00426-292-6704362-85743</PID><PIDType>5</PIDType><SID>S-1-5-21-367005675-1604576647-2706173860</SID><SYSTEM><Manufacturer>Dell Inc</Manufacturer><Model>Dimension E521</Model></SYSTEM><BIOS><Manufacturer>Dell Inc</Manufacturer><Version>1.1.4 </Version><SMBIOSVersion major="2" minor="4"/><Date>20061209000000.000000+000</Date></BIOS><HWID>7FB03307018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Pacific Standard Time(GMT-08:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>DELL  </OEMID><OEMTableID>bMk    </OEMTableID></OEM><GANotification><File Name="OGAAddin.dll" Version="2.0.48.0"/></GANotification></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-0012-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Standard 2007</Name><Ver>12</Ver><Val>901B47A3201FF0C</Val><Hash>HvOn6d5l4EDglSP4cDMPwGHHlMA=</Hash><Pid>81607-902-8968713-64126</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1A" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/></Applications></Office></Software></GenuineResults>  
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00170-292-670436-00-1033-7600.0000-3392009
Installation ID: 015445376991638962682430117474827122295592476543846370
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: RTWPQ
License Status: Licensed
Remaining Windows rearm count: 5
Trusted time: 10/10/2014 7:36:25 AM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000010040
Event Time Stamp: 10:9:2014 03:46
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppcext.dll|sppcext.dll.mui
Tampered File: %systemroot%\system32\drivers\spsys.sys

HWID Data-->
HWID Hash Current: LAAAAAEAAAABAAEAAgABAAAAAQABAAEAeqi2nDqlqkdYdFbKXN4m2qiMjrY=
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x0
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name OEMID Value OEMTableID Value
  APIC   DELL    bMk    
  FACP   DELL    bMk    
  HPET   DELL    bMk    
  BOOT   DELL    bMk    
  MCFG   DELL    bMk    
  SLIC   DELL    bMk

NoelDP · 11 Oct 2014

I'm having problems trying to work out why MGADiag is seeing these files as being tampered, when SFC says they aren't - it could be that it's actually the registry entries relating to them are broken....
Let's have a look...

Open an Elevated Command Prompt, and run the following commands...

Code:

REG LOAD HKLM\COMPONENTS C:\Windows\System32\config\COMPONENTS
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft-windows-security-spp-clientext_31bf3856ad364e35_none_fec4df291f9d1095" >> "%userprofile%\desktop\sppcext.txt"
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft-windows-s..clientext.resources_31bf3856ad364e35_en-us_1b9f68ef6e329c88" >> "%userprofile%\desktop\sppcext.txt"
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-security-spp-clientext_31bf3856ad364e35_none_5ae37aacd7fa81cb" >> "%userprofile%\desktop\sppcext.txt"
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-s..clientext.resources_31bf3856ad364e35_en-us_77be047326900dbe" >> "%userprofile%\desktop\sppcext.txt"
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-security-spp-clientext_31bf3856ad364e35_6.1.7600.16385_none_cc9d4bf812728aae" >> "%userprofile%\desktop\sppcext.txt"
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_microsoft-windows-s..clientext.resources_31bf3856ad364e35_6.1.7600.16385_en-us_66198be54f309f23" >> "%userprofile%\desktop\sppcext.txt"
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-security-spp-clientext_31bf3856ad364e35_6.1.7600.16385_none_28bbe77bcacffbe4" >> "%userprofile%\desktop\sppcext.txt"
REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_microsoft-windows-s..clientext.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c2382769078e1059" >> "%userprofile%\desktop\sppcext.txt"
REG UNLOAD HKLM\COMPONENTS
 
.

Here are some instructions to make life easier :)
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.

This will create a file 'sppcext.txt' on your desktop - please attach that file to your reply, and we'll see if there's a problem somewhere there.

timh · 11 Oct 2014

Here you go

timh · 11 Oct 2014

Also, looks like it couldn't find some of the keys. Results of the commands is below.

Code:

 
C:\temp>REG LOAD HKLM\COMPONENTS C:\Windows\System32\config\COMPONENTS
The operation completed successfully.
C:\temp>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.
7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft-windows-sec
urity-spp-clientext_31bf3856ad364e35_none_fec4df291f9d1095" >> "%userprofile%\de
sktop\sppcext.txt"
C:\temp>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.
7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\x86_microsoft-windows-s..
clientext.resources_31bf3856ad364e35_en-us_1b9f68ef6e329c88" >> "%userprofile%\d
esktop\sppcext.txt"
C:\temp>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.
7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-s
ecurity-spp-clientext_31bf3856ad364e35_none_5ae37aacd7fa81cb" >> "%userprofile%\
desktop\sppcext.txt"
ERROR: The system was unable to find the specified registry key or value.
C:\temp>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\VersionedIndex\6.1.
7601.17592 (win7sp1_gdr.110408-1631)\ComponentFamilies\amd64_microsoft-windows-s
..clientext.resources_31bf3856ad364e35_en-us_77be047326900dbe" >> "%userprofile%
\desktop\sppcext.txt"
ERROR: The system was unable to find the specified registry key or value.
C:\temp>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_micr
osoft-windows-security-spp-clientext_31bf3856ad364e35_6.1.7600.16385_none_cc9d4b
f812728aae" >> "%userprofile%\desktop\sppcext.txt"
C:\temp>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\x86_micr
osoft-windows-s..clientext.resources_31bf3856ad364e35_6.1.7600.16385_en-us_66198
be54f309f23" >> "%userprofile%\desktop\sppcext.txt"
C:\temp>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_mi
crosoft-windows-security-spp-clientext_31bf3856ad364e35_6.1.7600.16385_none_28bb
e77bcacffbe4" >> "%userprofile%\desktop\sppcext.txt"
ERROR: The system was unable to find the specified registry key or value.
C:\temp>REG QUERY "HKEY_LOCAL_MACHINE\COMPONENTS\DerivedData\Components\amd64_mi
crosoft-windows-s..clientext.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c23
82769078e1059" >> "%userprofile%\desktop\sppcext.txt"
ERROR: The system was unable to find the specified registry key or value.
C:\temp>REG UNLOAD HKLM\COMPONENTS
The operation completed successfully.

NoelDP · 11 Oct 2014

That's not too surprising - many of the Keys won't exist if the OS was installed using SP1 media, or the Cleanup tool has been used to remove backup files.

It'll take me a while to figure out what's really wrong here (if anything!)

back tomorrow!