Windows 7 x64 MAK Key Activated but Error 0x8004fe22

Aiphix · 06 Dec 2014

I have activated several brand new HP Elite 800 G1 desktops for a test lab. They are all activated on a valid MAK key. They were all activated and working perfectly for several weeks when all of a sudden they all started popping error 0x8004fe22 "This computer is not running genuine Windows" on reboot. They are still reporting that they are indeed activated in system properties yet the error still occurs. I have worked through several solutions on the internet and managed to eliminate all but 1 error in the MGADiag report. I simply cannot figure out the last mismatched / tampered file. Please assist.

Aiphix · 06 Dec 2014

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE22
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-*****-*****-R79DV
Windows Product Key Hash: Y3usLHuWD6K7/rqVnWBjTveAx5g=
Windows Product ID: 55041-034-5276843-86257
Windows Product ID Type: 6
Windows License Type: Volume MAK
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {AA93595E-E9A6-4464-B5D6-0A75438597E0}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.140706-1506
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\windows\system32\sppuinotify.dll[Hr = 0x80092003]

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{AA93595E-E9A6-4464-B5D6-0A75438597E0}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-BBBBB</PKey><PID>55041-034-5276843-86257</PID><PIDType>6</PIDType><SID>S-1-5-21-3996398734-2805193017-3448567933</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>HP EliteDesk 800 G1 DM</Model></SYSTEM><BIOS><Manufacturer>Hewlett-Packard</Manufacturer><Version>L04 v02.02</Version><SMBIOSVersion major="2" minor="7"/><Date>20140318000000.000000+000</Date></BIOS><HWID>28353807018400F4</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-BPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, VOLUME_MAK channel
Activation ID: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 55041-00172-034-527684-03-1033-7601.0000-3342014
Installation ID: 012074103405575120205700585213940051224270314345496000
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: R79DV
License Status: Licensed
Remaining Windows rearm count: 1
Trusted time: 12/6/2014 10:21:00 AM

Windows Activation Technologies-->
HrOffline: 0x8004FE22
HrOnline: N/A
HealthStatus: 0x0000000000000400
Event Time Stamp: 12:5:2014 17:49
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui


HWID Data-->
HWID Hash Current: NAAAAAEAAQABAAEAAQACAAAABAABAAEAHKLevU40XJE+edLm3oggYLPGUmdMnMgVRKrI9g==

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            HPQOEM        SLIC-BPC
  FACP            HPQOEM        SLIC-BPC
  HPET            HPQOEM        SLIC-BPC
  MCFG            HPQOEM        SLIC-BPC
  FPDT            HPQOEM        SLIC-BPC
  SSDT            PmRef        Cpu0Ist
  SSDT            PmRef        Cpu0Ist
  SSDT            PmRef        Cpu0Ist
  SSDT            PmRef        Cpu0Ist
  SSDT            PmRef        Cpu0Ist
  SSDT            PmRef        Cpu0Ist
  SLIC            HPQOEM        SLIC-BPC
  MSDM            HPQOEM        SLIC-BPC
  ASF!            INTEL          HCG
  TCPA            APTIO4        NAPAASF

NoelDP · 07 Dec 2014

File Scan Data-->
File Mismatch: C:\windows\system32\sppuinotify.dll[Hr = 0x80092003]

Tampered File: %systemroot%\system32\sppuinotify.dll|sppuinotify.dll.mui

SFC -System File Checker - Instructions
Click on Start > All Programs > Accessories
Right-click on the Command Prompt entry
Select Run as Administrator and accept the UAC prompt - the Elevated Command Prompt window should pop up.
At the Command prompt, type
SFC /SCANNOW
and hit the Enter key
Wait for the scan to finish - make a note of any error messages - and then reboot.

Upload the CBS.log file (compressed, please!) to your reply.

Aiphix · 07 Dec 2014

SFC Results:

"Beginning system scan. This process will take some time.

Beginning verification phase of system scan.
Verification 100% complete.
Windows Resource Protection found corrupt files but was unable to fix some of th
em.
Details are included in the CBS.Log windir\Logs\CBS\CBS.log. For example
C:\Windows\Logs\CBS\CBS.log"

Thank you for your help!

NoelDP · 07 Dec 2014

Here's the SFC summary...

Code:

 Line 3567: 2014-12-07 09:02:30, Info                  CSI    0000033d [SR] Repairing 1 components
 Line 3568: 2014-12-07 09:02:30, Info                  CSI    0000033e [SR] Beginning Verify and Repair transaction
 Line 3571: 2014-12-07 09:02:30, Info                  CSI    00000340 [SR] Cannot repair member file [l:30{15}]"sppuinotify.dll" of Microsoft-Windows-Security-SPP-UX, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 3574: 2014-12-07 09:02:30, Info                  CSI    00000342 [SR] Cannot repair member file [l:30{15}]"sppuinotify.dll" of Microsoft-Windows-Security-SPP-UX, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

The SHA hashes are notably different...

Code:

  Found: {l:32 b:4RZebu1ZgOjgLjLlU3fxmpfPX7OtexbUVYUug+tD6xU=} Expected: {l:32 b:NtSLI7gkO+Uilwc3X80RwtyslpgxmTRTZfBloMvzMxQ=}

I'll post a fix protocol for this later - but you should check your master install for problems.

NoelDP · 07 Dec 2014

I've uploaded a file - apxaa.zip - to my OneDrive at Noel's OneDrive
Please download and save it.

Right-click on the saved file and select Extract all...
Change the target to C:\ and click on Extract
Close all windows (it would be a good idea to print these instructions!)

Now reboot to the Repair Environment - as soon as the machine restarts, start tapping F8 - this should bring up the Advanced Boot Menu, at the top of which should be the option 'Repair my Computer'
Pick that
You'll have to log in with your username and password.

Pick the option to use a Command Prompt
At the prompt type
DIR C:\apxaa
hit the enter key - if you get a 'Not Found' error try
DIR D:\apxaa
or
DIR E:\apxaa

The drive letter in use when you find the folder will need to be substituted (for<drive>) into the following command...

XCOPY <drive>:\apxaa <drive>:\windows\winsxs /y /i /s /v /h

(e.g. XCOPY P:\wfire P:\windows\winsxs /y /i /s /v /h )

run the command (it should take almost no time) and when the prompt returns, type
EXIT
and hit the Enter key to exit Command Prompt - reboot to Normal Mode Windows.

Now run SFC /SCANNOW in an Elevated Command Prompt
then reboot and upload the new CBS.log file to your reply

Aiphix · 09 Dec 2014

Thank you for this solution. Would there be anyway to do this without rebooting to a repair environment, IE remotely?

We have already rebuilt the master image but I have a feeling this may have something to do with the embedded windows key on the machine and it may reoccur.

NoelDP · 09 Dec 2014

I can say that it has nothing whatever to do with the Key itself.

It's possible to do the substitution manually in normal mode Windows, by taking ownership of the affected subfolder, then giving yourself permissions on the folder and content, and then doing the substitution.
You then need to set the folder and content permissions back to normal and restore ownership to the TrustedInstaller entity.

You may be able to script it if you have a number of machines to do - but that is beyond my knowledge

Aiphix · 10 Dec 2014

Your files fixed the issue! Thank you so much for your help. SFC comes back with no errors.