This copy of Windows 7 is not genuine Build 7601

NoelDP · 03 Jan 2015

That brings us back to the error in report #1

(Have you EVER used Norton software on this machine?)
Please run the following commands, and post the results.

REG QUERY HKLM\SYSTEM\CurrentControlSet\services\spldr /S
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR /S
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SLSVC
REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SPPSVC

Here are some instructions to make life easier :)
1) To open an Elevated Command Prompt Window (the ECP window), click on Start, All Programs, Accessories – then right-click on Command Prompt, and select Run as Administrator. Accept the UAC prompt.
2) To run the commands easier, highlight the block of commands, and right-click on the highlight – select Copy. In the CP Window, click on the black/white icon at top left – select Paste. The commands will run but may not complete the last command, so hit the Enter Key once.
3) To copy the results... click on the Black/White icon in the top left, and select Edit... 'Select All', and hit the Enter key - then use Ctrl+V or r-click+Paste to paste it into your response.
They may show something

Drainbolt · 03 Jan 2015

Noel

Thank you for your reply..

As far as I can recall I have not used any Norton software on this PC.

Here are the results of the queries you asked me to run:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\services\spldr /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\spldr
DisplayName REG_SZ Security Processor Loader Driver
ErrorControl REG_DWORD 0x3
Start REG_DWORD 0x0
Type REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\spldr\Enum
0 REG_SZ Root\LEGACY_SPLDR\0000
Count REG_DWORD 0x1
NextInstance REG_DWORD 0x1

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPL
DR /S

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR
NextInstance REG_DWORD 0x1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000
Service REG_SZ spldr
Legacy REG_DWORD 0x1
ConfigFlags REG_DWORD 0x401
Class REG_SZ LegacyDriver
ClassGUID REG_SZ {8ECC055D-047F-11D1-A537-0000F8753ED1}
DeviceDesc REG_SZ Security Processor Loader Driver
Capabilities REG_DWORD 0x0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR\0000\Control

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SLS
VC
ERROR: The system was unable to find the specified registry key or value.

C:\Windows\system32>REG QUERY HKLM\SYSTEM\CurrentControlSet\Enum\Root\Legacy_SPP
SVC

I ran it more than once and each time there failed to be any response to the last of the four queries.

Thanks again for your help and your time.

NoelDP · 03 Jan 2015

Here's the root cause - it's typical of a post-Norton screwup - but I've seen ASC cause it before as well.

Code:

ConfigFlags REG_DWORD 0x401

Open Regedit and navigate to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPLDR Key

Export it to a reg file for safety!
Right-click on the key name, and Select Permissions,
Click on Advanced, then the Owner tab
Make sure that Administrators is the owner, and put a tick in the 'Replace owner...' box at the bottom
Click OK once
add Administrators to the 'Groups or Usernames' list, and give them Full permissions
CLICK OK
Now move to the 0000 subkey
Double-click on the ConfigFlags entry
Change the data value to 400 (make sure that the radio-button is in 'Hexadecimal') and click OK
Exit Regedit, and reboot twice

Post a new MGADiag report

Drainbolt · 04 Jan 2015

Thank you again Noel for your help. Having to date always shied away from making changes to the registry I have been a little nervous about proceeding without being sure of all the steps I need to take.

I followed your recipe so far but was intending to write seeking some reassurance before proceeding further, so I therefore decided to take screenshots of the various boxes as I moved through them.

I first saved the reg key to a reg file.

Screenshot 1

[IMG]file:///C:\Users\PRB\AppData\Local\Temp\msohtml1\01\clip_image002.jpg[/IMG]

Then I right-clicked on Legacy SPLDR and selected Permissions. This gave me
Screenshot 2

[IMG]file:///C:\Users\PRB\AppData\Local\Temp\msohtml1\01\clip_image003.jpg[/IMG]

Then clicked on Advanced, which gave me this:

Screenshot 3

[IMG]file:///C:\Users\PRB\AppData\Local\Temp\msohtml1\01\clip_image004.jpg[/IMG]

Then I clicked on the Owner tab. This gave me this:

Screenshot 4

[IMG]file:///C:\Users\PRB\AppData\Local\Temp\msohtml1\01\clip_image005.jpg[/IMG]

Adminstrators is the owner, so I ticked "Replace owner on subcontainers and objects" at the bottom and clicked OK. Then nothing happened.

I think it did when I first worked my way through the routine but it was at this point that I became unsure of how to proceed, and having decided to retrace to check the steps, I inadvertently clicked on "Replace all child object permissions with inheritable permissions from this object" from the previous screen, and found I could not get any further after I moved to the Owner tab, ticked "Replace owner on subcontainers and objects". and then OK.

I was and still am puzzled by the fact that in the "Permissions for Legacy SPLDR" box (screenshot 2), some of the tick boxes for Allow or Deny are preticked and greyed out. This applies for whichever of the group or user names is highlighted, including Administrators

Yesterday, I was also unclear where to find the 0000 subkey. However after sleeping on it, this morning it dawned on me that to get to that subkey, I needed to expand the entry for Legacy SPLDR in the registry editor screen shown in the first screenshot above. Then the rest of your routine became clear, and I completed it, I think, successfully. Anyhow I reran MGADiag.exe and now append the resulting diagnostic report.

Code:

Diagnostic Report (1.9.0027.0):
  -----------------------------------------
  Windows Validation Data-->
   
  Validation Code: 0
  Cached Online Validation Code: 0x0
  Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
  Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
  Windows Product ID: 00359-OEM-8992687-00006
  Windows Product ID Type: 2
  Windows License Type: OEM SLP
  Windows OS version: 6.1.7601.2.00010300.1.0.003
  ID: {AE1003E2-619B-4048-9598-C6F90248C48D}(3)
  Is Admin: Yes
  TestCab: 0x0
  LegitcheckControl ActiveX: N/A, hr = 0x80070002
  Signed By: N/A, hr = 0x80070002
  Product Name: Windows 7 Home Premium
  Architecture: 0x00000009
  Build lab: 7601.win7sp1_gdr.140706-1506
  TTS Error: 
  Validation Diagnostic: 
  Resolution Status: N/A
   
  Vista WgaER Data-->
  ThreatID(s): N/A, hr = 0x80070002
  Version: N/A, hr = 0x80070002
   
  Windows XP Notifications Data-->
  Cached Result: N/A, hr = 0x80070002
  File Exists: No
  Version: N/A, hr = 0x80070002
  WgaTray.exe Signed By: N/A, hr = 0x80070002
  WgaLogon.dll Signed By: N/A, hr = 0x80070002
   
  OGA Notifications Data-->
  Cached Result: N/A, hr = 0x80070002
  Version: N/A, hr = 0x80070002
  OGAExec.exe Signed By: N/A, hr = 0x80070002
  OGAAddin.dll Signed By: N/A, hr = 0x80070002
   
  OGA Data-->
  Office Status: 100 Genuine
  Microsoft Word 2002 - 100 Genuine
  OGA Version: N/A, 0x80070002
  Signed By: N/A, hr = 0x80070002
  Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-b01a_E2AD56EA-766-0_E2AD56EA-148-80004005_16E0B333-89-80004005_B4D0AA8B-1029-80004005
   
  Browser Data-->
  Proxy settings: N/A
  User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
  Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  Download signed ActiveX controls: Prompt
  Download unsigned ActiveX controls: Disabled
  Run ActiveX controls and plug-ins: Allowed
  Initialize and script ActiveX controls not marked as safe: Disabled
  Allow scripting of Internet Explorer Webbrowser control: Disabled
  Active scripting: Allowed
  Script ActiveX controls marked as safe for scripting: Allowed
   
  File Scan Data-->
   
  Other data-->
  Office Details: <GenuineResults><MachineData><UGUID>{AE1003E2-619B-4048-9598-C6F90248C48D}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-2364610701-1007709752-3769955550</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire M3910</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>P01-A3        </Version><SMBIOSVersion major="2" minor="6"/><Date>20100517000000.000000+000</Date></BIOS><HWID>5F123707018400FC</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{911B0409-6000-11D3-8CFE-0050048383[IMG]resource://skype_ff_extension-at-jetpack/skype_ff_extension/data/call_skype_logo.png[/IMG]0050048383[IMG]resource://skype_ff_extension-at-jetpack/skype_ff_extension/data/call_skype_logo.png[/IMG]0050048383[IMG]resource://skype_ff_extension-at-jetpack/skype_ff_extension/data/call_skype_logo.png[/IMG]0050048383[IMG]resource://skype_ff_extension-at-jetpack/skype_ff_extension/data/call_skype_logo.png[/IMG]0050048383C9}"><LegitResult>100</LegitResult><Name>Microsoft Word 2002</Name><Ver>10</Ver><Val>A445E3CEEDD9BF2</Val><Hash>OURolXztc+pHZKDC6mf94VI7e6c=</Hash><Pid>54189-OEM-1693002-08569</Pid><PidType>4</PidType></Product></Products><Applications><App Id="1B" Version="10" Result="100"/></Applications></Office></Software></GenuineResults>  
   
  Spsys.log Content: 0x80070002
   
  Licensing Data-->
  Software licensing service version: 6.1.7601.17514
   
  Name: Windows(R) 7, HomePremium edition
  Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
  Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
  Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
  Extended PID: 00359-00178-926-800006-02-2057-7601.0000-0042015
  Installation ID: 000802580412178553128364960321335161626152750543165923
  Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
  Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
  Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
  Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
  Partial Product Key: 7QJB7
  License Status: Licensed
  Remaining Windows rearm count: 3
  Trusted time: 04/01/2015 10:06:18
   
  Windows Activation Technologies-->
  HrOffline: 0x00000000
  HrOnline: 0x00000000
  HealthStatus: 0x0000000000000000
  Event Time Stamp: 1:3:2015 17:46
  ActiveX: Registered, Version: 7.1.7600.16395
  Admin Service: Registered, Version: 7.1.7600.16395
  HealthStatus Bitmask Output:
   
   
  HWID Data-->
  HWID Hash Current: MAAAAAEAAAABAAEAAQADAAAAAgABAAEA7r4OCISxaorO4FgY2jTvjaGFSslHnlxd
   
  OEM Activation 1.0 Data-->
  N/A
   
  OEM Activation 2.0 Data-->
  BIOS valid for OA 2.0: yes
  Windows marker version: 0x20001
  OEMID and OEMTableID Consistent: yes
  BIOS Information: 
    ACPI Table Name     OEMID Value  OEMTableID Value
    APIC                         ACRSYS                     APIC1139
    FACP                                    ACRSYS                     FACP1139
    HPET                         ACRSYS                     OEMHPET 
    MCFG                                   ACRSYS                     OEMMCFG 
    SLIC                          ACRSYS                     ACRPRDCT
    OEMB                                   ACRSYS                     OEMB1139
    ASF!                          LEGEND                     I865PASF
    GSCI                         ACRSYS                     GMCHSCI 
    AWMI                                   ACRSYS                     OEMB1139
    SSDT                         DpgPmm                      CpuPm

I hope all this is clear and not too much to wade through

Call
Send SMS
Add to Skype
You'll need Skype CreditFree via SkypeCall
Send SMS
Add to Skype
You'll need Skype CreditFree via SkypeCall
Send SMS
Add to Skype
You'll need Skype CreditFree via Skype

NoelDP · 04 Jan 2015

AYAYAYAYAYyyyyyy!!

'EVERYONE' should NEVER have permissions granted in the registry!
It's a guaranteed backdoor to malware and other nasties!
Where on earth did that setting come from?

MGADiag is now happy, at least, and you should o longer be seeing non-genuine notifications.

Drainbolt · 04 Jan 2015

Well, Noel. Windows Update seems to be working OK now, and the Windows Not Genuine message has gone, thank heavens, so I can only say how immensely grateful I am to you for holding my hand on this and seemingly resolving the issue. However, I'll leave it a couple of days before marking the thread as solved, just in case any gremlins emerge.

I have no idea where the Everyone permissions came from. I don't suppose I could ask you to tell me how to get rid of them?

NoelDP · 04 Jan 2015

You could, and I will - but I have to go out now, so it's likely to be tomorrow (and we need to check a few other details as well)

Glad everything is back on an even keel now!

Layback Bear · 04 Jan 2015

Good work men, it seem like things are getting fixed.

Note:
Things like permission to Everyone in registry could of been done by IOBits A.S.C.
No one really know all the things that program does. Removing such programs does not repair all the damage they have done.

Drainbolt · 10 Jan 2015

My Computer Properties window is now showing the MS "Genuine Windows" sticker and listing the computer's ID. Since also a few updates have come in, I am marking the thread as solved. So thanks again to Noel. If you can find time to advise on my Everyone permission issue (Posts #25 et al,) I'd be doubly grateful.