Windows not genuine after sfc /scannow following missing dnsapi.dll

jobucks · 18 Oct 2015

Code:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 50
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
Windows Product ID: 00359-OEM-8992687-00006
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {C7D6505C-8DBA-484C-87DC-095857A02694}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.150722-0600
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{C7D6505C-8DBA-484C-87DC-095857A02694}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-857474144-1243119279-4177950676</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire 5742</Model></SYSTEM><BIOS><Manufacturer>Acer</Manufacturer><Version>V1.15</Version><SMBIOSVersion major="2" minor="6"/><Date>20110121000000.000000+000</Date></BIOS><HWID>B3093B07018400FC</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0xC004F012' to display the error text.
Error: 0xC004F012 

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 9:24:2015 11:18
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MAAAAAEAAQABAAIAAAABAAAAAwABAAEAonYIihwpoMTmu85wMizsLB6LNgsI11xd

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            ACRSYS        ACRPRDCT
  FACP            ACRSYS        ACRPRDCT
  HPET            ACRSYS        ACRPRDCT
  BOOT            ACRSYS        ACRPRDCT
  MCFG            ACRSYS        ACRPRDCT
  ASF!            ACRSYS        ACRPRDCT
  SLIC            ACRSYS        ACRPRDCT
  ASPT            ACRSYS        ACRPRDCT
  SSDT            PmRef        CpuPm
  SSDT            PmRef        CpuPm
  SSDT            PmRef        CpuPm

========
I would be very grateful for any guidance.

The order of events (if relevant) were as follows.
1. After 2 weeks of being shutdown, a string of updates (including a Firefox update) led to browsers (except an old copy of Opera) not working, Firefox crashing, and Skype reporting missing dnsapi.dll. I could ping a site through the command window.
2. A system restore and re installing of Firefox brought everything back but the updates on shutdown made the problem worse.
3. Rolling back to before the two week shutdown (when everything worked) kept the dnsapi.dll missing and now all browsers not working. A reinstall of Firefox did not help.
4. sfc /scannow brought up the non genuine message and killed the internet connection (unable to ping).

I am out of my depth and will appreciate any help. It is around 10.30pm UK time and I will look out for a reply tomorrow. Thank you.
Jo

Layback Bear · 18 Oct 2015

What operating system did your computer come with?

Did you run sfc /scannow exactly as this tutorial instructs.

SFC /SCANNOW Command - System File Checker

Don't forget to reboot between each scan.

It might also help to do this.

At the Command prompt, type

CHKDSK C: /R

and hit the Enter key.
You will be told that the drive is locked,
and the CHKDSK will run at he next boot - hit the Y key, press Enter, and then reboot.

The CHKDSK will take a few hours depending on the size of the drive, so be patient!

This is what I found in your log.

On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0xC004F012' to display the error text.

Note:
I'm no expert on such matters. My suggestion are to do some basics before our expert Noel sees your thread. He is a little under the Weather at this time.

jobucks · 19 Oct 2015

I forgot to mention that I had tried to restore to an earlier point - I forget which - the restore hung and I had to switch off the machine. The machine rebooted into safe mode and checked the disk. All good.

sfs /scannow and subsequent correction is what produces the not genuine message.

I can find the sfc log but cannot open or copy it even in elevated command as administrator.

Should I run slui.exe? To be honest I am not sure where to find it and I am reluctant to fiddle. I am at the point of being so lost that it is better to stand still and ask for directions.

Much obliged for your quick reply and very grateful for any assistance.

Jo

NoelDP · 19 Oct 2015

slui.exe can't work until the problems are fixed.

Please follow the Windows Update Posting Instructions
and post the requested data

If the file is too large (8MB compressed), remove the older CBSPersist cab files until the final file is below the limit - you can always post them separately after zipping them. (the forum doesn't allow the upload of bare CAB files, for a number of reasons)

Please also post the C:\Windows\windowsudpate.log file

jobucks · 19 Oct 2015

Thank you very much for your prompt and structured reply.

SURT successfully downloaded KB947821 but the 'title' on the Window said the optional updating was not working. 7 updates and 3 updates were pending. I wasn't sure which way to jump. I ran the updates and it failed with error 8024402C.

sfc /scannow verified successfully.

I have attached the CBS.log as a zip file. The upload is resetting so I have taken out the Persist rar files and will try to load them one by one.

jobucks · 19 Oct 2015

additional cbs logsnm are failing - if you need them too, I will need to research how to convert them to .zip.

Thankyou you again,
Jo

NoelDP · 19 Oct 2015

Here's the error list from the CheckSUR log...

Code:

Summary:
Seconds executed: 3011
 Found 1 errors
  CBS Catalog Missing Total count: 1

Unavailable repair files:
	servicing\packages\Package_for_KB3035583_RTM~31bf3856ad364e35~amd64~~6.1.2.13.mum
	servicing\packages\Package_for_KB3035583_RTM~31bf3856ad364e35~amd64~~6.1.2.13.cat

... which is interesting, since I thought that this update wasn't supposed to install into pre-SP1 machines!
I'll see if I can find the right file versions for you and post them when I can.

NoelDP · 19 Oct 2015

(I don't believe these errors are related to your non-genuine problems, but they need fixing anyhow!)

I've uploaded a file - jbsaa.zip - to my OneDrive at Noel's OneDrive
Please download and save it.
Right-click on the downloaded file, and select Extract all…
Extract to the default location - which will create a new folder jbsaa in the same place.
Open this folder - there should be one folder inside it (Packages)

Copy the content of the Packages folder to the folder
C:\Windows\Temp\CheckSur\Servicing\Packages

Now run the CheckSUR tool again (it may take a while)

Post the new CheckSUR.log file, and the CheckSUR.persist.log file.

ALSO - Open Event Viewer
click on the Windows logs entry in the left pane to expand it.
Now click on the Application entry - wait while it loads.
Click on 'File' in the menu bar and select Save...
Save the file as Appevt.evtx
Repeat for the System log
then zip both, and upload them.

jobucks · 20 Oct 2015

Thank you again for the quick and structure reply.

Attached are the CheckSur and Event logs.

NoelDP · 20 Oct 2015

Strange - the CheckSUR doesn't appear to have completed the job properly

- ot only replaced the CAT file, not the associated MUM file.
Please repeat the entire process (apart from the Event logs) and post the new CheckSUR log

I'll take a look at the event logs later.

Windows not genuine after sfc /scannow following missing dnsapi.dll

Windows not genuine after sfc /scannow following missing dnsapi.dll

Answers to above

CheckSur Logs and Event Logs as requested