Windows activation providing error code 0x80070005 (Access is denied)

So I am having a rather unusual issue here....

I have been fixing up a computer which was loaded with malware/viruses. I have run the below software programs to help clean up the system:
- Malwarebytes Anti-Malware
- Super Anti-Spyware
- HiJack This

After cleaning it up, I am running into one additional issue which is flagging my system as not being genuine

The system was purchased with a valid license key for Windows 7 Home Premium 64-bit.

My thought here is that there is still some rootkit or rogue malware running which is preventing me access to this file. It is preventing access to other system files such as the hosts file, the ability to start/stop services through the services.msc console, etc.

Couple of things I have tried to resolve this:
- Microsoft support KB article 2008385 = https://support.microsoft.com/en-us/kb/2008385
- Disabled Plug N Play service within registry through CMD command
- Enabled Administrator account to attempt activation

After attempting these steps and performing a reboot, I am still unable to get around this unusual activation error. Please help!

Also provided is my MGADiag results from the infected system:



Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 50
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-73CQT-WMF7J-3Q6C9
Windows Product Key Hash: KaFG+RmurcM3ZxzWyfEP9WtPUJw=
Windows Product ID: 00359-OEM-8992687-00010
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {51482646-6E61-4A0A-B81F-423BF58A8C0F}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.151019-1254
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{51482646-6E61-4A0A-B81F-423BF58A8C0F}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-3Q6C9</PKey><PID>00359-OEM-8992687-00010</PID><PIDType>2</PIDType><SID>S-1-5-21-531353185-1000728662-116016096</SID><SYSTEM><Manufacturer>HP-Pavilion</Manufacturer><Model>AY633AA-ABA p6313w</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>5.14 </Version><SMBIOSVersion major="2" minor="5"/><Date>20100119000000.000000+000</Date></BIOS><HWID>1B583E07018400F4</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0xC004F012' to display the error text.
Error: 0xC004F012

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 10:10:2015 17:24
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
N/A, hr = 0x8007000d

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC HPQOEM SLIC-CPC
FACP HPQOEM SLIC-CPC
HPET HPQOEM SLIC-CPC
MCFG HPQOEM SLIC-CPC
OEMB HPQOEM SLIC-CPC
INFO HPQOEM SLIC-CPC
NVHD HPQOEM SLIC-CPC
SLIC HPQOEM SLIC-CPC
SSDT HPQOEM SLIC-CPC

Another thing to add.... when the machine is booted in safe mode, the error does not appear, leading me to believe that this may be malware. I am really looking for some help with this if anyone can provide some assistance as I am completely stumped on this one

Hi insomniac0418 & welcome to sevenforums.

First, you need to run some additional scans for virus/malware/rootkits

List of excellent scanners, for virus, rootkit, adware, nagware, pups, (free) I like free!

Malwarebytes

ADWCleaner

SuperAntiSpyware

HitmanPro choose x64 version

Rootkit Tools

TDSS Killer

Run all of them in their default settings, delete everything they find & post your results.

Hi wben353,

Thanks for the response. Please see the attached zip file which contains scan results from the programs recommended



Best regards,

Mike P

Hi wben353,

Also.... after running these utilities, I have run some other commands to verify registry permissions and the Plug N Play service:

sc sdshow plugplay
REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18" /S
REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19" /S
REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20" /S

Code:

C:\Users\Administrator>sc sdshow plugplay

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Users\Administrator>reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ProfileList\S-1-5-18" /S

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
    Flags    REG_DWORD    0xc
    State    REG_DWORD    0x0
    RefCount    REG_DWORD    0x1
    Sid    REG_BINARY    010100000000000512000000
    ProfileImagePath    REG_EXPAND_SZ    %systemroot%\system32\config\systemprofile


C:\Users\Administrator>reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ProfileList\S-1-5-19" /S

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19
    ProfileImagePath    REG_EXPAND_SZ    C:\Windows\ServiceProfiles\LocalService

    Flags    REG_DWORD    0x0
    State    REG_DWORD    0x0


C:\Users\Administrator>reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\ProfileList\S-1-5-20" /S

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20
    ProfileImagePath    REG_EXPAND_SZ    C:\Windows\ServiceProfiles\NetworkService
    Flags    REG_DWORD    0x0
    State    REG_DWORD    0x0

Virus/malware scan logs look good. Do you recall the virus name(s) you were infected with? Which program found the infection(s)?

What is the current status of your Windows activation, error code?

Download & run SURT. Post CheckSUR.log located at: C:\Windows\Logs\CBS We'll see if you have any correctable errors

SURT may take a while to complete. If you receive error code post that.

Hi wben353,

Current status of Windows activation has not changed. Still receiving the same error, along with others stating that either a reinstall or system restore is required to fix

As for the SURT, the CheckSUR.log output is posted below:

Code:

=================================
Checking System Update Readiness.
Binary Version 6.1.7601.22471
Package Version 26.0
2015-11-19 11:05

Checking Windows Servicing Packages

Checking Package Manifests and Catalogs

Checking Package Watchlist

Checking Component Watchlist

Checking Packages

Checking Component Store

Summary:
Seconds executed: 1746
 No errors detected
(w)	Unable to get system volume info	0x0000000D	SetupDiGetClassDevs on DiskClassGuid	\\.\C:

Best regards,

MP

Do you have recent restore point prior to your issue. You might want to try that first. If you have installed programs after that point they will be removed/deleted. Your personal files, folders, pictures, etc, will be preserved. Most of the time when I try system restore it fails dismally.

You can use CCleaner free version, I like FREE, to copy a list of all your installed program to text file. Click on tools, uninstall, save to text file.

I use AOMEI backupper, free (I like FREE). Simple interface, can to System Image, as well as incremental & differential backups. Can schedule them to run automatically if you wish, or manually.

You could perform a Repair Install which is pretty simple, reinstalls windows, preserves you installed programs, files, folders, music, pictures, etc.

Definitely will correct your error code.

You would need win7 DVD & your 25 character windows product key.

Check your PM (private message)

The following should help,
as you said your PC was infected, BIG clue;


Roy