Jump to content

Windows Activation problem..Files Attached

GrahamNZ

By GrahamNZ
in Resolved Malware Removal Logs

 Share

Recommended Posts

GrahamNZ

GrahamNZ

Posted
Posted

Hi

Started getting a Windows Validation Screen , Supplier says the system is activated correctly. Windows does update. Ok I can perhaps handle that by closing it down BUT MalwareBytes premium has been starting without the protection buttons on . I have to reboot to get MBytes to start correctly. Any ideas ? Thanks Graham NZ

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Hello Graham,

You`ve opened another thread to post the requested logs. I`ve merged both threads, please keep all replies here to this thread.....

I do not see anything obviously wrong in FRST logs, no Malware or Infection...

Can you uninstall the following program, it is outdated and may clash with your other security:

Spybot - Search & Destroy - https://www.safer-networking.org/faq/how-to-uninstall-2/

Malwarebytes is outdated Can you update to version 3.3.1. 2183....  Open Malwarebytes, select "Settings" then under "Application" select "Update Application Updates"

When the new version is installed run as follows:

Open Malwarebytes Anti-Malware.
 
  • On the Settings tab > Protection Scroll to and make sure the following are selected:
    Scan for Rootkits
    Scan within Archives
     
  • Scroll further to Potential Threat Protection make sure the following are set as follows:
    Potentially Unwanted Programs (PUP`s) set as :- Always detect PUP`s (recommended)
    Potentially Unwanted Modifications (PUM`s) set as :- Alwaysdetect PUM`s (recommended)
     
  • Click on the Scan make sure Threat Scan is selected,
  • A Threat Scan will begin.
  • When the scan is complete if anything is found make sure that the first checkbox at the top is checked (that will automatically check all detected items), then click on the Quarantine Selected Tab
  • If asked to restart your computer to complete the removal, please do so
  • When complete click on Export Summary after deletion (bottom-left corner) and select Copy to Clipboard.
  • Wait for the prompt to restart the computer to appear, then click on Yes.
  • After the restart once you are back at your desktop, open MBAM once more to retrieve the log.


To get the log from Malwarebytes do the following:
 
  • Click on the Reports tab > from main interface.
  • Double click on the Scan log which shows the Date and time of the scan just performed.
  • Click Export > From export you have two options:
    Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
    Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply

     
  • Use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

Next,

Download AdwCleaner by Malwarebytes onto your Desktop.

Or from this Mirror
 
  • Right-click on AdwCleaner.exe and select user posted imageRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
  • Accept the EULA (I accept), then click on Scan
  • Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all the active processes
  • Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
  • After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply

Post those logs, also can you post a screen shot of the Windows Activation problem.....

Thank you,

Kevin

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted (edited)

Hello GrahamNZ,

Run the MGA Diagnostic Tool and post back the report it creates:
 
  • Download MGADiag from here: http://go.microsoft.com/fwlink/?linkid=52012 and save it to your desktop.
  • Double-click on MGADiag.exe to launch the program
  • Click "Continue"
  • Ensure that the "Windows" tab is selected (it should be by default).
  • Click the "Copy" button to copy the MGA Diagnostic Report to the Windows clipboard. (Do not worry about any errors at this point, paste will still work)
  • Paste the MGA Diagnostic Report back here in your next reply.

Thank you,

Kevin...

Edited by kevinf80
Link to post
Share on other sites
GrahamNZ

GrahamNZ

Posted
  • Author
Posted

Kevin....Here's the MGA . the system didn't recognise the : licensingdiag .exe command line

Thanks

Graham

 

 

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0x8004FE22
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-BP4GF-9W9JR-YFQ42
Windows Product Key Hash: A436L9p/3XaFhMYke4jeQ02pKvU=
Windows Product ID: 00359-OEM-9823303-49190
Windows Product ID Type: 8
Windows License Type: COA SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {C7475C45-FF2D-41CE-AE0A-206AE95C698B}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_ldr.170913-0600
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{C7475C45-FF2D-41CE-AE0A-206AE95C698B}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-YFQ42</PKey><PID>00359-OEM-9823303-49190</PID><PIDType>8</PIDType><SID>S-1-5-21-282431795-2989704259-1115292206</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>p6-2175a</Model></SYSTEM><BIOS><Manufacturer>AMI</Manufacturer><Version>7.16</Version><SMBIOSVersion major="2" minor="6"/><Date>20120323000000.000000+000</Date></BIOS><HWID>FCC73F07018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>New Zealand Standard Time(GMT+12:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_SLP channel
Activation ID: 5e017a8a-f3f9-4167-b1bd-ba3e236a4d8f
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00196-233-049190-02-1033-7601.0000-1402016
Installation ID: 003003421943483746822930786515202165549494887255920721
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: YFQ42
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 22-Nov-17 10:37:02 PM

Windows Activation Technologies-->
HrOffline: 0x8004FE22
HrOnline: N/A
HealthStatus: 0x0000000000000800
Event Time Stamp: 11:21:2017 19:44
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration


HWID Data-->
HWID Hash Current: MAAAAAEAAQABAAEAAAACAAAAAwABAAEA6GHWH2Y5fmBi+VQMYj1iWFDSXuVm1C5z

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            HPQOEM        SLIC-CPC
  FACP            HPQOEM        SLIC-CPC
  DBGP            HPQOEM        SLIC-CPC
  HPET            HPQOEM        SLIC-CPC
  MCFG            HPQOEM        SLIC-CPC
  SSDT            HPQOEM        SLIC-CPC
  SLIC            HPQOEM        SLIC-CPC

 

 

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Hiya Graham,

That MGA log is indicating legitimate but one of the codes does suggest Invalid license key....

Lets see if recreating the Licensing Store will make a fix.
 
  • Click Start button.
  • Type or copy/paste: CMD.exe into the 'Search programs and files' field, then Right-Click on CMD.exe and select Run as Administrator

    At the prompt continue with the following commands:
     
  • Type or copy/paste: net stop sppsvc hit the enter key (It may ask you if you are sure, select yes)

    Note: the Software Protection service may not be running, this is ok.
     
  • Type or copy/paste: cd %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform hit the enter key
  • Type or copy/paste: rename tokens.dat tokens.bar hit the enter key
  • Type or copy/paste: cd %windir%\system32 hit the enter key
  • Type or copy paste: net start sppsvc hit the ener key
  • Type or copy/paste: slui.exe hit the enter key
  • After a couple of seconds Windows Activation dialog will appear. You may be asked to re-activate and/or re-enter your product key or Activation may occur automatically.


If you are asked for your Key, use the one on the COA sitcker on the machine's case, or that was supplied by your retailer...

Let me know the outcome...

Thank you,

Kevin...
Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Hiya Graham,

That screenshot information is what I expected to see. Your problem however is still to be resolved,  from the the MGA log the following entries are the problem:

Quote

Tampered File: %systemroot%\system32\slui.exe|slui.exe.mui|COM Registration

Usually that is indicative of an illegal license set up, but it can also happen when registry cleaners, or enhancers are used. I see you have CCleaner installed so am thinking that maybe what has happened in your case...

The best way forward is to make a fresh activation by phone, the following link have all necessary instructions:

https://www.sevenforums.com/tutorials/18715-activate-windows-7-phone.html

Let me know the outcome (if activation nags cease)

Thanks,

Kevin...

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.