Windows 7 build 7601 This copy of windows is not genuine.

RESULTS:’

Microsoft Windows [Version 6.1.7601]

Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>NET START SPPUINOTIFY

The SPP Notification Service service is starting.

The SPP Notification Service service was started successfully.

C:\Windows\system32>SC QUERYEX SPPUINOTIFY

SERVICE_NAME: SPPUINOTIFY

TYPE               : 20  WIN32_SHARE_PROCESS

STATE              : 4  RUNNING

(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)

WIN32_EXIT_CODE    : 0  (0x0)

SERVICE_EXIT_CODE  : 0  (0x0)

CHECKPOINT         : 0x0

WAIT_HINT          : 0x0

PID                : 1060

FLAGS              :

C:\Windows\system32>NET START SPLDR

The requested service has already been started.

More help is available by typing NET HELPMSG 2182.

C:\Windows\system32>SC QUERYEX SPLDR

SERVICE_NAME: SPLDR

TYPE               : 1  KERNEL_DRIVER

STATE              : 4  RUNNING

(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)

WIN32_EXIT_CODE    : 0  (0x0)

SERVICE_EXIT_CODE  : 0  (0x0)

CHECKPOINT         : 0x0

WAIT_HINT          : 0x0

PID                : 0

 FLAGS              :

C:\Windows\system32>

It didn't find anything significant :(

OK - let's try a few more relevant services.....

NET START SPPUINOTIFY

SC QUERYEX SPPUINOTIFY

NET START SPLDR

SC QUERYEX SPLDR

OK, I ran the Farber scanner. I think the first time I followed the link, the Reimage ad was at the top of the Farber page and I did not notice that it was an ad separate from the Farber scanner.

 Farbar Service Scanner Version: 01-12-2012 02

Ran by Millonig Family 2011 (administrator) on 03-12-2012 at 08:01:44

Running from "C:\Download"

Windows 7 Professional Service Pack 1 (X64)

Boot Mode: Normal

****************************************************************

Internet Services:

============

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo IP is accessible.

Yahoo.com is accessible.

Windows Firewall:

=============

Firewall Disabled Policy:

==================

System Restore:

============

System Restore Disabled Policy:

========================

Action Center:

============

Windows Update:

============

Windows Autoupdate Disabled Policy:

============================

Windows Defender:

==============

WinDefend Service is not running. Checking service configuration:

The start type of WinDefend service is set to Demand. The default start type is Auto.

The ImagePath of WinDefend service is OK.

The ServiceDll of WinDefend service is OK.

Other Services:

==============

File Check:

========

C:\Windows\System32\nsisvc.dll => MD5 is legit

C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit

C:\Windows\System32\dhcpcore.dll => MD5 is legit

C:\Windows\System32\drivers\afd.sys => MD5 is legit

C:\Windows\System32\drivers\tdx.sys => MD5 is legit

C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit

C:\Windows\System32\dnsrslvr.dll => MD5 is legit

C:\Windows\System32\mpssvc.dll => MD5 is legit

C:\Windows\System32\bfe.dll => MD5 is legit

C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit

C:\Windows\System32\SDRSVC.dll => MD5 is legit

C:\Windows\System32\vssvc.exe => MD5 is legit

C:\Windows\System32\wscsvc.dll => MD5 is legit

C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit

C:\Windows\System32\wuaueng.dll => MD5 is legit

C:\Windows\System32\qmgr.dll => MD5 is legit

C:\Windows\System32\es.dll => MD5 is legit

C:\Windows\System32\cryptsvc.dll => MD5 is legit

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit

C:\Windows\System32\ipnathlp.dll => MD5 is legit

C:\Windows\System32\iphlpsvc.dll => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

Reimage IS NOT THE FARBAR SCANNER

The farbar scanner is purely a scanner - Reimage is a scareware program designed to lighten your pockets.

Now please download the FARBAR SCANNER (filename FSS.EXE) from the site I pointed you at, and run it - AFTER UNINSTALLING REIMAGE

It looks like Reimage (i.e., Farber scanner) did not work. After a short while, the watermark reappeared. This has happened before. When I reboot, sometimes the watermark is gone but then it reappears again.  I hope you don’t want me to run it again; I’ll have to pay again. It clearly did not work.

If you google “This copy of Windows is not genuine” many of the results use removewat. It is not always clear that they are trying to circumvent Windows validation. I never did run removeWAT.  It appeared to be what you described so I did not go any further with it. I removed it with Symantec360.

I tried to install some Windows updates. They did install but upon reboot I got an error message and then everything was uninstalled.

Here is new MGADiag report

Diagnostic Report (1.9.0027.0):

---

Windows Validation Data-->

Validation Code: 0x8004FE21

Cached Online Validation Code: N/A, hr = 0xc0000022

Windows Product Key: *****-*****-788W3-H689G-6P6GT

Windows Product Key Hash: yr8OHoeXhbT4dc6MxGYjdAStSPY=

Windows Product ID: 00371-OEM-8992671-00008

Windows Product ID Type: 2

Windows License Type: OEM SLP

Windows OS version: 6.1.7601.2.00010100.1.0.048

ID: {998A7F9F-2A4B-44ED-BA11-EC66B03D29E2}(3)

Is Admin: Yes

TestCab: 0x0

LegitcheckControl ActiveX: N/A, hr = 0x80070002

Signed By: N/A, hr = 0x80070002

Product Name: Windows 7 Professional

Architecture: 0x00000009

Build lab: 7601.win7sp1_gdr.120503-2030

TTS Error:

Validation Diagnostic:

Resolution Status: N/A

Vista WgaER Data-->

ThreatID(s): N/A, hr = 0x80070002

Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->

Cached Result: N/A, hr = 0x80070002

File Exists: No

Version: N/A, hr = 0x80070002

WgaTray.exe Signed By: N/A, hr = 0x80070002

WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->

Cached Result: N/A, hr = 0x80070002

Version: N/A, hr = 0x80070002

OGAExec.exe Signed By: N/A, hr = 0x80070002

OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->

Office Status: 109 N/A

OGA Version: N/A, 0x80070002

Signed By: N/A, hr = 0x80070002

Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->

Proxy settings: N/A

User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)

Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Download signed ActiveX controls: Prompt

Download unsigned ActiveX controls: Disabled

Run ActiveX controls and plug-ins: Allowed

Initialize and script ActiveX controls not marked as safe: Disabled

Allow scripting of Internet Explorer Webbrowser control: Disabled

Active scripting: Allowed

Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->

Office Details: <GenuineResults><MachineData><UGUID>{998A7F9F-2A4B-44ED-BA11-EC66B03D29E2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-6P6GT</PKey><PID>00371-OEM-8992671-00008</PID><PIDType>2</PIDType><SID>S-1-5-21-2978311456-595975254-546380561</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>p7-1080t</Model></SYSTEM><BIOS><Manufacturer>AMI</Manufacturer><Version>7.13</Version><SMBIOSVersion major="2" minor="6"/><Date>20110722000000.000000+000</Date></BIOS><HWID>5D4A3607018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

Spsys.log Content: 0x80070002

Licensing Data-->

On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.

Error: 0x80070426

Windows Activation Technologies-->

HrOffline: 0x8004FE21

HrOnline: N/A

HealthStatus: 0x0001000000000000

Event Time Stamp: 11:28:2012 03:48

ActiveX: Registered, Version: 7.1.7600.16395

Admin Service: Registered, Version: 7.1.7600.16395

HealthStatus Bitmask Output:

Tampered Service: sppsvc

HWID Data-->

HWID Hash Current: LAAAAAEAAQABAAEAAAACAAAAAQABAAEAonagc8aHJOn6mtb2Yj1YpRQZLnM=

OEM Activation 1.0 Data-->

N/A

OEM Activation 2.0 Data-->

BIOS valid for OA 2.0: yes

Windows marker version: 0x20001

OEMID and OEMTableID Consistent: yes

BIOS Information:

ACPI Table Name             OEMID Value       OEMTableID Value

APIC                                     HPQOEM                              SLIC-CPC

FACP                                   HPQOEM                              SLIC-CPC

DBGP                                   HPQOEM                              SLIC-CPC

HPET                                   HPQOEM                              SLIC-CPC

MCFG                                  HPQOEM                              SLIC-CPC

SSDT                                   HPQOEM                              SLIC-CPC

SLIC                                     HPQOEM                              SLIC-CPC