Windows 7 build 7601 This copy of windows is not genuine.

Reimage IS NOT THE FARBAR SCANNER

The farbar scanner is purely a scanner - Reimage is a scareware program designed to lighten your pockets.

Now please download the FARBAR SCANNER (filename FSS.EXE) from the site I pointed you at, and run it - AFTER UNINSTALLING REIMAGE

It looks like Reimage (i.e., Farber scanner) did not work. After a short while, the watermark reappeared. This has happened before. When I reboot, sometimes the watermark is gone but then it reappears again.  I hope you don’t want me to run it again; I’ll have to pay again. It clearly did not work.

If you google “This copy of Windows is not genuine” many of the results use removewat. It is not always clear that they are trying to circumvent Windows validation. I never did run removeWAT.  It appeared to be what you described so I did not go any further with it. I removed it with Symantec360.

I tried to install some Windows updates. They did install but upon reboot I got an error message and then everything was uninstalled.

Here is new MGADiag report

Diagnostic Report (1.9.0027.0):

---

Windows Validation Data-->

Validation Code: 0x8004FE21

Cached Online Validation Code: N/A, hr = 0xc0000022

Windows Product Key: *****-*****-788W3-H689G-6P6GT

Windows Product Key Hash: yr8OHoeXhbT4dc6MxGYjdAStSPY=

Windows Product ID: 00371-OEM-8992671-00008

Windows Product ID Type: 2

Windows License Type: OEM SLP

Windows OS version: 6.1.7601.2.00010100.1.0.048

ID: {998A7F9F-2A4B-44ED-BA11-EC66B03D29E2}(3)

Is Admin: Yes

TestCab: 0x0

LegitcheckControl ActiveX: N/A, hr = 0x80070002

Signed By: N/A, hr = 0x80070002

Product Name: Windows 7 Professional

Architecture: 0x00000009

Build lab: 7601.win7sp1_gdr.120503-2030

TTS Error:

Validation Diagnostic:

Resolution Status: N/A

Vista WgaER Data-->

ThreatID(s): N/A, hr = 0x80070002

Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->

Cached Result: N/A, hr = 0x80070002

File Exists: No

Version: N/A, hr = 0x80070002

WgaTray.exe Signed By: N/A, hr = 0x80070002

WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->

Cached Result: N/A, hr = 0x80070002

Version: N/A, hr = 0x80070002

OGAExec.exe Signed By: N/A, hr = 0x80070002

OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->

Office Status: 109 N/A

OGA Version: N/A, 0x80070002

Signed By: N/A, hr = 0x80070002

Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->

Proxy settings: N/A

User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)

Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Download signed ActiveX controls: Prompt

Download unsigned ActiveX controls: Disabled

Run ActiveX controls and plug-ins: Allowed

Initialize and script ActiveX controls not marked as safe: Disabled

Allow scripting of Internet Explorer Webbrowser control: Disabled

Active scripting: Allowed

Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->

Office Details: <GenuineResults><MachineData><UGUID>{998A7F9F-2A4B-44ED-BA11-EC66B03D29E2}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-6P6GT</PKey><PID>00371-OEM-8992671-00008</PID><PIDType>2</PIDType><SID>S-1-5-21-2978311456-595975254-546380561</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>p7-1080t</Model></SYSTEM><BIOS><Manufacturer>AMI</Manufacturer><Version>7.13</Version><SMBIOSVersion major="2" minor="6"/><Date>20110722000000.000000+000</Date></BIOS><HWID>5D4A3607018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

Spsys.log Content: 0x80070002

Licensing Data-->

On a computer running Microsoft Windows non-core edition, run 'slui.exe 0x2a 0x80070426' to display the error text.

Error: 0x80070426

Windows Activation Technologies-->

HrOffline: 0x8004FE21

HrOnline: N/A

HealthStatus: 0x0001000000000000

Event Time Stamp: 11:28:2012 03:48

ActiveX: Registered, Version: 7.1.7600.16395

Admin Service: Registered, Version: 7.1.7600.16395

HealthStatus Bitmask Output:

Tampered Service: sppsvc

HWID Data-->

HWID Hash Current: LAAAAAEAAQABAAEAAAACAAAAAQABAAEAonagc8aHJOn6mtb2Yj1YpRQZLnM=

OEM Activation 1.0 Data-->

N/A

OEM Activation 2.0 Data-->

BIOS valid for OA 2.0: yes

Windows marker version: 0x20001

OEMID and OEMTableID Consistent: yes

BIOS Information:

ACPI Table Name             OEMID Value       OEMTableID Value

APIC                                     HPQOEM                              SLIC-CPC

FACP                                   HPQOEM                              SLIC-CPC

DBGP                                   HPQOEM                              SLIC-CPC

HPET                                   HPQOEM                              SLIC-CPC

MCFG                                  HPQOEM                              SLIC-CPC

SSDT                                   HPQOEM                              SLIC-CPC

SLIC                                     HPQOEM                              SLIC-CPC

RemoveWAT.rar is definitely NOT 'acceptable' - it's a hack to circumvent activation and validation requirements. It should be deleted ASAP.

Where did you get teh idea that running this tool was a good idea?

I said to download the Farbar scanner - NOT anything else!

Please run a new MGADiag report and post the results.

OK I downloaded the Reimageplus scanner and ran it. After completion, I rebooted. Message stated: “installing windows updated”; “Repair Successfully completed.” I could not figure out how to copy the report; I could not highlight the text. There was no right click menu with options to copy. If you know how I can do this, let me know. I did print it and will summarize below:

“fresh files installed; faulty files removed

we discovered 1607 files that had to be replaced on your system

5% files replaced

2% files missing

3% of files were damaged and/or incomplete

8% Registry entries reset “

Also, after Remageplus completed, Symantec 360 had a message: Risk in compressed file ”remove wat.rar” have been detected (the compressed file and all of its contents including infected files will be deleted”).  I did not click to remove it since I was afraid it might interfere with Reimageplus. This message re-appeared after reboot.  I did click to remove the file at that time.

I did previously run a full Norton 360 scan since I had this problem but did not get this or any other message. I may have downloaded the remove.wat file when I was trying to fix this myself the last few weeks.

The watermark “This copy of Windows is not genuine” has disappeared.  I also have some Windows updates available to install. Before it would not let me do any Windows updates due to the not genuine message. It looks like the problem is solved. Let’s wait a few days to verify. Thanks very much for your help.

I'm obviously missing something!

Please download the Farbar Service Scanner from http://www.bleepingcomputer.com/download/farbar-service-scanner/

Run it, and tick all the options, then click on the Scan button - copy and paste the report to your reponse.

(I only discovered this tool today - and this is already the third thread I'm having to use it in!)