This copy of windows is not genuine error

Viruses and worms
1

I know this is not a problem with avast, but this forum is a good place to search advice.

I keep getting this windows is not genuine 0x8004fe21 error, sometimes 1-2 times per day. My windows 7 is genuine, I know it. It is a bought copy and I called yedsterday to Microsoft and made phone activation but this error still appears. I would not like to reinstall windows but if its the only choice maybe I have to…? I have also ran sfc/scannow command and it found some errors, but can not fix them. Can anyone help me, this error is getting on my nerves!

2

Lets see if some adware is messing the licence data

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]Select additions at the bottom
[*]Press Scan button.

https://dl.dropboxusercontent.com/u/73555776/frst.JPG

[*]It will produce a log called FRST.txt in the same directory the tool is run from.
[*]Please attach both logs generated.

3

Sounds like the KB3004394 update bug.
This should solve it: http://support.microsoft.com/kb/3024777

4

here is the logs.

5

Did you try the KB that Eddy linked to ?

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKU\S-1-5-21-2284315779-993640343-905712904-1000\...\RunOnce: [AsrOMG_Day0] => [X] HKU\S-1-5-21-2284315779-993640343-905712904-1000\...\RunOnce: [AsrOMG_Day1] => [X] HKU\S-1-5-21-2284315779-993640343-905712904-1000\...\RunOnce: [AsrOMG_Day2] => [X] HKU\S-1-5-21-2284315779-993640343-905712904-1000\...\RunOnce: [AsrOMG_Day3] => [X] HKU\S-1-5-21-2284315779-993640343-905712904-1000\...\RunOnce: [AsrOMG_Day4] => [X] HKU\S-1-5-21-2284315779-993640343-905712904-1000\...\RunOnce: [AsrOMG_Day5] => [X] HKU\S-1-5-21-2284315779-993640343-905712904-1000\...\RunOnce: [AsrOMG_Day6] => [X] 2015-02-05 13:15 - 2015-02-05 13:15 - 00000000 ____D () C:\ProgramData\Office Genuine Advantage 2015-01-26 19:47 - 2015-01-26 19:47 - 00000000 ____D () C:\Users\Hannu\AppData\Local\{6CDD08D2-4502-44F0-9753-3D5B10261DFE} 2015-01-08 10:45 - 2015-01-08 10:45 - 00000000 ____D () C:\Users\Hannu\AppData\Local\{B174EA4C-564F-48B2-8C0B-18031A78FD12} EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

6

More logs.

I tried the KB earlier, but it seemed to do nothing. Just flashed on the screen and gone. I can’t say if it worked.

7

Could you now reboot a few times and let me know if the not genuine warning re-appears

8

Yes, this warning still appears >:(

9

More info;
is seems that KB3024777 update was installed 12.12.2014 on my pc. Also, I forgot to mention that windows action center is working now, it was not working earlier. Now, I only could get rid of that “windows not genuine” warning.

10

Could you see if the following windows update is installed, if it is then uninstall it

KB 3004394

11

I did not find the update on my computer.

12

Did you do/tried this?
go into programs and features
then into view install updates
scroll down into the windows update section
uninstall KB3004394

Here is another way to get Windows activated again:
http://tinyurl.com/ot3jk8v

13

Could you copy the contents of the code box below to notepad
Save the file as All Files… profilelist.reg to your desktop
Right click profilelist.reg and select merge
Reboot windows and let me know if that has cured it

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18]

"Flags"=dword:0000000c
 "State"=dword:00000000
 "RefCount"=dword:00000001
 "Sid"=hex:01,01,00,00,00,00,00,05,12,00,00,00
 "ProfileImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,\
   00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,\
   5c,00,63,00,6f,00,6e,00,66,00,69,00,67,00,5c,00,73,00,79,00,73,00,74,00,65,\
   00,6d,00,70,00,72,00,6f,00,66,00,69,00,6c,00,65,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19]
 "ProfileImagePath"=hex(2):43,00,3a,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,\
   00,73,00,5c,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,50,00,72,00,6f,00,\
   66,00,69,00,6c,00,65,00,73,00,5c,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65,\
   00,72,00,76,00,69,00,63,00,65,00,00,00
 "Flags"=dword:00000000
 "State"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20]
 "ProfileImagePath"=hex(2):43,00,3a,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,\
   00,73,00,5c,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,50,00,72,00,6f,00,\
   66,00,69,00,6c,00,65,00,73,00,5c,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,\
   00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,00,00
 "Flags"=dword:00000000
 "State"=dword:00000000
14

Looks good so far, I’ll let you know if problems still appear.

15

Fingers crossed

16

Let’s glue his fingers together ;D

17

This is ridiculous. Today, few minutes after windows was started and loaded to desktop, the warning appeared again.

https://onedrive.live.com/redir?resid=4EB1F931FF579F20!2722&authkey=!ADrd5znPuOnQtZ8&v=3&ithint=photo%2Cjpg

18

See reply #11

19

already did that, still gettng that warning.

20

I will do some more searching although I am not sure I will find anything applicable