Legit copy of windows now displays as unverified. [Solved]

Hello and   

• Please download and save the following tool to your desktop Link
• Right-click on MGADiag.exe and select Run as Administrator.
• Select Continue.  The diagnosis will now begin.
• When the process is over, click Copy.
• Open Notepad and paste the contents.
• Save this file as MGADiag.txt.
• Post the content on MGADiag.txt in your next reply.

Thank you so much for your help!  I haven't noticed any other infections, but I am kinda worried that something might be lurking, ya know?

Here is the log you requested:

Also, microsoft security essentials keeps popping up saying there is a trojan on the pc, but I haven't touched anything.  I figured its best to wait on you.

• Click the Start button > right-click Computer > click Properties
• Scroll down to the bottom of the window that appears, and then, under Windows activation, click Change product key
• If you're prompted for permission to continue the process, click Continue
• Follow the instructions to enter your product key and activate your copy of Windows 7

So I have my product key.  Its on the bottom of my laptop.  Unfortunately I can't enter it into the section.  I uploaded a picture of the screen to imgur: http://imgur.com/3tqvUVV

Clicking on the button takes me to a useless website about what genuine windows actually is and stuff.

Can you please run me a fresh MGA Diagnostic? 

Here you go. Although nothing has been done between the last one I posted and now.  

MGAdiag2:

It's fine that the keys don't match. The one shown in your image is the OEM key that gets installed at the factory (and is used on many machines). These keys can stop being detected automatically for any number of reasons (from system upgrades to malware). The other 25 digit key you have located on your machine (and you SHOULD NOT post that key publicly) is your Certificate of Authenticity (COA) key. It can only be used a certain number of times for activation and is specific to your machine. You'll want to safeguard that key.

(Note: For security, the diagnostic log does not display your full COA key, and I will not ask you for the full key at any time.)

The OEM key matches your Sony Vaio. In theory, we should be able to change the code to the COA key for activation. However, there is a line in your report that concerns me, knowing that you recently removed malware immediately prior to this issue starting. I do need to do a little more research to ensure we don't need to do some registry fixes as well.

We do need to make sure we get Windows to properly recognize activation so you can get all your Windows Updates. After that, we can remove the remnants of what needs to be cleaned up. Please be patient while to do some further research and I'll be back with what we need to do next.

Awesome!  You are amazing!  Thank you so much for all the work you are putting in for me!  I will be here refreshing like a maniac till then, haha.  Thank you for sticking with such a silly issue.  Again, thanks.  You rock so much.

And for clarity's sake, the issue with the invalid key happened with the malware, and I'm still getting consistent popups about malware still on the laptop.  So I know that issue is present as well, but I'm sure you know the best route to take.  Keep on rocking!

First, let's check your Active X settings in Internet Explorer. Some of these appear to be disabled and it could possibly interfere with proper Windows Validation.

1. Open Internet Explorer.

2. Click the Tools menu, and then click Internet Options.

3. On the Security tab, click the Custom level button.

4. Scroll down the Security Settings list until you see ActiveX controls and plug-ins.

5. For Automatic prompting for ActiveX controls, click Enable.

6. Scroll down to Download signed ActiveX controls and click Enable or Prompt.

7. Scroll down to Run ActiveX controls and plug-ins and click Enable or Prompt.

8. Scroll down to Script ActiveX controls marked safe for scripting and click Enable or Prompt.

9. Click OK, and then click OK again.

I know this may get a little repetitive, but the error code your report shows can be caused by a few different issues. I'd like to try the least invasive solutions first.

Please post a fresh MGA Diagnostic report after completing these steps.

Ok!  Here is the log from the latest run.

We're going to rebuild the Licensing Store:

1. Start an elevated command prompt. To do this, follow these steps:
   1. Click Start, and then type cmd in the search box.
   2. Right-click cmd, and then click Run as Administrator.
2. Type the following commands (listed in bold) in the order in which they are presented.
   Press Enter after each command.
   net stop sppsvc <—If it asks if you're sure, select yes
   Note: the Software Protection Service may not be running, this is ok.
    
3. cd %windir%\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform 
   
   ren tokens.dat tokens.bar 
   
   net start sppsvc 
   
   cscript.exe %windir%\system32\slmgr.vbs /rilc
    
4. Restart the computer.

Right-click Computer > Properties > Change product key

Note: Your COA key may require activation by phone (this is not unusual when you are changing the key from OEM to COA. If activation via the above steps is unsuccessful, AND you are presented with a screen for other options on activation, please look for one to activate via automated phone system. You'll be asked for your location and then given a call center phone number.

​Please reboot and then post a fresh MGA Diagnostic log. If for any reason you are unable to complete these steps successfully please let me know.

So, I couldn't attempt to activate windows because it was already activated upon reboot.  So yay!  That is resolved.  Here is the log you requested:

MGADiag3:

I'm glad we were able to get your product back to licensed status! There are a few things that need to be addressed now:

• Open notepad (Start =>All Programs => Accessories => Notepad).
• Please copy the entire contents of the code box below.
  (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
• Save it to the same directory as frst.exe (or frst64.exe) as fixlist.txt.Open notepad. e this into the open notepad. 

CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2212292319-1339573239-2403685339-1005\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
 
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
 
U2 IAStorDataMgrSvc; no ImagePath
U2 MSSQL$DDNI; no ImagePath
 
C:\Users\Owner\AppData\Local\Temp\EAD1C17.exe
C:\Users\Owner\AppData\Local\Temp\EAD254B.exe
C:\Users\Owner\AppData\Local\Temp\EAD2838.exe
C:\Users\Owner\AppData\Local\Temp\EAD369.exe
C:\Users\Owner\AppData\Local\Temp\EAD3F31.exe
C:\Users\Owner\AppData\Local\Temp\EAD6FB3.exe
C:\Users\Owner\AppData\Local\Temp\EAD8E5.exe
C:\Users\Owner\AppData\Local\Temp\EADF9A9.exe
C:\Users\Owner\AppData\Local\Temp\i4jdel0.exe
C:\Users\Owner\AppData\Local\Temp\i7FbB4Tr1u.exe
C:\Users\Owner\AppData\Local\Temp\JNL0dxjqko.exe
C:\Users\Owner\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Owner\AppData\Local\Temp\jre-8u51-windows-au.exe
C:\Users\Owner\AppData\Local\Temp\jre-8u60-windows-au.exe
C:\Users\Owner\AppData\Local\Temp\jre-8u73-windows-au.exe
C:\Users\Owner\AppData\Local\Temp\jre-8u77-windows-au.exe
C:\Users\Owner\AppData\Local\Temp\MSN3B1E.exe
C:\Users\Owner\AppData\Local\Temp\nb8knocy.dll
C:\Users\Owner\AppData\Local\Temp\UninstallEADM.dll
C:\Users\Owner\AppData\Local\Temp\xzhOtGfLMo.exe
C:\Users\Owner\AppData\Local\Temp\Y2CbLGIyip.exe
C:\Users\Owner\AppData\Local\Temp\yu5iEn8UzC.exe
 
Task: {05EA6B03-C37D-4AD1-BA96-EFC4A4CDDA70} - \StartPoint -> No File <==== ATTENTION
Task: {4E7E5A7C-C174-43A0-8052-7245972BE631} - \StartPoint Updater -> No File <==== ATTENTION
Task: {7337D2C6-A80F-4D7C-BE3B-D1136175FD97} - System32\Tasks\Telni => C:\PROGRA~1\Faxci\Saesu.bat <==== ATTENTION
 
AlternateDataStreams: C:\Windows\system32\Drivers\bwsojnng.sys:changelist [1282]
AlternateDataStreams: C:\Windows\system32\Drivers\kuzmlcql.sys:changelist [1282]