Message box appears saying I may be a victim of counterfeit software

Page 1 of 2 12 LastLast

  1. Posts : 114
    Windows 7 Pro 64-bit Service Pack 1
       #1

    Message box appears saying I may be a victim of counterfeit software


    Out of the blue, I found the attached message box posted on my desktop. I says that I may be a victim of software counterfeiting and to go online to resolve the issue.

    Is this a legit message from Microsoft or do I have a trojan/virus/rootkit trying to gain control (of course I didn't select to go online to resolve the issue)?

    Thanks and Merry Christmas.
      My Computer


  2. Posts : 19,383
    Windows 10 Pro x64 ; Xubuntu x64
       #2

    We can easily check. In order to completely troubleshoot Windows validation & activation issues, please perform the following:

    1. Download and save this tool to your desktop:
    http://go.microsoft.com/fwlink/?linkid=52012

    2. Run the tool, and then click Copy - ignore any errors if they appear

    3. Use CTRL+V to paste the unedited results of the tool here in your next reply

    More detail: Windows Genuine and Activation Issue Posting Instructions
      My Computer


  3. Posts : 114
    Windows 7 Pro 64-bit Service Pack 1
    Thread Starter
       #3

    Here's the copy:

    Code:
     
    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
     
    Validation Code: 0
    Cached Online Validation Code: 0x0
    Windows Product Key: *****-*****-PDX4R-2Q4MC-J8368
    Windows Product Key Hash: 36K63na+fKngCc75KCvsWBRXACs=
    Windows Product ID: 00371-152-0935065-85467
    Windows Product ID Type: 5
    Windows License Type: Retail
    Windows OS version: 6.1.7601.2.00010100.1.0.048
    ID: {21AF8073-4513-4E44-9AC4-B5F153A10FC4}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Professional
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.130828-1532
    TTS Error: 
    Validation Diagnostic: 
    Resolution Status: N/A
     
    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
     
    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002
     
    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002
     
    OGA Data-->
    Office Status: 100 Genuine
    Microsoft Office Home and Student 2007 - 100 Genuine
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
     
    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed
     
    File Scan Data-->
     
    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{21AF8073-4513-4E44-9AC4-B5F153A10FC4}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-J8368</PKey><PID>00371-152-0935065-85467</PID><PIDType>5</PIDType><SID>S-1-5-21-1527527429-2520481382-2976781397</SID><SYSTEM><Manufacturer>MSI</Manufacturer><Model>MS-7612</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>V1.4</Version><SMBIOSVersion major="2" minor="6"/><Date>20100812000000.000000+000</Date></BIOS><HWID>A74F3C07018400F6</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>5E34EBF2D164F26</Val><Hash>/1yf03PWHoQPzTgWJA6obL9h2Oo=</Hash><Pid>81602-915-2740591-68558</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 
     
    Spsys.log Content: 0x80070002
     
    Licensing Data-->
    Software licensing service version: 6.1.7601.17514
     
    Name: Windows(R) 7, Professional edition
    Description: Windows Operating System - Windows(R) 7, RETAIL channel
    Activation ID: e838d943-63ed-4a0b-9fb1-47152908acc9
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 00371-00170-152-093506-01-1033-7600.0000-0502010
    Installation ID: 005512877760213332056531276606163724887346938542487331
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: J8368
    License Status: Licensed
    Remaining Windows rearm count: 4
    Trusted time: 12/23/2013 7:13:24 PM
     
    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0x00000000
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 11:7:2013 01:46
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:
     
     
    HWID Data-->
    HWID Hash Current: OAAAAAIABAABAAEAAAADAAAAAgABAAEAhFH+VkbbjIYoQtQUPgqWknDuGr+CMhZDeKLYwCRkAtA=
     
    OEM Activation 1.0 Data-->
    N/A
     
    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes, but no SLIC table
    Windows marker version: N/A
    OEMID and OEMTableID Consistent: N/A
    BIOS Information: 
    ACPI Table Name OEMID Value OEMTableID Value
    APIC 7612MS A7612200
    FACP 7612MS A7612200
    SRAT AMD FAM_F_10
    MCFG 7612MS OEMMCFG 
    OEMB 7612MS A7612200
    INFO 7612MS AMDINFO 
    NVHD 7612MS NVHDCP 
    SSDT A M I POWERNOW
    Last edited by Brink; 23 Dec 2013 at 21:24. Reason: code box
      My Computer


  4. whs
    Posts : 26,210
    Vista, Windows7, Mint Mate, Zorin, Windows 8
       #4

    Check which process issued the message.

    Error Message - Where Does it Come From
      My Computer

  5.    #5

    Where did you get WIn7? How long has it been installed?

    Was there anything that was done before you got the error message?

    I would try reactivating with the retail Product Key to see what happens. It may resolve the issue, or it may be rejected leading to Activate Windows 7 by Phone


    If all fails activation you have the option to file a case with MS Customer Service to investigate non-genuine software you were sold. If you cooperate with this they may award you a free copy.
    Last edited by gregrocker; 23 Dec 2013 at 22:37. Reason: added tutorial link for more info
      My Computer


  6. Posts : 114
    Windows 7 Pro 64-bit Service Pack 1
    Thread Starter
       #6

    WHS: That was a good video and all fine and dandy but I didn't have Process Explorer running.

    Gregrocker: I have had Win 7 Pro installed for several years without this message. Also, the message was on my desktop after I came back to the PC from several hours being away, so I don't know if something tried to install or what. Also, I went into Control Panel/System and did a Windows activation there and everything seems to be OK.

    In the System Event Viewer there was a message: The start type of the Windows Modules Installer service was changed from demand start to auto start and then: The start type of the Windows Modules Installer service was changed from auto start to demand start but I didn't initiate those. It's almost like something tried to install.

    Also, just before I got back on the PC, the Application Event log showed: The Software Protection service has completed licensing status check with a bunch of information below the message. Could this check have caused the message?
    Last edited by rzn6jw; 23 Dec 2013 at 21:26. Reason: additional information
      My Computer


  7. Posts : 114
    Windows 7 Pro 64-bit Service Pack 1
    Thread Starter
       #7

    WHS: That was a good video and all fine and dandy but I didn't have Process Explorer running.

    Gregrocker: I have had Win 7 Pro installed for several years without this message. Also, the message was on my desktop after I came back to the PC from several hours being away, so I don't know if something tried to install or what. Also, I went into Control Panel/System and did a Windows activation there and everything seems to be OK.

    In the System Event Viewer there was a message: The start type of the Windows Modules Installer service was changed from demand start to auto start and then: The start type of the Windows Modules Installer service was changed from auto start to demand start but I didn't initiate those. It's almost like something tried to install.

    Also, just before I got back on the PC, the Application Event log showed: The Software Protection service has completed licensing status check with a bunch of information below the message. Could this check have caused the message?

    Also just after this was the message A request to disable the Desktop Window Manager was made by process (Windows System Assessment Tool). What was that all about?
      My Computer


  8. Posts : 19,383
    Windows 10 Pro x64 ; Xubuntu x64
       #8

    What anti-virus suite are you running?
      My Computer


  9. Posts : 21,482
    Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
       #9

    rzn6jw said:
    In the System Event Viewer there was a message: The start type of the Windows Modules Installer service was changed from demand start to auto start and then: The start type of the Windows Modules Installer service was changed from auto start to demand start but I didn't initiate those. It's almost like something tried to install.
    That is a normal message for when there is a pending install - possibly of an update. you can safely ignore it.

    There are no obvious problems in the MGADiag report - are you seeing the non-genuine notification all the time, (bottom right of the desktop)? - or does it come and go?

    Please attempt validation at www.microsoft.com/genuine/validate using Internet Explorer - what happens?
      My Computer


  10. Posts : 114
    Windows 7 Pro 64-bit Service Pack 1
    Thread Starter
       #10

    Validation via IE worked fine. This was the first time I saw the message. I never had anything like this in any of the Windows I've ever ran so it raised a flag when I saw it.

    Thanks everybody and enjoy the holidays!
      My Computer


 
Page 1 of 2 12 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 17:42.
Find Us