Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Message box appears saying I may be a victim of counterfeit software

23 Dec 2013   #1
rzn6jw

Windows 7 Pro 64-bit Service Pack 1
 
 
Message box appears saying I may be a victim of counterfeit software

Out of the blue, I found the attached message box posted on my desktop. I says that I may be a victim of software counterfeiting and to go online to resolve the issue.

Is this a legit message from Microsoft or do I have a trojan/virus/rootkit trying to gain control (of course I didn't select to go online to resolve the issue)?

Thanks and Merry Christmas.


My System SpecsSystem Spec
.

23 Dec 2013   #2
Golden
Microsoft MVP

Windows 7 Ult. x64
 
 

We can easily check. In order to completely troubleshoot Windows validation & activation issues, please perform the following:

1. Download and save this tool to your desktop:
http://go.microsoft.com/fwlink/?linkid=52012

2. Run the tool, and then click Copy - ignore any errors if they appear

3. Use CTRL+V to paste the unedited results of the tool here in your next reply

More detail: Windows Genuine and Activation Issue Posting Instructions
My System SpecsSystem Spec
23 Dec 2013   #3
rzn6jw

Windows 7 Pro 64-bit Service Pack 1
 
 

Here's the copy:

Code:
 
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
 
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-PDX4R-2Q4MC-J8368
Windows Product Key Hash: 36K63na+fKngCc75KCvsWBRXACs=
Windows Product ID: 00371-152-0935065-85467
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {21AF8073-4513-4E44-9AC4-B5F153A10FC4}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130828-1532
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
 
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
 
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
 
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
 
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Home and Student 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
 
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
 
File Scan Data-->
 
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{21AF8073-4513-4E44-9AC4-B5F153A10FC4}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-J8368</PKey><PID>00371-152-0935065-85467</PID><PIDType>5</PIDType><SID>S-1-5-21-1527527429-2520481382-2976781397</SID><SYSTEM><Manufacturer>MSI</Manufacturer><Model>MS-7612</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>V1.4</Version><SMBIOSVersion major="2" minor="6"/><Date>20100812000000.000000+000</Date></BIOS><HWID>A74F3C07018400F6</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>5E34EBF2D164F26</Val><Hash>/1yf03PWHoQPzTgWJA6obL9h2Oo=</Hash><Pid>81602-915-2740591-68558</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 
 
Spsys.log Content: 0x80070002
 
Licensing Data-->
Software licensing service version: 6.1.7601.17514
 
Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: e838d943-63ed-4a0b-9fb1-47152908acc9
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00170-152-093506-01-1033-7600.0000-0502010
Installation ID: 005512877760213332056531276606163724887346938542487331
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: J8368
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 12/23/2013 7:13:24 PM
 
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 11:7:2013 01:46
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
 
 
HWID Data-->
HWID Hash Current: OAAAAAIABAABAAEAAAADAAAAAgABAAEAhFH+VkbbjIYoQtQUPgqWknDuGr+CMhZDeKLYwCRkAtA=
 
OEM Activation 1.0 Data-->
N/A
 
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
ACPI Table Name OEMID Value OEMTableID Value
APIC 7612MS A7612200
FACP 7612MS A7612200
SRAT AMD FAM_F_10
MCFG 7612MS OEMMCFG 
OEMB 7612MS A7612200
INFO 7612MS AMDINFO 
NVHD 7612MS NVHDCP 
SSDT A M I POWERNOW
My System SpecsSystem Spec
.


23 Dec 2013   #4
whs
Microsoft MVP

Vista, Windows7, Mint Mate, Zorin, Windows 8
 
 

Check which process issued the message.

Error Message - Where Does it Come From
My System SpecsSystem Spec
23 Dec 2013   #5
gregrocker
Microsoft MVP

 
 

Where did you get WIn7? How long has it been installed?

Was there anything that was done before you got the error message?

I would try reactivating with the retail Product Key to see what happens. It may resolve the issue, or it may be rejected leading to Activate Windows 7 by Phone


If all fails activation you have the option to file a case with MS Customer Service to investigate non-genuine software you were sold. If you cooperate with this they may award you a free copy.
My System SpecsSystem Spec
23 Dec 2013   #6
rzn6jw

Windows 7 Pro 64-bit Service Pack 1
 
 

WHS: That was a good video and all fine and dandy but I didn't have Process Explorer running.

Gregrocker: I have had Win 7 Pro installed for several years without this message. Also, the message was on my desktop after I came back to the PC from several hours being away, so I don't know if something tried to install or what. Also, I went into Control Panel/System and did a Windows activation there and everything seems to be OK.

In the System Event Viewer there was a message: The start type of the Windows Modules Installer service was changed from demand start to auto start and then: The start type of the Windows Modules Installer service was changed from auto start to demand start but I didn't initiate those. It's almost like something tried to install.

Also, just before I got back on the PC, the Application Event log showed: The Software Protection service has completed licensing status check with a bunch of information below the message. Could this check have caused the message?
My System SpecsSystem Spec
23 Dec 2013   #7
rzn6jw

Windows 7 Pro 64-bit Service Pack 1
 
 

WHS: That was a good video and all fine and dandy but I didn't have Process Explorer running.

Gregrocker: I have had Win 7 Pro installed for several years without this message. Also, the message was on my desktop after I came back to the PC from several hours being away, so I don't know if something tried to install or what. Also, I went into Control Panel/System and did a Windows activation there and everything seems to be OK.

In the System Event Viewer there was a message: The start type of the Windows Modules Installer service was changed from demand start to auto start and then: The start type of the Windows Modules Installer service was changed from auto start to demand start but I didn't initiate those. It's almost like something tried to install.

Also, just before I got back on the PC, the Application Event log showed: The Software Protection service has completed licensing status check with a bunch of information below the message. Could this check have caused the message?

Also just after this was the message A request to disable the Desktop Window Manager was made by process (Windows System Assessment Tool). What was that all about?
My System SpecsSystem Spec
23 Dec 2013   #8
Golden
Microsoft MVP

Windows 7 Ult. x64
 
 

What anti-virus suite are you running?
My System SpecsSystem Spec
24 Dec 2013   #9
NoelDP

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)
 
 

Quote   Quote: Originally Posted by rzn6jw View Post
In the System Event Viewer there was a message: The start type of the Windows Modules Installer service was changed from demand start to auto start and then: The start type of the Windows Modules Installer service was changed from auto start to demand start but I didn't initiate those. It's almost like something tried to install.
That is a normal message for when there is a pending install - possibly of an update. you can safely ignore it.

There are no obvious problems in the MGADiag report - are you seeing the non-genuine notification all the time, (bottom right of the desktop)? - or does it come and go?

Please attempt validation at www.microsoft.com/genuine/validate using Internet Explorer - what happens?
My System SpecsSystem Spec
25 Dec 2013   #10
rzn6jw

Windows 7 Pro 64-bit Service Pack 1
 
 

Validation via IE worked fine. This was the first time I saw the message. I never had anything like this in any of the Windows I've ever ran so it raised a flag when I saw it.

Thanks everybody and enjoy the holidays!
My System SpecsSystem Spec
Reply

 Message box appears saying I may be a victim of counterfeit software




Thread Tools





Similar help and support threads
Thread Forum
Error: Windows not genuine - may be victim of software counterfeiting
Hi, I currently have Windows 7 Home Premium x64, which was installed on my Lenovo T520 when I purchased it. I've had no issues with it over the past few years, but recently started getting the "Windows Not Genuine" error when I start up my system. I use McAfee Total Protection, but I also use...
Windows Updates & Activation
Dialog box, "You may be a victim of software counterfeiting"
Good morning everyone, First time posting here. After reviewing site info, this appeared to be the appropriate sub-forum to post in. Apologies, if it is not. I acquired & have been using this refurbished computer since December 2012. (More info in "Additional Notations" section...
Windows Updates & Activation
WAT message- My system is running a counterfeit copy of windows
Few months similar kind of message was getting displayed after I start my system. I contacted a person , he downloaded REMOVE -WAT software onto my system , it worked well until now. Again that same error is coming and "Remove WAT " software is not working. I am attaching results of MGAD tool ....
Windows Updates & Activation
What does “victim of counterfeit software” really mean?
More...
News
Microsoft Warns Of Malware-Laced Counterfeit Software
GENERAL CYBER/ELECTRONIC CRIME Citing a rising tide of complaints from people who unknowingly bought counterfeit software infected with malware, Microsoft on Thursday announced the launch of educational initiatives and enforcement actions in over 70 countries to raise awareness of...
System Security
Counterfeit Software
First of all I appologize, i wasnt sure what category to place this topic under. I recently installed build 7137. Setup and activation (with Key i received from previous beta version) went smooth and everything has been working great for the past 4 days. out of nowhere today, i got a popup saying...
General Discussion

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 04:49.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App