Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Message box appears saying I may be a victim of counterfeit software


23 Dec 2013   #1

Windows 7 64-bit
 
 
Message box appears saying I may be a victim of counterfeit software

Out of the blue, I found the attached message box posted on my desktop. I says that I may be a victim of software counterfeiting and to go online to resolve the issue.

Is this a legit message from Microsoft or do I have a trojan/virus/rootkit trying to gain control (of course I didn't select to go online to resolve the issue)?

Thanks and Merry Christmas.



Attached Images
 
My System SpecsSystem Spec
.

23 Dec 2013   #2

Microsoft Community Contributor Award Recipient

Windows 7 Ult. x64 Windows 8.1 x64 Ubuntu 12.04 LTS Tri-Boot
 
 

We can easily check. In order to completely troubleshoot Windows validation & activation issues, please perform the following:

1. Download and save this tool to your desktop:
http://go.microsoft.com/fwlink/?linkid=52012

2. Run the tool, and then click Copy - ignore any errors if they appear

3. Use CTRL+V to paste the unedited results of the tool here in your next reply

More detail: Windows Genuine and Activation Issue Posting Instructions
My System SpecsSystem Spec
23 Dec 2013   #3

Windows 7 64-bit
 
 

Here's the copy:

Code:
 
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
 
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-PDX4R-2Q4MC-J8368
Windows Product Key Hash: 36K63na+fKngCc75KCvsWBRXACs=
Windows Product ID: 00371-152-0935065-85467
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {21AF8073-4513-4E44-9AC4-B5F153A10FC4}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130828-1532
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
 
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
 
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
 
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
 
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Home and Student 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
 
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
 
File Scan Data-->
 
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{21AF8073-4513-4E44-9AC4-B5F153A10FC4}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-J8368</PKey><PID>00371-152-0935065-85467</PID><PIDType>5</PIDType><SID>S-1-5-21-1527527429-2520481382-2976781397</SID><SYSTEM><Manufacturer>MSI</Manufacturer><Model>MS-7612</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>V1.4</Version><SMBIOSVersion major="2" minor="6"/><Date>20100812000000.000000+000</Date></BIOS><HWID>A74F3C07018400F6</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>5E34EBF2D164F26</Val><Hash>/1yf03PWHoQPzTgWJA6obL9h2Oo=</Hash><Pid>81602-915-2740591-68558</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 
 
Spsys.log Content: 0x80070002
 
Licensing Data-->
Software licensing service version: 6.1.7601.17514
 
Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: e838d943-63ed-4a0b-9fb1-47152908acc9
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00170-152-093506-01-1033-7600.0000-0502010
Installation ID: 005512877760213332056531276606163724887346938542487331
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: J8368
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 12/23/2013 7:13:24 PM
 
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 11:7:2013 01:46
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
 
 
HWID Data-->
HWID Hash Current: OAAAAAIABAABAAEAAAADAAAAAgABAAEAhFH+VkbbjIYoQtQUPgqWknDuGr+CMhZDeKLYwCRkAtA=
 
OEM Activation 1.0 Data-->
N/A
 
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
ACPI Table Name OEMID Value OEMTableID Value
APIC 7612MS A7612200
FACP 7612MS A7612200
SRAT AMD FAM_F_10
MCFG 7612MS OEMMCFG 
OEMB 7612MS A7612200
INFO 7612MS AMDINFO 
NVHD 7612MS NVHDCP 
SSDT A M I POWERNOW
My System SpecsSystem Spec
.


23 Dec 2013   #4
whs
Microsoft MVP

Vista, Windows7, Mint Mate, Zorin, Windows 8
 
 

Check which process issued the message.

Error Message - Where Does it Come From
My System SpecsSystem Spec
23 Dec 2013   #5
Microsoft MVP

 

Where did you get Windows 7? How long has it been installed?

Was there anything that was done before you got the error message?

I would try reactivating with the retail Product Key to see what happens. It may resolve the issue, or it may be rejected leading to Activate Windows 7 by Phone


If all fails activation you have the option to file a case with MS Customer Service to investigate non-genuine software you were sold. If you cooperate with this they may award you a free copy.
My System SpecsSystem Spec
23 Dec 2013   #6

Windows 7 64-bit
 
 

WHS: That was a good video and all fine and dandy but I didn't have Process Explorer running.

Gregrocker: I have had Win 7 Pro installed for several years without this message. Also, the message was on my desktop after I came back to the PC from several hours being away, so I don't know if something tried to install or what. Also, I went into Control Panel/System and did a Windows activation there and everything seems to be OK.

In the System Event Viewer there was a message: The start type of the Windows Modules Installer service was changed from demand start to auto start and then: The start type of the Windows Modules Installer service was changed from auto start to demand start but I didn't initiate those. It's almost like something tried to install.

Also, just before I got back on the PC, the Application Event log showed: The Software Protection service has completed licensing status check with a bunch of information below the message. Could this check have caused the message?
My System SpecsSystem Spec
23 Dec 2013   #7

Windows 7 64-bit
 
 

WHS: That was a good video and all fine and dandy but I didn't have Process Explorer running.

Gregrocker: I have had Win 7 Pro installed for several years without this message. Also, the message was on my desktop after I came back to the PC from several hours being away, so I don't know if something tried to install or what. Also, I went into Control Panel/System and did a Windows activation there and everything seems to be OK.

In the System Event Viewer there was a message: The start type of the Windows Modules Installer service was changed from demand start to auto start and then: The start type of the Windows Modules Installer service was changed from auto start to demand start but I didn't initiate those. It's almost like something tried to install.

Also, just before I got back on the PC, the Application Event log showed: The Software Protection service has completed licensing status check with a bunch of information below the message. Could this check have caused the message?

Also just after this was the message A request to disable the Desktop Window Manager was made by process (Windows System Assessment Tool). What was that all about?
My System SpecsSystem Spec
23 Dec 2013   #8

Microsoft Community Contributor Award Recipient

Windows 7 Ult. x64 Windows 8.1 x64 Ubuntu 12.04 LTS Tri-Boot
 
 

What anti-virus suite are you running?
My System SpecsSystem Spec
24 Dec 2013   #9

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)
 
 

Quote   Quote: Originally Posted by rzn6jw View Post
In the System Event Viewer there was a message: The start type of the Windows Modules Installer service was changed from demand start to auto start and then: The start type of the Windows Modules Installer service was changed from auto start to demand start but I didn't initiate those. It's almost like something tried to install.
That is a normal message for when there is a pending install - possibly of an update. you can safely ignore it.

There are no obvious problems in the MGADiag report - are you seeing the non-genuine notification all the time, (bottom right of the desktop)? - or does it come and go?

Please attempt validation at www.microsoft.com/genuine/validate using Internet Explorer - what happens?
My System SpecsSystem Spec
25 Dec 2013   #10

Windows 7 64-bit
 
 

Validation via IE worked fine. This was the first time I saw the message. I never had anything like this in any of the Windows I've ever ran so it raised a flag when I saw it.

Thanks everybody and enjoy the holidays!
My System SpecsSystem Spec
Reply

 Message box appears saying I may be a victim of counterfeit software




Thread Tools



Similar help and support threads for2: Message box appears saying I may be a victim of counterfeit software
Thread Forum
What does “victim of counterfeit software” really mean? News
What does “victim of counterfeit software” really mean? Installation & Setup
Microsoft Warns Of Malware-Laced Counterfeit Software System Security
message appears Browsers & Mail
Counterfeit Software General Discussion

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 09:56 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33