Message box appears saying I may be a victim of counterfeit software

[rzn6jw]

Out of the blue, I found the attached message box posted on my desktop. I says that I may be a victim of software counterfeiting and to go online to resolve the issue.

Is this a legit message from Microsoft or do I have a trojan/virus/rootkit trying to gain control (of course I didn't select to go online to resolve the issue)?

Thanks and Merry Christmas.

 

[Golden]

We can easily check. In order to completely troubleshoot Windows validation & activation issues, please perform the following:

1. Download and save this tool to your desktop:
http://go.microsoft.com/fwlink/?linkid=52012

2. Run the tool, and then click Copy - ignore any errors if they appear

3. Use CTRL+V to paste the unedited results of the tool here in your next reply

More detail: http://www.sevenforums.com/windows-...ne-activation-issue-posting-instructions.html

 

[rzn6jw]

Here's the copy:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
 
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-PDX4R-2Q4MC-J8368
Windows Product Key Hash: 36K63na+fKngCc75KCvsWBRXACs=
Windows Product ID: 00371-152-0935065-85467
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {21AF8073-4513-4E44-9AC4-B5F153A10FC4}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130828-1532
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
 
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
 
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
 
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
 
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Home and Student 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
 
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
 
File Scan Data-->
 
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{21AF8073-4513-4E44-9AC4-B5F153A10FC4}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-J8368</PKey><PID>00371-152-0935065-85467</PID><PIDType>5</PIDType><SID>S-1-5-21-1527527429-2520481382-2976781397</SID><SYSTEM><Manufacturer>MSI</Manufacturer><Model>MS-7612</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>V1.4</Version><SMBIOSVersion major="2" minor="6"/><Date>20100812000000.000000+000</Date></BIOS><HWID>A74F3C07018400F6</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>5E34EBF2D164F26</Val><Hash>/1yf03PWHoQPzTgWJA6obL9h2Oo=</Hash><Pid>81602-915-2740591-68558</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 
 
Spsys.log Content: 0x80070002
 
Licensing Data-->
Software licensing service version: 6.1.7601.17514
 
Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: e838d943-63ed-4a0b-9fb1-47152908acc9
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00170-152-093506-01-1033-7600.0000-0502010
Installation ID: 005512877760213332056531276606163724887346938542487331
Processor Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88338[/URL]
Machine Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88339[/URL]
Use License URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88341[/URL]
Product Key Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88340[/URL]
Partial Product Key: J8368
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 12/23/2013 7:13:24 PM
 
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 11:7:2013 01:46
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
 
 
HWID Data-->
HWID Hash Current: OAAAAAIABAABAAEAAAADAAAAAgABAAEAhFH+VkbbjIYoQtQUPgqWknDuGr+CMhZDeKLYwCRkAtA=
 
OEM Activation 1.0 Data-->
N/A
 
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
ACPI Table Name OEMID Value OEMTableID Value
APIC 7612MS A7612200
FACP 7612MS A7612200
SRAT AMD FAM_F_10
MCFG 7612MS OEMMCFG 
OEMB 7612MS A7612200
INFO 7612MS AMDINFO 
NVHD 7612MS NVHDCP 
SSDT A M I POWERNOW

 

[whs]

Check which process issued the message.

http://www.sevenforums.com/tutorials/74502-error-message-where-does-come.html

 

[gregrocker]

Where did you get WIn7? How long has it been installed?

Was there anything that was done before you got the error message?

I would try reactivating with the retail Product Key to see what happens. It may resolve the issue, or it may be rejected leading to http://www.sevenforums.com/tutorials/18715-activate-windows-7-phone.html


If all fails activation you have the option to file a case with MS Customer Service to investigate non-genuine software you were sold. If you cooperate with this they may award you a free copy.

 

[rzn6jw]

WHS: That was a good video and all fine and dandy but I didn't have Process Explorer running.

Gregrocker: I have had Win 7 Pro installed for several years without this message. Also, the message was on my desktop after I came back to the PC from several hours being away, so I don't know if something tried to install or what. Also, I went into Control Panel/System and did a Windows activation there and everything seems to be OK.

In the System Event Viewer there was a message: The start type of the Windows Modules Installer service was changed from demand start to auto start and then: The start type of the Windows Modules Installer service was changed from auto start to demand start but I didn't initiate those. It's almost like something tried to install.

Also, just before I got back on the PC, the Application Event log showed: The Software Protection service has completed licensing status check with a bunch of information below the message. Could this check have caused the message?

 

[rzn6jw]

WHS: That was a good video and all fine and dandy but I didn't have Process Explorer running.

Gregrocker: I have had Win 7 Pro installed for several years without this message. Also, the message was on my desktop after I came back to the PC from several hours being away, so I don't know if something tried to install or what. Also, I went into Control Panel/System and did a Windows activation there and everything seems to be OK.

In the System Event Viewer there was a message: The start type of the Windows Modules Installer service was changed from demand start to auto start and then: The start type of the Windows Modules Installer service was changed from auto start to demand start but I didn't initiate those. It's almost like something tried to install.

Also, just before I got back on the PC, the Application Event log showed: The Software Protection service has completed licensing status check with a bunch of information below the message. Could this check have caused the message?

Also just after this was the message A request to disable the Desktop Window Manager was made by process (Windows System Assessment Tool). What was that all about?

 

[Golden]

What anti-virus suite are you running?

 

[NoelDP]

In the System Event Viewer there was a message: The start type of the Windows Modules Installer service was changed from demand start to auto start and then: The start type of the Windows Modules Installer service was changed from auto start to demand start but I didn't initiate those. It's almost like something tried to install.

That is a normal message for when there is a pending install - possibly of an update. you can safely ignore it.

There are no obvious problems in the MGADiag report - are you seeing the non-genuine notification all the time, (bottom right of the desktop)? - or does it come and go?

Please attempt validation at www.microsoft.com/genuine/validate using Internet Explorer - what happens?

 

[rzn6jw]

Validation via IE worked fine. This was the first time I saw the message. I never had anything like this in any of the Windows I've ever ran so it raised a flag when I saw it.

Thanks everybody and enjoy the holidays!

 

[gregrocker]

Is your Win7 activated at bottom of Computer>Properties page?

 

[rzn6jw]

Yes, it is. Still, since I have never had this message appear before, I wonder if it's Microsoft that posting it or something else.

Anyway, everything seems OK with the system and no erroneous programs are trying to install. Will keep an eye on it though.

Thanks again for all the replies and help!

 

[NoelDP]

Such race conditions as you have are nor all that unusual - they are normally caused by AV conflicting with the SPPSVC, but can be caused by pretty much any processor-intensive process during the boot. It's almost impossible to isolate the actual conflict as merely looking for it changes the conditions sufficiently that it is less likely to occur.
It can happen as a result of some third-party 'system tools' doing a 'cleanup' on the drive and deleting the boot optimisation records - this results in Windows having to re-learn the boot process, and the order in which it starts non-kernel processes.
It usually settles down after a few reboots, and isn't seen again for months (if ever).