"Windows 7 Build 7601 not genuine" intermittently popping up

[MelCalyx]

I'm working on this for someone else - we have a genuine copy of Windows 7 Pro that is coming up with this error, but only about once a week does it pop up... then the computer is restarted, and all is ok. When I ran the validation (Genuine Microsoft Software) I get "Because Windows installed on your PC is genuine, enjoy the security, reliability and protection it provides." Yay, it's genuine. (I am 100% positive it is genuine in fact, as it all came from Best Buy -- the computer came with Win 7 Home and was upgraded to 7 Pro with a key purchased from the same store.)

Below is the log from MGADiag -- mind you, this was gathered while it's working and thinks it's valid, so it might not be of any help.

What I can't figure out is why it will suddenly come up, about once a week (for the last 3 weeks), and then be gone when we reboot... what am I missing?

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-XFBC7-BPQPX-7FFJR
Windows Product Key Hash: 8bBtLgfx7U/SPVa2StbJ1Emebns=
Windows Product ID: 00371-618-8321502-85237
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {CF3E31B2-07C2-4A2C-8F60-345254A8B5DA}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130318-1533
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{CF3E31B2-07C2-4A2C-8F60-345254A8B5DA}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7FFJR</PKey><PID>00371-618-8321502-85237</PID><PIDType>5</PIDType><SID>S-1-5-21-1599347709-2440589739-2733707782</SID><SYSTEM><Manufacturer>Hewlett-Packard</Manufacturer><Model>p7-1054</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>6.06</Version><SMBIOSVersion major="2" minor="6"/><Date>20110322000000.000000+000</Date></BIOS><HWID>B7793207018400F2</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>1</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>HPQOEM</OEMID><OEMTableID>SLIC-CPC</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

Spsys.log Content: 0x80070002

Licensing Data-->
Software licensing service version: 6.1.7601.17514

Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: e838d943-63ed-4a0b-9fb1-47152908acc9
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00170-618-832150-01-1033-7601.0000-1882011
Installation ID: 013651830226413772970130278175082405806230637315644314
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: 7FFJR
License Status: Licensed
Remaining Windows rearm count: 1
Trusted time: 4/30/2013 2:02:11 PM

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 4:30:2013 08:38
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: MgAAAAEAAQABAAEAAAADAAAAAwABAAEAonZgRWKIIJGmalTI6kUCqLWphuM+qU6KQho=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name    OEMID Value    OEMTableID Value
  APIC            HPQOEM        SLIC-CPC
  FACP            HPQOEM        SLIC-CPC
  SRAT            HPQOEM        SLIC-CPC
  HPET            HPQOEM        SLIC-CPC
  MCFG            HPQOEM        SLIC-CPC
  SLIC            HPQOEM        SLIC-CPC
  OEMB            HPQOEM        SLIC-CPC
  SSDT            HPQOEM        SLIC-CPC
  SSDT            HPQOEM        SLIC-CPC

 

[NoelDP]

Intermittent WGA errors like this tend to be caused by race conditions, where two or more processes fight over resources.

Such things can happen where the AV (or malware) is fighting the SPPSVC and associated systems - if SPPSVC loses the fight (or at least doesn't win it within a certain amount of time), then the system gets flagged as non-genuine as it assumes that something is actively blocking it.
Usually, a reboot or two will fix it.

What AV is installed currently? What other security software is installed?
What other AV's have EVER been installed on this machine?
When was the last time you ran a full system scan with updated definitions?

 

[MelCalyx]

This machine is running MSE, and that's the only AV that's ever been installed. I actually ran a full scan with that (definitions are up to date), as well as Malwarebytes, TDSSKiller, Sophos Virus Removal Tool, and the ESET Online scanner when this problem first came up (Because I suspected malware as the culprit, and I never take the word of just one program - might be a little bit of overkill, but I have cleaned a LOT of machines and generally find it takes a village to get them clear.) and short of a tracking cookie or two, everything came back clean.

It's up to date on Windows Updates, save for IE10 because there's a web app she uses that isn't compatible with IE10 currently.

I've told her to try and get hold of me as soon as it comes up - if it does again, in the hopes that I can find some sort of explanation for it.

Ugh! Thanks for the answer --I really do appreciate it-- but ugh!

 

[NoelDP]

Race conditions are a real pain to isolate - as soon as you start trying to track them they disappear into the woodwork, only to reappear when you remove the tracking.

There may be some clues in the Event Logs (System and Application are the best bets) - I'll take a look if you want to upload them, but it's needles/haystacks.