Solved Windows now says that my copy is counterfeit.

[subwayjm]

I built a new PC a little over 2 years now and bought everything, nothing was second hand or salvaged from other computers. I have never had any issues with my copy of Windows 7 Ultimate x64 till now. I received my copy in a sealed case and with the key sticker on the outside still intack. About a month ago I started having issues with not being able to install any updates and did not think anything this serious. I ran some virus scans with no viruses found. I use Avast and SpyBit S&D.


I contacted Microsoft to try to get it resolved only to get the reply of "you have a counterfeit copy". After hours of reading forums and trying to re-apply my key, I have come to the conclusion that I may have contracted a virus of some sort. So my next course of action is to go ahead and do a full reinstall. Though I do not want do reinstall only for it to say this is a fake copy again. So maybe someone out there has a solution for me.

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-MDWT6-P8JGW-JPXTM
Windows Product Key Hash: UIStqASRIerJXztZ4G+mQIhVz3g=
Windows Product ID: 00426-OEM-9154216-39554
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {727B7B83-5D4B-4E8A-BE4F-CE2BD85EA4DA}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.9.42.0
Signed By: Microsoft
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.110622-1506
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{727B7B83-5D4B-4E8A-BE4F-CE2BD85EA4DA}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-JPXTM</PKey><PID>00426-OEM-9154216-39554</PID><PIDType>3</PIDType><SID>S-1-5-21-3375088572-3281612960-3250069356</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>1704   </Version><SMBIOSVersion major="2" minor="5"/><Date>20091230000000.000000+000</Date></BIOS><HWID>EB203807018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: cfb3e52c-d707-4861-af51-11b27ee6169c
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00182-542-139554-02-1033-7601.0000-1062012
Installation ID: 008370709804325614891422819636341662153183158261094712
Processor Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88338[/URL]
Machine Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88339[/URL]
Use License URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88341[/URL]
Product Key Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88340[/URL]
Partial Product Key: JPXTM
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 4/15/2012 11:47:02 PM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000000080
Event Time Stamp: 4:15:2012 16:46
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppwinob.dll

HWID Data-->
HWID Hash Current: PAAAAAMABAABAAEAAQADAAAAAgABAAEACraGiXcWBCGorIwmRrxoZYQ04BAUCgqAYj2UItVfKIoACeqC
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name OEMID Value OEMTableID Value
  APIC   123009  APIC1822
  FACP   123009  FACP1822
  HPET   123009  OEMHPET 
  MCFG   123009  OEMMCFG 
  OEMB   123009  OEMB1822
  OSFR   123009  OEMOSFR 
  SSDT   DpgPmm  CpuPm

 

[wanchoo]

Did you contact Microsoft on the phone and got this reply (I contacted Microsoft to try to get it resolved only to get the reply of "you have a counterfeit copy") after explaining the matter to their Rep?

 

[profdlp]

When and where did you obtain your copy of Windows 7?

What is the date and size of the folling file: sppwinob.dll which should be located here:

Tampered File: %systemroot%\system32\sppwinob.dll

 

[NoelDP]

As has been pointed out, your problem is the 'Tampered file' sppwinob.dll
Since this file also appears as a file mismatch, it may have been substituted or corrupted by malware.
Have you had any problem with malware recently? What AV and other seciruty software are you running?


To attempt to address this, please run the standard file system tools....
Please run CHKDSK and SFC scans -
type in the Search box
CMD.EXE
right-click on the only file that is found
Select Run as Administrator
- the Elevated Command Prompt window should pop up
At the Command prompt, type
CHKDSK C: /R
and hit the Enter key
You will be told that the drive is locked, and the CHKDSK will run at he next boot
- hit the Y key, and then reboot. The chkdsk will take a few hours depending on the size of the drive, so be patient!

After the CHKDSK has run, Windows should boot normally (possibly after a second auto-reboot)
- then run the SFC

SFC -System File Checker - Instructions
Click on the Start button
type in the Search box
CMD.EXE
right-click on the only file that is found
Select Run as Administrator
- the Elevated Command Prompt window should pop up
At the Command prompt, type

SFC /SCANNOW

and hit the Enter key
Wait for the scan to finish - make a note of any error messages
- and then reboot.
Post a new MGADiag report with details of any error messages encountered.

<edit> Oh - and there is no sign whatever that the system is counterfeit! </edit>

 

[ignatzatsonic]

I received my copy in a sealed case and with the key sticker on the outside still intack..........I contacted Microsoft to try to get it resolved only to get the reply of "you have a counterfeit copy"...........I have come to the conclusion that I may have contracted a virus of some sort.

Anything is possible.

But, since you haven't told us anything about the pedigree of your Windows 7 disc, it's entirely possible you have a counterfeit disc, as Microsoft says.

The world is full of counterfeit discs "in a sealed case and with the key sticker on the outside".

If it's a fake, Microsoft may make it good, depending on the surrounding circumstances--of which we know nothing.

 

[subwayjm]

@Wanchoo: Yeah even after explaining that I have had it for 2 years he said I got a counterfeit copy. He walked me through a few webpages that i guess verify it. Though to be honest he seemed like he just wanted me off the phone.


@Profdlp: I got my copy from Newegg about 2 years ago. It came in a sealed case with the halogram CD and the authenticity sticker for me to attach to my PC. The date shows 11/20/10 and the size is 409 KB.


@NoelDP: I will try that as soon as I get done replying here. I am currently running Avast and SpyBot S&D. I cannot recall any issues of late with and attacks.


@Ignatzatsonic: When I say sealed case I mean original packaging with a halogram CD inside and the authenticity sticker still afixed to the removable backing(as in the backing that you would find on any sticker). To me what I got seems to be ginuine and looks authentic. Unless counterfeits go to great lenths to make their packaging look realistic.

 

[ignatzatsonic]

@Ignatzatsonic: Unless counterfeits go to great lenths to make their packaging look realistic.

Counterfeiters do exactly that. Otherwise, how could you fool anyone?

However, if I understand correctly, you got it from Newegg?

If so, I would assume it is legitimate. Again, anything is possible.

 

[subwayjm]

Yeah I bought it along with the majority of my parts from newegg. Some specialty parts I went to other sites for but I got the new SSD and OS from Newegg. Thanks for your concern that I may still be looking at a counterfeit copy. Your right if they wanted to sell something as ginuine they would make it look as legit as they could.

 

[ignatzatsonic]

Yeah I bought it along with the majority of my parts from newegg. Some specialty parts I went to other sites for but I got the new SSD and OS from Newegg. Thanks for your concern that I may still be looking at a counterfeit copy. Your right if they wanted to sell something as ginuine they would make it look as legit as they could.

If you bought it from Newegg and can prove it, I'd have to think Microsoft or Newegg would ultimately make it good.

My guess would be that it is legit, but you have some other issue going on.

 

[subwayjm]

I am leaning towards that too. I am about on the verge of just redoing a fresh install. I have most of my important files backed-up on a external drive it is just a matter of reinstalling and gettting all the updates. I really hate having to do it as I am sure most here have had to do it a time or two Going to hold out till I do the chkdsk and SFC scan to see if that opens up another option. Right now I am in the middle of installing a game(lol I know installing right before I do a fresh reinstall) that I had a friend refer me to. Thanks for advice so far guys.

 

[profdlp]

...@Profdlp: I got my copy from Newegg about 2 years ago. It came in a sealed case with the halogram CD and the authenticity sticker for me to attach to my PC. The date shows 11/20/10 and the size is 409 KB...

The date and size match what is on my system exactly.

I asked about when and where you got is because there are a lot of people who pick up sophisticated fakes off eBay or something. Those are sometimes cracked with a file which it takes Microsoft a while to catch up to. The fact that you got it from Newegg a couple years ago with the rest of the systems makes me pretty sure that you either had a corrupt install or MS just mistakenly flagged you. Either way I'm sure it can be straightened out.

 

[Jacee]

See if this answer applies to you Validating My Windows Software

 

[subwayjm]

now that is a cocern that ran through my head. does microsoft flag my product key to the point where even a reinstall would still show it as counterfeit?

 

[Jacee]

Let's see what CKScanner says ...

Download CKScanner by askey127 from HERE
Important - Save it to your desktop.
Doubleclick CKScanner.exe and click Search For Files.
After a very short time, when the cursor hourglass disappears, click Save List To File.
A message box will verify the file saved.
Double-click the CKFiles.txt icon on your desktop and copy/paste the contents in your next reply.

 

[subwayjm]

CKScanner - Additional Security Risks - These are not necessarily bad
scanner sequence 3.RP.11.DXCPEH
----- EOF -----


And when I tried to install the rapid storage drive it said:

Computer does not meet requirments.

 

[Jacee]

Something else to read regarding these two items:
Spsys.log Content: 0x80070002
Tampered File: %systemroot%\system32\sppwinob.dll


System went into a Tamper State, Spsys.log Content decryption

 

[NoelDP]

Please people - the last few posts have either confused the issue, or repeated what's already been said.

Let's give the OP a chance to digest the offerings, and respond as appropriate, before deluging them with what are (in some instances) irrelevancies.

 

[subwayjm]

@NoelDP: I ran the chkdsk and all I could get out of it since it went so fast was this error:

Replaced bad cluster 502 windows\logs\system~1\RE5479~1.ETL


The SFC scan says it found currupted files and has created a log. The log is huge and it does not let me open it. I assume I need the windows repair kit thing to open and read it. In the past I diabled with it some but could not make head or tails of it.

 

[subwayjm]

After those tests here is a new report:

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0x8004FE21
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-MDWT6-P8JGW-JPXTM
Windows Product Key Hash: UIStqASRIerJXztZ4G+mQIhVz3g=
Windows Product ID: 00426-OEM-9154216-39554
Windows Product ID Type: 3
Windows License Type: OEM System Builder
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {727B7B83-5D4B-4E8A-BE4F-CE2BD85EA4DA}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.9.42.0
Signed By: Microsoft
Product Name: Windows 7 Ultimate
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.110622-1506
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
File Mismatch: C:\Windows\system32\sppwinob.dll[6.1.7601.17514], Hr = 0x80092003
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{727B7B83-5D4B-4E8A-BE4F-CE2BD85EA4DA}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-JPXTM</PKey><PID>00426-OEM-9154216-39554</PID><PIDType>3</PIDType><SID>S-1-5-21-3375088572-3281612960-3250069356</SID><SYSTEM><Manufacturer>System manufacturer</Manufacturer><Model>System Product Name</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>1704   </Version><SMBIOSVersion major="2" minor="5"/><Date>20091230000000.000000+000</Date></BIOS><HWID>EB203807018400FE</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, Ultimate edition
Description: Windows Operating System - Windows(R) 7, OEM_COA_NSLP channel
Activation ID: cfb3e52c-d707-4861-af51-11b27ee6169c
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00426-00182-542-139554-02-1033-7601.0000-1072012
Installation ID: 008370709804325614891422819636341662153183158261094712
Processor Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88338[/URL]
Machine Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88339[/URL]
Use License URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88341[/URL]
Product Key Certificate URL: [URL]http://go.microsoft.com/fwlink/?LinkID=88340[/URL]
Partial Product Key: JPXTM
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 4/16/2012 7:19:26 PM
Windows Activation Technologies-->
HrOffline: 0x8004FE21
HrOnline: N/A
HealthStatus: 0x0000000000000080
Event Time Stamp: 4:15:2012 16:46
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
Tampered File: %systemroot%\system32\sppwinob.dll

HWID Data-->
HWID Hash Current: PAAAAAMABAABAAEAAQADAAAAAgABAAEACraGiXcWBCGorIwmRrxoZYQ04BAUCgqAYj2UItVfKIoACeqC
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
  ACPI Table Name OEMID Value OEMTableID Value
  APIC   123009  APIC1822
  FACP   123009  FACP1822
  HPET   123009  OEMHPET 
  MCFG   123009  OEMMCFG 
  OEMB   123009  OEMB1822
  OSFR   123009  OEMOSFR 
  SSDT   DpgPmm  CpuPm

 

[NoelDP]

The fact that the CHKDSK found even one bad cluster is a pontential indicator that the hard drive may be on the way out.
You should back up your data to external media now - before doing anything more.

Once that's done, download the hard disk manufacturer's disk test utility, and create the boot CD.
Boot to the utility and run the Quick test - if that reports errors, then you probably have a failing drive.
Run the Long test - at the end it may offer to try and fix problems. Accept that, and then run another Long test to check the results.