Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Message box appears saying I may be a victim of counterfeit software

23 Dec 2013   #1
rzn6jw

Windows 7 Pro 64-bit Service Pack 1
 
 
Message box appears saying I may be a victim of counterfeit software

Out of the blue, I found the attached message box posted on my desktop. I says that I may be a victim of software counterfeiting and to go online to resolve the issue.

Is this a legit message from Microsoft or do I have a trojan/virus/rootkit trying to gain control (of course I didn't select to go online to resolve the issue)?

Thanks and Merry Christmas.


My System SpecsSystem Spec
.
23 Dec 2013   #2
Golden
Microsoft MVP

Windows 7 Ult. x64
 
 

We can easily check. In order to completely troubleshoot Windows validation & activation issues, please perform the following:

1. Download and save this tool to your desktop:
http://go.microsoft.com/fwlink/?linkid=52012

2. Run the tool, and then click Copy - ignore any errors if they appear

3. Use CTRL+V to paste the unedited results of the tool here in your next reply

More detail: Windows Genuine and Activation Issue Posting Instructions
My System SpecsSystem Spec
23 Dec 2013   #3
rzn6jw

Windows 7 Pro 64-bit Service Pack 1
 
 

Here's the copy:

Code:
 
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
 
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-PDX4R-2Q4MC-J8368
Windows Product Key Hash: 36K63na+fKngCc75KCvsWBRXACs=
Windows Product ID: 00371-152-0935065-85467
Windows Product ID Type: 5
Windows License Type: Retail
Windows OS version: 6.1.7601.2.00010100.1.0.048
ID: {21AF8073-4513-4E44-9AC4-B5F153A10FC4}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Professional
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130828-1532
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
 
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
 
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
 
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
 
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Home and Student 2007 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
 
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
 
File Scan Data-->
 
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{21AF8073-4513-4E44-9AC4-B5F153A10FC4}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-J8368</PKey><PID>00371-152-0935065-85467</PID><PIDType>5</PIDType><SID>S-1-5-21-1527527429-2520481382-2976781397</SID><SYSTEM><Manufacturer>MSI</Manufacturer><Model>MS-7612</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>V1.4</Version><SMBIOSVersion major="2" minor="6"/><Date>20100812000000.000000+000</Date></BIOS><HWID>A74F3C07018400F6</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification/></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{91120000-002F-0000-0000-0000000FF1CE}"><LegitResult>100</LegitResult><Name>Microsoft Office Home and Student 2007</Name><Ver>12</Ver><Val>5E34EBF2D164F26</Val><Hash>/1yf03PWHoQPzTgWJA6obL9h2Oo=</Hash><Pid>81602-915-2740591-68558</Pid><PidType>1</PidType></Product></Products><Applications><App Id="16" Version="12" Result="100"/><App Id="18" Version="12" Result="100"/><App Id="1B" Version="12" Result="100"/><App Id="A1" Version="12" Result="100"/></Applications></Office></Software></GenuineResults> 
 
Spsys.log Content: 0x80070002
 
Licensing Data-->
Software licensing service version: 6.1.7601.17514
 
Name: Windows(R) 7, Professional edition
Description: Windows Operating System - Windows(R) 7, RETAIL channel
Activation ID: e838d943-63ed-4a0b-9fb1-47152908acc9
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00371-00170-152-093506-01-1033-7600.0000-0502010
Installation ID: 005512877760213332056531276606163724887346938542487331
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: J8368
License Status: Licensed
Remaining Windows rearm count: 4
Trusted time: 12/23/2013 7:13:24 PM
 
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 11:7:2013 01:46
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:
 
 
HWID Data-->
HWID Hash Current: OAAAAAIABAABAAEAAAADAAAAAgABAAEAhFH+VkbbjIYoQtQUPgqWknDuGr+CMhZDeKLYwCRkAtA=
 
OEM Activation 1.0 Data-->
N/A
 
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes, but no SLIC table
Windows marker version: N/A
OEMID and OEMTableID Consistent: N/A
BIOS Information: 
ACPI Table Name OEMID Value OEMTableID Value
APIC 7612MS A7612200
FACP 7612MS A7612200
SRAT AMD FAM_F_10
MCFG 7612MS OEMMCFG 
OEMB 7612MS A7612200
INFO 7612MS AMDINFO 
NVHD 7612MS NVHDCP 
SSDT A M I POWERNOW
My System SpecsSystem Spec
.

23 Dec 2013   #4
whs
Microsoft MVP

Vista, Windows7, Mint Mate, Zorin, Windows 8
 
 

Check which process issued the message.

Error Message - Where Does it Come From
My System SpecsSystem Spec
23 Dec 2013   #5
gregrocker
Microsoft MVP

 

Where did you get WIn7? How long has it been installed?

Was there anything that was done before you got the error message?

I would try reactivating with the retail Product Key to see what happens. It may resolve the issue, or it may be rejected leading to Activate Windows 7 by Phone


If all fails activation you have the option to file a case with MS Customer Service to investigate non-genuine software you were sold. If you cooperate with this they may award you a free copy.
My System SpecsSystem Spec
23 Dec 2013   #6
rzn6jw

Windows 7 Pro 64-bit Service Pack 1
 
 

WHS: That was a good video and all fine and dandy but I didn't have Process Explorer running.

Gregrocker: I have had Win 7 Pro installed for several years without this message. Also, the message was on my desktop after I came back to the PC from several hours being away, so I don't know if something tried to install or what. Also, I went into Control Panel/System and did a Windows activation there and everything seems to be OK.

In the System Event Viewer there was a message: The start type of the Windows Modules Installer service was changed from demand start to auto start and then: The start type of the Windows Modules Installer service was changed from auto start to demand start but I didn't initiate those. It's almost like something tried to install.

Also, just before I got back on the PC, the Application Event log showed: The Software Protection service has completed licensing status check with a bunch of information below the message. Could this check have caused the message?
My System SpecsSystem Spec
23 Dec 2013   #7
rzn6jw

Windows 7 Pro 64-bit Service Pack 1
 
 

WHS: That was a good video and all fine and dandy but I didn't have Process Explorer running.

Gregrocker: I have had Win 7 Pro installed for several years without this message. Also, the message was on my desktop after I came back to the PC from several hours being away, so I don't know if something tried to install or what. Also, I went into Control Panel/System and did a Windows activation there and everything seems to be OK.

In the System Event Viewer there was a message: The start type of the Windows Modules Installer service was changed from demand start to auto start and then: The start type of the Windows Modules Installer service was changed from auto start to demand start but I didn't initiate those. It's almost like something tried to install.

Also, just before I got back on the PC, the Application Event log showed: The Software Protection service has completed licensing status check with a bunch of information below the message. Could this check have caused the message?

Also just after this was the message A request to disable the Desktop Window Manager was made by process (Windows System Assessment Tool). What was that all about?
My System SpecsSystem Spec
23 Dec 2013   #8
Golden
Microsoft MVP

Windows 7 Ult. x64
 
 

What anti-virus suite are you running?
My System SpecsSystem Spec
24 Dec 2013   #9
NoelDP

Microsoft Community Contributor Award Recipient

Win 7 x64 Home Premium (and x86 VirtualBox VM)/Win10
 
 

Quote   Quote: Originally Posted by rzn6jw View Post
In the System Event Viewer there was a message: The start type of the Windows Modules Installer service was changed from demand start to auto start and then: The start type of the Windows Modules Installer service was changed from auto start to demand start but I didn't initiate those. It's almost like something tried to install.
That is a normal message for when there is a pending install - possibly of an update. you can safely ignore it.

There are no obvious problems in the MGADiag report - are you seeing the non-genuine notification all the time, (bottom right of the desktop)? - or does it come and go?

Please attempt validation at www.microsoft.com/genuine/validate using Internet Explorer - what happens?
My System SpecsSystem Spec
25 Dec 2013   #10
rzn6jw

Windows 7 Pro 64-bit Service Pack 1
 
 

Validation via IE worked fine. This was the first time I saw the message. I never had anything like this in any of the Windows I've ever ran so it raised a flag when I saw it.

Thanks everybody and enjoy the holidays!
My System SpecsSystem Spec
Reply

 Message box appears saying I may be a victim of counterfeit software




Thread Tools




Similar help and support threads
Thread Forum
Counterfeit Software Error
I have a headless Windows 7 Pro machine. The machine just runs, and I rarely have any issues with it. However, a couple of day's ago, the machine hung, and I had to power cycle it. Today I RDP'd in and saw a warning that my OS is counterfeit and that I had to register it. I did a little...
Windows Updates & Activation
Message pop up 'you may be victim of software counterfeiting'
the desktop turned black and the following message is shown on the bottom right corner of the desktop: Windows7 Build 7601 This copy of Windows is not genuine I have a genuine Windows 7 version installed. I tried several methods in my efforts to get rid of the distracting message but failed....
General Discussion
WAT message- My system is running a counterfeit copy of windows
Few months similar kind of message was getting displayed after I start my system. I contacted a person , he downloaded REMOVE -WAT software onto my system , it worked well until now. Again that same error is coming and "Remove WAT " software is not working. I am attaching results of MGAD tool ....
Windows Updates & Activation
What does “victim of counterfeit software” really mean?
More...
News
Counterfeit Software
First of all I appologize, i wasnt sure what category to place this topic under. I recently installed build 7137. Setup and activation (with Key i received from previous beta version) went smooth and everything has been working great for the past 4 days. out of nowhere today, i got a popup saying...
General Discussion


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 17:52.
Twitter Facebook Google+