locked
Trouble with "counterfeit XP" RRS feed

  • Question

  • Hello,

    I started getting the "you may be a victim of software counterfeiting" three days ago for my Windows XP Pro.

    I will say that the last three parts of the product key does NOT match the product key on my label which I installed personally when I built this computer two plus years ago.

    Following instructions on another thread, I tried MS's Key Update tool and the response was "The product key entered is not a valid key for this system.  Please check it for typing errors and try again."

    First of all, what could have caused this switch?

    Could someone help me get to the bottom of this?

    Thank you in advance.

    David


    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    Validation Status: Blocked VLK
    Validation Code: 3
    Cached Validation Code: N/A
    Windows Product Key: *****-*****-6BKXT-M8JJ6-RPXGJ
    Windows Product Key Hash: 5nTiWPHCccmBwT7jn+WSWXJC39g=
    Windows Product ID: 55274-640-1464517-23629
    Windows Product ID Type: 1
    Windows License Type: Volume
    Windows OS version: 5.1.2600.2.00010100.3.0.pro
    ID: {DDF947CD-CBBC-4B1C-91A4-017461133DAE}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: Registered, 1.9.42.0
    Signed By: Microsoft
    Product Name: N/A
    Architecture: N/A
    Build lab: N/A
    TTS Error: N/A
    Validation Diagnostic: 025D1FF3-230-1
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A
    Version: N/A

    Windows XP Notifications Data-->
    Cached Result: 3
    File Exists: Yes
    Version: 1.9.40.0
    WgaTray.exe Signed By: Microsoft
    WgaLogon.dll Signed By: Microsoft

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-230-1

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: D:\Program Files\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{DDF947CD-CBBC-4B1C-91A4-017461133DAE}</UGUID><Version>1.9.0027.0</Version><OS>5.1.2600.2.00010100.3.0.pro</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-RPXGJ</PKey><PID>55274-640-1464517-23629</PID><PIDType>1</PIDType><SID>S-1-5-21-1390067357-764733703-725345543</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>GA-MA785GMT-UD2H</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F5</Version><SMBIOSVersion major="2" minor="4"/><Date>20091130000000.000000+000</Date></BIOS><HWID>04C9352701844074</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification><File Name="WgaTray.exe" Version="1.9.40.0"/><File Name="WgaLogon.dll" Version="1.9.40.0"/></GANotification></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

    Licensing Data-->
    N/A

    Windows Activation Technologies-->
    N/A

    HWID Data-->
    N/A

    OEM Activation 1.0 Data-->
    BIOS string matches: yes
    Marker string from BIOS: 14A00:SYNNEX TECHNOLOGY INTERNATIONAL CORP|14A00:SYNNEX TECHNOLOGY INTERNATIONAL CORP|14A00:SYNNEX TECHNOLOGY INTERNATIONAL CORP
    Marker string from OEMBIOS.DAT: N/A, hr = 0x80004005

    OEM Activation 2.0 Data-->
    N/A

    • Edited by Dundunbop Wednesday, January 16, 2013 12:23 AM
    Tuesday, January 15, 2013 9:34 PM

Answers

  • OK.  I found the answer:  I have a counterfeit.  After two weeks of all sorts of crazy and stressful hoop jumping, including installing all sorts of anti-malware software, all I had to do was look at the disk itself.  So to those who find themselves reading this thread and hopefully scan to the bottom first:  Look at your disk.  If the hologram sticker is on the outside of the disk it is a counterfeit, i.e. if you run your fingernail and it catches on the wavy part of the circumference, then you got taken like me.  The hologram should be embedded inside the disk, otherwise these counterfeits are amazingly well done, with shrink wrap, booklet, and disk... yet it only took a brush of a fingernail to know... I'm surprised it's not in the "read me before posting" post.


    Monday, February 4, 2013 5:14 AM
  • I guess you ought to contact Microsoft Genuine Advantage Support and ask them to help sort this problem out.  They are the only ones who can determine if your product key is actually genuine or not.


    Carey Frisch

    Saturday, January 26, 2013 3:42 AM
    Moderator

All replies

  • Does your COA sticker state which version of Windows it's valid for?

    The usual reason for a change in the Key of this type is sending the machine to a disreputable store for repair - or manual intervention.

    You may have to do a clean install, but see if you can get assistance from an activation center....

    http://support.microsoft.com/kb/950929


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Wednesday, January 16, 2013 12:02 PM
    Moderator
  • Thank you, Mr. Paton,

    At the top of the sticker: "Windows (r) XP Professional  OEM Software"

    A curiosity: I ran Belarc Advisor as well and it showed both the product key for XP and for Explorer.  Only the Explorer matched my product key.

    I must have picked up a virus that changes product keys, does nothing else, and leaves.  The US gov warned of the Java problem and I wonder if I was a victim of that.  I shut off Java the day before only to find the need to turn Java on again 4 hours later in order to submit a document to the patent office, ironically, of the US gov.  Later that night I played my brother online with a game that most certainly used Java.  But other than waking up next morning to the counterfeit warning there has been no other issues.

    I've run a full scan and nothing has been detected.

    I'll try the activation center as you suggest.

    Thanks again.

    Wednesday, January 16, 2013 4:48 PM
  • Interesting Belarc result!

    You may want to run CHKDSK and SFC scans to make sure that there's no file system corruption present before hitting the phone.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Wednesday, January 16, 2013 5:49 PM
    Moderator
  • Running CHKDSK the following happens:

    >>

    Verifying files (Stage 1 of 3) [seems normal so far]

    Verifying indexes (Stage 2 of 3)

    "Recovering lost files"

    Verifying security descriptors (Stage 3 of 3)

    The command prompt window closes faster than I can read what it says.

    <<

    The 2nd and all subsequent times I run it, it has added the following at the top:

    "Warning! F Parameter not specified

    Running CHKDSK in read-only mode."

    I'm going to run CHKDSK again hit "Alt-Print Screen" right before it closes and see if I can bring up the image and read it...

    OK image captured.  The last thing it said before closing abruptly:

    >>

    Deleting index entry globaLoadable.bak in index $I30 of file 165817.

    Deleting index entry globaLoadable.gdb in index $I30 of file 165817.

    Deleting index entry GLOBA~1.BAK in index $I30 of file 165817.

    Deleting index entry GLOBA~1.BAK in index $I30 of file 165817.

    <<

    Although this time it happened after stage 2.  The time before stage 2 seemed fine and it closed quickly after stage 3.



    =================================

    Running SFC:

    Command Prompt closes immediately.  Caught it with PrtScn.  It just simply lists the various SFC options and what they do from: SCANNOW through CACHESIZE=x. 

    In the meantime I might try one of those SFC/* options.



    • Edited by Dundunbop Wednesday, January 16, 2013 7:12 PM
    Wednesday, January 16, 2013 6:41 PM
  • You need to run the following command with CHKDSK

    CHKDSK C: /F

    You will be told the disk is locked - accept the warning, then reboot, and the check will run on the reboot.

    You need to use the following command for SFC

    SFC /SCANNOW

    you will need you Windows XP disk handy


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Wednesday, January 16, 2013 7:16 PM
    Moderator
  • Running CHKDSK C: /F

    Windows closes quickly but from print screen I get the following:

    >>

    The type of the file is system FAT32.

    Volume Serial Number is ****-**** (I'll keep numbers like that off the internet unless you request it.)

    Windows is verifying files and folders...

    Windows has checked the file system and found no problems.

    32,748,528 KB total disk space....

    <<

    My XP is on drive D: if that makes a difference (i.e., should I have used CHKDSK D: /F?)

    ==========

    I will try SFC /SCANNOW, disk at the ready, and update.

    Thank you again

    Wednesday, January 16, 2013 7:27 PM
  • in that case, run

    CHKDSK D: /F


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.


    Wednesday, January 16, 2013 7:38 PM
    Moderator
  • Running CHKDSK D: /F

    On reboot it went through stages 1-3 then moved onto starting XP before I could read anything.

    ======================

    Running SFC /SCANNOW

    I provided the disk as asked for.  It ran "Checking for dll's" (paraphrasing).  For 5 minutes it ran and hummed while I was organizing and cleaning the office, periodically checking.  Last check: as if nothing happened.  Just the desktop and this browser.  If there was any info or brief window I may have missed it.

    =====================

    Side note:

    As I was restarting for CHKDSK D: /F the "Turn off" option was offering "updates for my computer."  I thought that was odd because in this recent research I read you couldn't get updates if Microsoft (incorrectly) thought your version was counterfeit.  Anyways I didn't go opt for the updates this time because I didn't want to add another variable just yet.

    =====================

    For "fun" I ran CHKDSK again:

    This time I caught the print screen at:

    >>

    (stage 1 of 3)... verification completed.

    (stage 2 of 3)... verification completed.  CHKDSK is recovering lost files. Recovering orphaned file tmp.edb (7870) into directory file 10203.

    (stage 3 of 3)...verification completed.

    CHKDSK is verifying Usn Journal...Usn Journal verification completed.

    <<

    Abruptly closed

    Wednesday, January 16, 2013 8:14 PM
  • You'll find the results of both the CHKDSK and SFC scans in the Event Viewer logs.

    Try the Product Key Update tool again, and see if it works this time. If not, then phone an activation center and see if they can assist. http://support.microsoft.com/kb/950929


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Wednesday, January 16, 2013 8:43 PM
    Moderator
  • Found the solution and it was really easy in the end after all the hair pulling days*.

    For anyone else who this might be useful for:

    Download and run WinKeyFinder

    Select "Change Key"

    Enter your correct product key

    Enjoy

    dd

    *No need to call Microsoft.  No need to reinstall.  No need to lose data.

    Friday, January 25, 2013 3:26 AM
  • Not so fast.  The entire text of the Microsoft Windows XP End User License Agreement would also have to be changed which "WinKeyFinder" does not do.

    Carey Frisch

    Friday, January 25, 2013 3:34 AM
    Moderator
  • Ok. If I may pull some teeth.  Are you and Noel saying 1) that even if I correct my product key to my original one, the powers that be won't recognize the correction unless some further step is taken, or 2) that my original product key although "working" is still considered a bad one, or 3) that my product key is some sort of member of a subset of the "*****-*****-6BKXT-M8JJ6-RPXGJ" product volume license key, again a "bad one," and that I was duped into buying what I thought was a genuine copy of XP that wasn't all along.

    For you amusement, I present:

    My new MGADiag

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->
    Validation Status: Invalid Product Key
    Validation Code: 8
    Cached Validation Code: N/A
    Windows Product Key: *****-*****-QQWXH-KV2TX-Q3KB8
    Windows Product Key Hash: lgxeaYszwUvjzxG1A8bfBqsRGFE=
    Windows Product ID: 55274-640-8432434-23826
    Windows Product ID Type: 1
    Windows License Type: Volume
    Windows OS version: 5.1.2600.2.00010100.3.0.pro
    ID: {DDF947CD-CBBC-4B1C-91A4-017461133DAE}(3)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: Registered, 1.9.42.0
    Signed By: Microsoft
    Product Name: N/A
    Architecture: N/A
    Build lab: N/A
    TTS Error: N/A
    Validation Diagnostic: 025D1FF3-230-1
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A
    Version: N/A

    Windows XP Notifications Data-->
    Cached Result: 8
    File Exists: Yes
    Version: 1.9.40.0
    WgaTray.exe Signed By: Microsoft
    WgaLogon.dll Signed By: Microsoft

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-230-1

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE; Win32)
    Default Browser: D:\Program Files\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{DDF947CD-CBBC-4B1C-91A4-017461133DAE}</UGUID><Version>1.9.0027.0</Version><OS>5.1.2600.2.00010100.3.0.pro</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-Q3KB8</PKey><PID>55274-640-8432434-23826</PID><PIDType>1</PIDType><SID>S-1-5-21-1390067357-764733703-725345543</SID><SYSTEM><Manufacturer>Gigabyte Technology Co., Ltd.</Manufacturer><Model>GA-MA785GMT-UD2H</Model></SYSTEM><BIOS><Manufacturer>Award Software International, Inc.</Manufacturer><Version>F5</Version><SMBIOSVersion major="2" minor="4"/><Date>20091130000000.000000+000</Date></BIOS><HWID>04C9352701844074</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Central Standard Time(GMT-06:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification><File Name="WgaTray.exe" Version="1.9.40.0"/><File Name="WgaLogon.dll" Version="1.9.40.0"/></GANotification></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

    Licensing Data-->
    N/A

    Windows Activation Technologies-->
    N/A

    HWID Data-->
    N/A

    OEM Activation 1.0 Data-->
    BIOS string matches: yes
    Marker string from BIOS: 14A00:SYNNEX TECHNOLOGY INTERNATIONAL CORP|14A00:SYNNEX TECHNOLOGY INTERNATIONAL CORP|14A00:SYNNEX TECHNOLOGY INTERNATIONAL CORP
    Marker string from OEMBIOS.DAT: N/A, hr = 0x80004005

    OEM Activation 2.0 Data-->
    N/A

    Friday, January 25, 2013 7:11 AM
  • Visit: http://windows.microsoft.com/en-US/windows/help/genuine/product-key and click on the Windows XP tab to access the Microsoft Windows XP Product Key Update Tool.  Let us know if it works for you.

    Carey Frisch

    Friday, January 25, 2013 7:59 AM
    Moderator
  • It states "The product key is the same as the one currently in use.  Please try again."
    Friday, January 25, 2013 3:41 PM
  • I guess you ought to contact Microsoft Genuine Advantage Support and ask them to help sort this problem out.  They are the only ones who can determine if your product key is actually genuine or not.


    Carey Frisch

    Saturday, January 26, 2013 3:42 AM
    Moderator
  • In the effort to fix this product key problem, I decided to do a REPAIR INSTALL.  I accidentally executed a CLEAN INSTALL.

    That has resulted in a dual-boot option at the start.  I have essentially installed XP twice on the same partition.

    Option 1) takes me to the generic XP sp2. Option 2) takes me back to my previous XP upgraded to sp3 with all my files, settings, and data intact.

    Can I delete "Option 1" somehow, i.e. the latest installation?  I want to go back to doing the REPAIR INSTALL and I am concerned the repair won't know which version of xp to fix...

    Thank you in advance.

    Saturday, February 2, 2013 3:50 PM
  • To be honest - I have no idea!

    Your best option is to post your (new) problem to the Microsoft Community forums at http://answers.microsoft.com/en-us/windows/forum/windows_xp-system and see if they can help.


    Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth
    No - I do not work for Microsoft, or any of its contractors.

    Saturday, February 2, 2013 4:50 PM
    Moderator
  • OK.  I found the answer:  I have a counterfeit.  After two weeks of all sorts of crazy and stressful hoop jumping, including installing all sorts of anti-malware software, all I had to do was look at the disk itself.  So to those who find themselves reading this thread and hopefully scan to the bottom first:  Look at your disk.  If the hologram sticker is on the outside of the disk it is a counterfeit, i.e. if you run your fingernail and it catches on the wavy part of the circumference, then you got taken like me.  The hologram should be embedded inside the disk, otherwise these counterfeits are amazingly well done, with shrink wrap, booklet, and disk... yet it only took a brush of a fingernail to know... I'm surprised it's not in the "read me before posting" post.


    Monday, February 4, 2013 5:14 AM