I have seen in two Windows 7 SP1 machines in the past 2 weeks that have a problem I could not figure out. For some reason, each machine would suddenly indicate that the "This copy of windows is not genuine", even though it clearly is and licensed through our KMS. One thing I did notice is the the Plug and Play service was missing on each machine and none of the network interfaces were displayed in device manager or the command prompt. I ran sfc /scannow and showed nothing wrong. Ran every malware/virus scanner I can get my hands on, nothing found. The only thing in common was that they both were infected with a trojan about a week earlier. Any ideas.

Hi, Ronald you shuold make a call to Microsoft support for all lisence issue. More information refers below link: http://social.technet.microsoft.com/Forums/en-US/w7itproinstall/thread/e197c7e1-160e-4c2f-b594-e97daa13decb Also, you would get more sense from the below topic: I see messages that Windows might not be genuine. How do I fix this?

Hi, Ronald you shuold make a call to Microsoft support for all lisence issue. More information refers below link: http://social.technet.microsoft.com/Forums/en-US/w7itproinstall/thread/e197c7e1-160e-4c2f-b594-e97daa13decb Also, you would get more sense from the below topic: I see messages that Windows might not be genuine. How do I fix this?

To correct the issue, I exported the PlugNPlay registry keys from a good workstation and imported them to the affected workstations and the issue was resolved.

Currently we are seeing this on systems infected by zero access rootkit There were other services missing including plug and play.You could this tool to get the list of missing services and to know if zero access is still on the system http://www.bleepingcomputer.com/download/rkill/