I have no idea what is going on with these. I check before defragging and again afterwards. Some days, they are there, and some days they are not. All rhyme and reason appears to have gone to the wall. One thing I do know is that System Restore on this computer is not something I would ever rely on.
The link will take you to the Microsoft pages on counterfeit Windows and Office http://www.microsoft.com/howtotell/content.aspx?displaylang=en&pg=prepurchase The counterfeit gallery is particularly interesting. A quick glance at the COA sticker clearly is not enough anymore, but it should come as no surprise. Counterfeiting has been and remains a profitable industry, preying on people who like to get a bargain. Anyway, it is definitely worth a look even if you do not plan to buy from shady sources.