- Can a website really fake a response given to a network scanner?
Yes, but very few intentially fake responses. However, that doesn't mean you won't get incorrect fingerprint results on a regular basis; there are more common reasons for incorrect results. Many network scanners will have invalid responses due to just configuration changes from the OS's default, or in Nmap's case an inability to gather all of the required data to construct a full fingerprint. To get the most accurate Nmap fingerprint possible, the target host must (see the Nmap book on the topic),
1. Have at least one open TCP port
2. Have at least one closed TCP port
3. Have at least one closed UDP port
4. Respond to ICMP Echo requests
Part of the power of the Nmap OS scanner compared to simpler tools is that it combines tests from multiple protocols and attempts to produce a result that's a combination of many different probes, but it's also a downside because many hosts won't respond to all the probes needed to generate a full fingerprint (many machines block ICMP pings for instance). It will fill in default values for the missing tests and hope that the tests it could run on the host are enough to distinguish it's identity, but in most cases the best you'll get is a "fuzzy" match (not an exact fingerpring match, but something that is close).
Writing fingerprinting tools is a hard task, many operating systems behave in a very similar fashion, and distinguishing between them can be next to impossible. As you've already seen, many versions of Windows (in this case Windows 7 and Server 2008) get lumped together because the network stack implementations are identical or near identical.
Another problem that can sometimes change results is packet timing and network delay. Several of the Nmap fingerprint features rely on exact timing between probes sent and the response, combined with things like TCP Timestamps and sequence numbers. If a packet is delayed for a second because of a bit of lag, a resend somewhere along the routing path, or a CPU usage spike in the target machine, you can actually see differences in the Nmap fingerprint, meaning running an Nmap OS scan on the same target more than once can give you slightly different results!
- Nowadays is there a tool which is able to detect the running OS a hundred per cent sure?
No. The best way is to use a combination of tools and common sense. Running an Nmap scan can give you a basic idea of what OS is running, and you can often narrow it down by looking at the versions and banners of services you see. If you see a machine that reports Linux 2.6 and then look at an SSH banner that says SSH-2.0-OpenSSH_4.6 Debian-4, you can be more confident the OS scan was correct. If you start seeing conflicting information, like a machine Nmap thinks is FreeBSD but it's running Microsoft IIS, then it needs more investigation and you should be more weary of the OS results. You're poking a black box on the other side of the internet and trying to extrapolate what's inside based on what it tells you, but what it tells you may be a lie or just accidentally confusing.