These  two lines of code introduced in the v.04 of Bitcoin make sure the count always exceeds 25000
if (kMasterKey.nDeriveIterations < 25000)
        kMasterKey.nDeriveIterations = 25000;

Therefore any wallet.dat hash has less than this count it is a fake wallet.
What about the release or testing versions before this version ? Because I have seen a lot of wallets with count less than 25000, are they all fake ?

Examples :

31000 BTC :

$32a7166992f7ac1a$17360$2$00$2$00

7941 BTC :

$4d4e190f0ef92dd3$18562$2$00$2$00