locked
Fake Windows XP Product Activation Scam: Don't Become a Victim!

    General discussion

  • Dear Microsoft Windows XP Customers,

    [Reference ZDNet Blog by Dancho Danev:  http://blogs.zdnet.com/security/?p=2201&tag=nl.e589]

    If your installation of Windows XP surprises you by claiming it is not activated and displays Product Activation dialog boxes, please read this post to help avoid becoming a victim of an 18-month old scam that has recently been given a facelift by its author.

    Legitmate Windows Product Activation will require your action to Activate Windows ONLY under these circumstances:

    • Within 30 days of a clean installation
    • Within 30 days of a repair reinstallation
    • Within 3 days of a major hardware change, such as installation of a new motherboard; or within 3 days of the latest of a series of minor hardware changes (say, replacing a video card, and RAM, and a network card sequentially within a short time period)
    Any other dialog boxes requiring Windows XP Product Activation should be viewed with great suspicion and should NOT be acted upon until you are satisfied that they are legitimate.

    Legitimate Windows Product Activation:

    • NEVER displays the Product Key of the installation of Windows XP
    • NEVER asks you for any personally identifiable information, such as your email address or birthdate
    • NEVER asks you to enter your Credit Card number
    • NEVER asks you to enter your Social Security number


    The FAKE Windows Product Activation trojan known as "Kardphisher" ( http://www.symantec.com/security_response/writeup.jsp?docid=2007-042705-0108-99 ) is a Social Engineering attack that tries to trick the unsuspecting user into entering critical personal and financial information such as credit card numbers, birth dates, and social security numbers, most likely to facilitate Identity Theft.

    Here are two examples of what the FAKE Windows Product Activation dialog boxes look like:

    http://blogs.zdnet.com/security/images/fake_windows_xp_activation_malware_4.jpg>

    http://blogs.zdnet.com/security/images/fake_windows_xp_activation_malware_2.jpg>


    Please note that Windows Product Activation is completely different technology compared to the Windows Genuine Advantage Program and its two main components, Windows Validation and WGA Notifications, which is the stated subject and topic of this forum.  However, based on the many Product Activation questions and problems that have been posted in this forum over the last two and a half years, it is likely that someone seeking help with this Product Activation Trojan might find their way to this forum and see this post.
    For great advice on all topics XP, visit http://www.annoyances.org/exec/forum/winxp
    Wednesday, November 19, 2008 2:53 PM

All replies