Security Essentials alert - You may be a victim of ...........

All replies

• 

  

  1

  Sign in to vote

  "bonalymac" wrote in message news:13594e5f-452b-4b9b-b4ad-23a05386d44c...

  My COA slip is XP Home and it does not have OEM anywhere on it.It does have the manufacturers name on it.

  Presumably your machine is an eMachine? If it's a sticker on the case it automatically means that it's OEM - what operating system does it say it is? (do NOT post the Key!!)

   

  It looks to me as if the System description there is not what it's supposed to be, for one reason or another - and one part of WGA is accepting it, while another doesn't.

  Look here:-

  <SYSTEM><Manufacturer>P4i6G</Manufacturer><Model>P4i65G</Model></SYSTEM>

  the manufacturer appears to be ASROCK - it's one of their motherboards, and is/was available at retail

  while here,,,

  <SMBIOSVersion major="2" minor="3"/><Date>20060516000000.000000+000</Date><SLPBIOS>EMACHINES</SLPBIOS></BIOS><
  the manufacturer is eMachines.

   

  To be honest, anything I say is going to be a stab in the dark on this :)

   

  You could try and see if there's an updated BIOS available from Acer/eMachines - but I suspect that is unlikely.

  You could try ringing or eMachines/Acer for their, and seeing if this is a 'common' problem - again, you'd be unlikely to get too much assistance, since the machine is well out of warranty.

  You could try ringing MS and see if you can talk them into giving you free support since this is a WGA/Validation problem.

  You could wait a while, and Darin Smith the MS Forum Manager should pop in and may correct me and put you on the right track!

   

  HTH
  --
   

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  Monday, June 7, 2010 2:16 PM

  Moderator
• 

  

  1

  Sign in to vote

  bonalymac,

  Your WGA Notifications Utility is out of date--you may be able to correct the problem by updating:

  http://support.microsoft.com/kb/905474

  ---

  Buy Office 2007 Now, Get Office 2010 Free http://office2010.microsoft.com/en-us/tech-guarantee/microsoft-office-2010-technology-guarantee-FX101825695.aspx?CTT=97

  Monday, June 7, 2010 2:28 PM
• 

  

  1

  Sign in to vote

  "Dan at IT Associates" wrote in message news:f224e264-32c5-448f-9004-f18bba8fe86d...

  bonalymac,

  Your WGA Notifications Utility is out of date--you may be able to correct the problem by updating:

  http://support.microsoft.com/kb/905474

  
  

  Duh! didn't notice that - just as well I got another cup of coffee after writing my response! :)

  
  --
   

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  Monday, June 7, 2010 2:39 PM

  Moderator
• 

  

  0

  Sign in to vote

  Thanks to both of you. Yep its an emachines model,a nd its stil got original MB. I'll have a lkook at updatting the WGA Notifications utility as suggested. I did think however that I had updated it earlier today, but I'll try and update the thread afterwards.

   

  Thanks

  Monday, June 7, 2010 2:53 PM
• 

  

  1

  Sign in to vote

  "bonalymac" wrote in message news:2fb4321a-9b1f-410e-ace2-64a4859501c8...

  Thanks to both of you. Yep its an emachines model,a nd its stil got original MB. I'll have a lkook at updatting the WGA Notifications utility as suggested. I did think however that I had updated it earlier today, but I'll try and update the thread afterwards.

   

  Thanks

  
  

  For some reason MS aren't removing old versions, or updating links to them - the best place to get them is from the links in these groups, or from the Validation site.

  
  --
   

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  Monday, June 7, 2010 3:12 PM

  Moderator
• 

  

  1

  Sign in to vote

  Hello bonalymac,

  Windows XP Notifications Data-->
  Cached Result: 0
  File Exists: Yes
  Version: 1.7.18.5
  WgaTray.exe Signed By: Microsoft
  WgaLogon.dll Signed By: Microsoft

  This http://support.microsoft.com/kb/905474 will get you v1.9.0040.0.  Not sure it will fix the problem, but a good place to start.

  ---

  Buy Office 2007 Now, Get Office 2010 Free http://office2010.microsoft.com/en-us/tech-guarantee/microsoft-office-2010-technology-guarantee-FX101825695.aspx?CTT=97

  Monday, June 7, 2010 4:16 PM
• 

  

  0

  Sign in to vote

  Hi

  I tried v1.9.0040.0. The message seemed to go away. I rebooted about a dozen times. but it has just returneed. I poceked the "Get Genuine" button, got a message saying validation completed, Thanks. for using Genuine software.

  But it looks as if the prob is still there.

  Any other suggestions?

  Ta

  Colin 

  Monday, June 7, 2010 8:39 PM
• 

  

  1

  Sign in to vote

  "bonalymac" wrote in message news:26d32ea1-9a65-45f5-9827-134010bdbf17...

  Hi

  I tried v1.9.0040.0. The message seemed to go away. I rebooted about a dozen times. but it has just returneed. I poceked the "Get Genuine" button, got a message saying validation completed, Thanks. for using Genuine software.

  But it looks as if the prob is still there.

  Any other suggestions?

  Ta

  Colin 

  
  

  without seeing the new report - not a clue!

  :)

  
  --
   

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  Monday, June 7, 2010 9:02 PM

  Moderator
• 

  

  1

  Sign in to vote

  Hello bonalymac,

  Have a look at this:  http://social.answers.microsoft.com/Forums/en-US/msestart/thread/3f877be5-3a04-47b7-a3ee-835910633110

  ---

  Buy Office 2007 Now, Get Office 2010 Free http://office2010.microsoft.com/en-us/tech-guarantee/microsoft-office-2010-technology-guarantee-FX101825695.aspx?CTT=97

  • Proposed as answer by Darin Smith MS Wednesday, June 9, 2010 9:34 PM

  Tuesday, June 8, 2010 1:20 AM
• 

  

  0

  Sign in to vote

  Hi folks

  Ive followed the instructions regarding data.dat.

  Seems clear enough. Everyomne ws NOT listed so I've done as reccommended. Hopefully this will resolve the issue.

  I'll update this thread in a day or so once I've seen if the  problem has been resolved.

  Many thanks for all the help so far. Very much appreciated. Reall helpful, really prompt.

  Colin

   

  Tuesday, June 8, 2010 6:14 PM
• 

  

  0

  Sign in to vote

  Sorry, but that didn't work

  I've updated to WGA Notifications Utility and re-run the test - see below.

  My COA slip is XP Home and it does not have OEM anywhere on it. It does have the manufacturers name on it.

  Would welcome any comments.

   

   

  Diagnostic Report (1.9.0027.0):
  -----------------------------------------
  Windows Validation Data-->
  Validation Status: Genuine
  Validation Code: 0
  Cached Validation Code: N/A
  Windows Product Key: *****-*****-XJ9J8-WC9Y8-RWX8B
  Windows Product Key Hash: 9MvO51/6ns4fpIG1CcwgnQrrjzU=
  Windows Product ID: 55277-OEM-2154986-39848
  Windows Product ID Type: 3
  Windows License Type: OEM System Builder
  Windows OS version: 5.1.2600.2.00010300.3.0.hom
  ID: {10F8885C-5C6C-470A-A8D8-CF0013C168F1}(3)
  Is Admin: Yes
  TestCab: 0x0
  LegitcheckControl ActiveX: Registered, 1.9.42.0
  Signed By: Microsoft
  Product Name: N/A
  Architecture: N/A
  Build lab: N/A
  TTS Error: N/A
  Validation Diagnostic: 025D1FF3-230-1
  Resolution Status: N/A
  Vista WgaER Data-->
  ThreatID(s): N/A
  Version: N/A
  Windows XP Notifications Data-->
  Cached Result: 0
  File Exists: Yes
  Version: 1.9.40.0
  WgaTray.exe Signed By: Microsoft
  WgaLogon.dll Signed By: Microsoft
  OGA Notifications Data-->
  Cached Result: N/A, hr = 0x80070002
  Version: N/A, hr = 0x80070002
  OGAExec.exe Signed By: N/A, hr = 0x80070002
  OGAAddin.dll Signed By: N/A, hr = 0x80070002
  OGA Data-->
  Office Status: 109 N/A
  OGA Version: Registered, 2.0.48.0
  Signed By: Microsoft
  Office Diagnostics: B4D0AA8B-543-80070002_025D1FF3-230-1
  Browser Data-->
  Proxy settings: N/A
  User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
  Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe
  Download signed ActiveX controls: Prompt
  Download unsigned ActiveX controls: Disabled
  Run ActiveX controls and plug-ins: Allowed
  Initialize and script ActiveX controls not marked as safe: Disabled
  Allow scripting of Internet Explorer Webbrowser control: Disabled
  Active scripting: Allowed
  Script ActiveX controls marked as safe for scripting: Allowed
  File Scan Data-->
  Other data-->
  Office Details: <GenuineResults><MachineData><UGUID>{10F8885C-5C6C-470A-A8D8-CF0013C168F1}</UGUID><Version>1.9.0027.0</Version><OS>5.1.2600.2.00010300.3.0.hom</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-RWX8B</PKey><PID>55277-OEM-2154986-39848</PID><PIDType>3</PIDType><SID>S-1-5-21-2013333284-2016402832-2599643633</SID><SYSTEM><Manufacturer>P4i6G</Manufacturer><Model>P4i65G</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>P1.10</Version><SMBIOSVersion major="2" minor="3"/><Date>20060516000000.000000+000</Date><SLPBIOS>EMACHINES</SLPBIOS></BIOS><HWID>0AED385F01846072</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>2</stat><msppid></msppid><name>eMachines</name><model>5220/8220</model></SBID><OEM/><GANotification><File Name="WgaTray.exe" Version="1.9.40.0"/><File Name="WgaLogon.dll" Version="1.9.40.0"/></GANotification></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 
  Licensing Data-->
  N/A
  Windows Activation Technologies-->
  N/A
  HWID Data-->
  N/A
  OEM Activation 1.0 Data-->
  BIOS string matches: yes
  Marker string from BIOS: 1399F:GENUINE C&C INC
  Marker string from OEMBIOS.DAT: EMACHINES
  OEM Activation 2.0 Data-->
  N/A
  
  

  Thursday, June 10, 2010 7:04 PM
• 

  

  1

  Sign in to vote

  "bonalymac" wrote in message news:6f39f3af-0115-41d1-b73a-f6cdba9022e5...

  Sorry, but that didn't work

  I've updated to WGA Notifications Utility and re-run the test - see below.

  My COA slip is XP Home and it does not have OEM anywhere on it. It does have the manufacturers name on it.

  Would welcome any comments.

   

   

  Diagnostic Report (1.9.0027.0):
  -----------------------------------------
  Windows Validation Data-->
  Validation Status: Genuine
  Validation Code: 0
  Cached Validation Code: N/A
  Windows Product Key: *****-*****-XJ9J8-WC9Y8-RWX8B
  Windows Product Key Hash: 9MvO51/6ns4fpIG1CcwgnQrrjzU=
  Windows Product ID: 55277-OEM-2154986-39848
  Windows Product ID Type: 3
  Windows License Type: OEM System Builder
  Windows OS version: 5.1.2600.2.00010300.3.0.hom
  

  
  

  According to that your computer is activated and validated. - are you still seeing non-genuine messages?

  Does the above Key agree with the Key on your Sticky Label?

  
  --
   

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  Thursday, June 10, 2010 8:30 PM

  Moderator
• 

  

  0

  Sign in to vote

  Yes, still getting MSE error messages warning of possible counterfeit software.

  I'll need to get my friend to check the number.

  The problem only arose last week when I uninstalled the AV software she was using and I installed MSE instead.

  Thursday, June 10, 2010 11:40 PM
• 

  

  1

  Sign in to vote

  "bonalymac" wrote in message news:efb5d61d-664a-4023-a276-0df3af4b99ff...

  Yes, still getting MSE error messages warning of possible counterfeit software.

  I'll need to get my friend to check the number.

  The problem only arose last week when I uninstalled the AV software she was using and I installed MSE instead.

  
  

  Hmmm - that sound like the AV she had been using may have had a Firewall as well, and WGA couldn't phone home to update so left things alone.

  MSE wouldn't have installed if the system was Not Genuine!

  Either that, or something else was changed at the same time.

  What happens if you go to the Validation site, and attempt to Validate? (http://www.microsoft.com/genuine)

  Go here, and run the diagnostic tool - see if it gives us a clue

  http://www.microsoft.com/genuine/diag

   

  we may also see something new then in the MGADiag report.

   

  
  --
   

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  Friday, June 11, 2010 7:36 AM

  Moderator
• 

  

  0

  Sign in to vote

  Hi

  She did have a different firewall as well.

  I look after PC's for a dozen friends and family, and all of them I had setup with AVG virus software and Zonelabs firewall. At home my own PC's had the same set up.

  However, I switched my home set-up to use Microsoft Security Essentials & Windows Firewall, about 6 months ago, and was very impressed with how well it worked and most importantly how inobtrusive the whole set-up was. When you have to deal with users who are not experienced, that is a major advantage. So I gradually set about changing all my friends PC's to the same set-up. This is the first that has given me any probs.

  I'll need to get on line with a Remote Assistance session and run these checks on her PC, and check the CoA Code as well. I'll do this over the weekend when I can get hold of her.

  I'll update this later.

   

  Friday, June 11, 2010 9:02 AM
• 

  

  1

  Sign in to vote

  "bonalymac" wrote in message news:e0a2a418-a53b-4b94-b9ec-52854cb36958...

  Hi

  She did have a different firewall as well.

  I look after PC's for a dozen friends and family, and all of them I had setup with AVG virus software and Zonelabs firewall. At home my own PC's had the same set up.

  However, I switched my home set-up to use Microsoft Security Essentials & Windows Firewall, about 6 months ago, and was very impressed with how well it worked and most importantly how inobtrusive the whole set-up was. When you have to deal with users who are not experienced, that is a major advantage. So I gradually set about changing all my friends PC's to the same set-up. This is the first that has given me any probs.

  I'll need to get on line with a Remote Assistance session and run these checks on her PC, and check the CoA Code as well. I'll do this over the weekend when I can get hold of her.

  I'll update this later.

   

  
  

  The Zonelabs firewall has a reputation for blocking things without telling the user (and/or the user getting so annoyed with constant pop-ups, that they auto-click either Deny, or Allow). Windows Firewall, even in RTM (when it was called Internet Connection Firewall), was good enough for most home users, its only problem was that it wasn't switched on by default.

   

  If ZoneLabs has been uninstalled, then you need to run their removal program as well, as it leaves (or at least used to leave) behind a boatload of stuff which the user neither needs nor wants.

  http://download.zonealarm.com/bin/free/support/cpes_clean.exe

   

  Then check the settings in Windows Firewall, and make sure that it's switched on, and that exceptions are allowed. Check what the exceptions are, because ZA may have messed with them, and there will almost certainly be some that should be deleted anyhow.

   

  HTH

  
  --
   

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  Friday, June 11, 2010 9:42 AM

  Moderator
• 

  

  0

  Sign in to vote

  Thanks I'll check all these when I can get on the PC.

  Ta

  Friday, June 11, 2010 11:34 AM
• 

  

  0

  Sign in to vote

  No replys to thread in some time.

  Issue is assumed to be resolved

  ---

  Darin MS

  • Marked as answer by Darin Smith MS Thursday, June 17, 2010 9:52 PM

  Thursday, June 17, 2010 9:52 PM
• 

  

  0

  Sign in to vote

  Sorry guys but was still getting the "Possible Counterfeit" issue

  Since the last post, I have

  updated the WGA Notifications utility

  ensured data.dat has permissions

  ran the Zonelabs clean prog

  ran the AVG remover prog

  uninstalled MSSE

  redownloaded MSSE

  Checked the validation website

  It said Validation complete

  ran Windows Update

  It passed validation

  re-installed MSSE

  It passed validation

  Checked Windows Firewall is on, and exceptions are allowed

  Exceptions are

  AOL Loader
  Bonjour
  iTunes (twice)
  Limewire
  Network Diagnostics for Windows XP
  Network Diagnostics for Windows XP
  Remote Assistance
  Remote Assistance - Windows messenger and Voice
  Windws Live Call
  Windows Live Messenger
  Windows Live Messenger 8.0 (Phone)
  Windows Live Messenger 8.1 (Phone)
  Windows Live Sync
  Windows Messenger

   

  My COA slip is XP Home and it does not have OEM anywhere on it. It does have the manufacturers name on it.

  
  I Would welcome any comments. Not sure if I'll still have probs, but

   

  
  MG Diag listing is

   

  
  Diagnostic Report (1.9.0027.0):
  -----------------------------------------
  Windows Validation Data-->
  Validation Status: Genuine
  Validation Code: 0
  Cached Validation Code: N/A
  Windows Product Key: *****-*****-XJ9J8-WC9Y8-RWX8B
  Windows Product Key Hash: 9MvO51/6ns4fpIG1CcwgnQrrjzU=
  Windows Product ID: 55277-OEM-2154986-39848
  Windows Product ID Type: 3
  Windows License Type: OEM System Builder
  Windows OS version: 5.1.2600.2.00010300.3.0.hom
  ID: {10F8885C-5C6C-470A-A8D8-CF0013C168F1}(3)
  Is Admin: Yes
  TestCab: 0x0
  LegitcheckControl ActiveX: Registered, 1.9.42.0
  Signed By: Microsoft
  Product Name: N/A
  Architecture: N/A
  Build lab: N/A
  TTS Error: N/A
  Validation Diagnostic: 025D1FF3-230-1
  Resolution Status: N/A

  Vista WgaER Data-->
  ThreatID(s): N/A
  Version: N/A

  Windows XP Notifications Data-->
  Cached Result: 0
  File Exists: Yes
  Version: 1.9.40.0
  WgaTray.exe Signed By: Microsoft
  WgaLogon.dll Signed By: Microsoft

  OGA Notifications Data-->
  Cached Result: N/A, hr = 0x80070002
  Version: N/A, hr = 0x80070002
  OGAExec.exe Signed By: N/A, hr = 0x80070002
  OGAAddin.dll Signed By: N/A, hr = 0x80070002

  OGA Data-->
  Office Status: 109 N/A
  OGA Version: Registered, 2.0.48.0
  Signed By: Microsoft
  Office Diagnostics: B4D0AA8B-543-80070002_025D1FF3-230-1

  Browser Data-->
  Proxy settings: N/A
  User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
  Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe
  Download signed ActiveX controls: Prompt
  Download unsigned ActiveX controls: Disabled
  Run ActiveX controls and plug-ins: Allowed
  Initialize and script ActiveX controls not marked as safe: Disabled
  Allow scripting of Internet Explorer Webbrowser control: Disabled
  Active scripting: Allowed
  Script ActiveX controls marked as safe for scripting: Allowed

  File Scan Data-->

  Other data-->
  Office Details: <GenuineResults><MachineData><UGUID>{10F8885C-5C6C-470A-A8D8-CF0013C168F1}</UGUID><Version>1.9.0027.0</Version><OS>5.1.2600.2.00010300.3.0.hom</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-RWX8B</PKey><PID>55277-OEM-2154986-39848</PID><PIDType>3</PIDType><SID>S-1-5-21-2013333284-2016402832-2599643633</SID><SYSTEM><Manufacturer>P4i6G</Manufacturer><Model>P4i65G</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>P1.10</Version><SMBIOSVersion major="2" minor="3"/><Date>20060516000000.000000+000</Date><SLPBIOS>EMACHINES</SLPBIOS></BIOS><HWID>0AED385F01846072</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>2</stat><msppid></msppid><name>eMachines</name><model>5220/8220</model></SBID><OEM/><GANotification><File Name="WgaTray.exe" Version="1.9.40.0"/><File Name="WgaLogon.dll" Version="1.9.40.0"/></GANotification></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults> 

  Licensing Data-->
  N/A

  Windows Activation Technologies-->
  N/A

  HWID Data-->
  N/A

  OEM Activation 1.0 Data-->
  BIOS string matches: yes
  Marker string from BIOS: 1399F:GENUINE C&C INC
  Marker string from OEMBIOS.DAT: EMACHINES

  OEM Activation 2.0 Data-->
  N/A

   

  Monday, June 21, 2010 6:34 PM
• 

  

  0

  Sign in to vote

  "bonalymac" wrote in message news:795ad707-3e42-40d0-b57a-460fd6ae8a9b...

  Sorry guys but was still getting the "Possible Counterfeit" issue

   

  
  

  That log looks OK to me - were you having the notification at the time you ran it?

   

  
  --
   

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  Monday, June 21, 2010 9:16 PM

  Moderator
• 

  

  0

  Sign in to vote

  AFraid so. Still getting the error warning.

  Might be time to gve up on MSSE and return to AVG.

   

  Colin

  Tuesday, June 22, 2010 8:57 PM
• 

  

  0

  Sign in to vote

  "bonalymac" wrote in message news:7943306a-0e19-4325-90c9-a7653d7f8881...

  AFraid so. Still getting the error warning.

  Might be time to gve up on MSSE and return to AVG.

   

  Colin

  
  

  Changing the AV will make no difference (apart from slowing the PC down - AVG has gotten really bad for that lately, which is why I've stopped recommending it).

  All I can think of, since there's nothing I can see that's changing here, is to repost in the MSE forum, and see if they've any more ideas than I have!

  http://social.answers.microsoft.com/Forums/en-US/msestart/threads

  Make sure that you explain what you've been through - and refer back to this thread - so that you don't get the automatic responses :)

   

  Good Luck! (please let us know how you get on!)

  
  --
   

  ---

  Noel Paton | Nil Carborundum Illegitemi | CrashFixPC | The Three-toed Sloth

  Wednesday, June 23, 2010 7:47 AM

  Moderator