Answered by:
Recent Trend of User Posts

Question
-
Hi, Rick of MS,
I'm noticing that recent posters are reporting that after a vrus attack, their systems are becoming nongenuine.
Also noticing that the mgadiag reports typically are showing these systems with VLKs and "unknown" as the license type.
Is it possible one of the tasks of the attacking malware it to try to harvest valid Product Keys?
Just wondering...... :-)
For great advice on all topics XP, visit http://www.annoyances.org/exec/forum/winxpMonday, August 25, 2008 7:15 PM
Answers
-
H2490,
Thank you too for your post. I did pick your post up and added it earlier this morning to my analysis. I appreciate your attention here to the WGA forum.
Respectfully,
Rick, MS- Marked as answer by RickImAPC Tuesday, September 2, 2008 3:02 PM
Tuesday, August 26, 2008 8:21 PM
All replies
-
Hi Dan,
Would you point me to a few of the posts where you are seeing this? We want to get a handle on this if it is an ongoing issue.
Darin
Attention Forum All Users: Please Do Not post your issue in someone else's Thread...Create your own.Monday, August 25, 2008 8:33 PM -
Hi Dan,
Thank you for your message. I will certainly pass this along and look into this situation as far as I can. Do you have any specific posts I can review as a trend? Security issues can be tough to track down and classify. Stephen has noticed the occurance of the unknown license types lately too.
To answer your question, I'm not sure if that is the specific behavior, however I wouldn't rule it out either. Like yourself, I have a very limited information to go on and need to review these trends further, perhaps more in depth too.
Rick, MSMonday, August 25, 2008 8:36 PM -
Hi Darin and Rick,
Here are some recent posts:
http://forums.community.microsoft.com/en-US/genuinewindowsxp/thread/15a8424a-a81c-4a19-b01f-6b4cdb62075f
http://forums.community.microsoft.com/en-US/genuinewindowsxp/thread/0f5acccf-4af0-4e4a-a96a-eab087cb4b9b
http://forums.community.microsoft.com/en-US/genuinewindowsxp/thread/758483e1-8cdb-45c3-b463-d33aa5391af3
http://forums.community.microsoft.com/en-US/genuinewindowsxp/thread/0bdfdfd1-b9c7-40a6-a7a0-1557074710fe
http://forums.community.microsoft.com/en-US/genuinewindowsxp/thread/cadda449-b4c4-454a-b305-8d0c4ae147e8
http://forums.community.microsoft.com/en-US/genuinevista/thread/445b2569-4103-486e-add8-8e3f3fac90ad
They all seem to have two things in common: (1) the poster reporting a virus or malware attack, and (2) alteration of the PID and/or the Windows License Type as reported in the mgadiag report.
The malware could be harvesting product keys, or maybe just targeting files that, when tampered with or corrupted, will create the nuisance for the owner of an instance of nongenuine software.
For great advice on all topics XP, visit http://www.annoyances.org/exec/forum/winxpTuesday, August 26, 2008 3:11 AM -
Hi Dan,
Thank you for the information. We will look into this further. I appreciate your time and assistance.
Rick, MSTuesday, August 26, 2008 2:04 PM -
I had a similar problem, Dan probably missed it. The only thing that woked for me was to format and re-install.
anyway, here's the link to my thread, which would seem to apply to this thread.
http://forums.community.microsoft.com/en-US/genuinewindowsxp/thread/49770dbd-4fe9-4e7b-895c-fb82fdc0ca58Tuesday, August 26, 2008 4:10 PM -
Timmyyy,
Thank you for your post. I have included your post in my analysis along with the other posts identified.
Respectfully,
RickTuesday, August 26, 2008 4:38 PM -
http://forums.community.microsoft.com/en-US/genuinewindowsxp/thread/03cf179c-6eee-477f-80e2-553f21ac96d3
I guess im on this list too, ill be updating my output on the post when I get home from work.
H2490Tuesday, August 26, 2008 7:24 PM -
H2490,
Thank you too for your post. I did pick your post up and added it earlier this morning to my analysis. I appreciate your attention here to the WGA forum.
Respectfully,
Rick, MS- Marked as answer by RickImAPC Tuesday, September 2, 2008 3:02 PM
Tuesday, August 26, 2008 8:21 PM