[Wrinkly Pete]

Hi,

I am going to relate an incident that occurred on one of my PCs today (it's using Windows XP Home Edition SP3). This is my gaming PC, and was built for me by Chillblast 3 years ago. I have NEVER altered any hardware on this PC, it is EXACTLY as it was when built. All installed software was bought by me and genuine. It has regularly been checked by the Microsoft Genuine Advantage tool and scanned by Microsoft's system on several occasions before, with NO problems whatsoever.

That said, when I turned it on this morning during the start up procedure a new (never seen it before) window appeared, telling me the following:

"WINDOWS PRODUCT ACTIVATION
Since Windows was first activated on this computer, the hardware on the computer has changed significantly. Due to these changes, Windows must be reactivated within 3 days.
Do you want to reactivate Windows now?
Yes No."

This in itself was a total surprise, in fact it was a shock.
WHY is it telling me this, when I know it to be untrue? Is this a virus/hoax?

All my PCs are genuine and use ONLY genuine Microsoft software and operating systems (XP, Vista and Windows 7).

Bearing in mind it is a Bank Holiday weekend here in the UK I was unable to get through to a single human (if Microsoft actually have any humans working for them these days!) by phone.
I gave up and tried the online "Chat" option.
The first person I got had zero knowledge, and I actually suspected I was dealing with some A.I. (artificial intelligence) as the replies seemed not to fully understand my questions. The best advice the "customer support" person offered was to ring Technical Support. I already HAD and I told the same person that there was no reply due to it being a Bank Holiday. She said there was nothing else she could do, even if I only had 3 days to contact Microsoft!

About this time I noticed another problem. By now Microsoft Security Essentials regarded my PC as invalidated and using invalidated software, so it stopped working!

The second live "chat" with another Customer service agent wasn't much better, although the guy appeared to understand what I was saying, but was still unable to help!

The story goes on... and on.. and on... I won't bore you with all the details.

I can assure you my ALL PCs are totally genuine and use paid for genuine software, hardware and peripherals.

What I'd really like to know is WHY?
Why did my PC, which was working normally with no new software or hardware (or indeed ANYTHING different to yesterday), suddenly become "significantly changed" as far as Microsoft are concerned.

Today has been a nightmare. Caused totally BY Microsoft, and I strongly suspect instigated quite deliberately in an attempt to make me update to a later operating system. This would explain why I was directed to an operating system upgrade option on the Microsoft website, when I clicked on the "Rectify the problem now". It would also explain the banner telling me Microsoft are ceasing all support for XP by April 8th 2014.

I could understand this IF I had altered the hardware, or installed some dodgy Micros--- software, but I hadn't.

Can any of you Geeks explain WHY this may have happened, because I haven't the faintest idea, and I really DON'T want to go through that [bleep] again?

Thanks
Wrinkly Pete

[Advertisements]

I suspect that you have some malware on your computer causing issues that we are not able to solve through means we can use here in the Tech Forums. I suggest you read the 'Start Here' topic found HERE. With these self-help tools you have a high chance of fixing the problems on your own. If you are still having problems after following Step 3 of the guide, continue with Step 4 and 5 and post in the Malware Forum. If you are unable to run any programs, Please create a topic stating what you have tried so far and that you are unable to run any programs. Also, Please do NOT post the logs in this thread.

If you are still having issues after the malware expert gives you a clean bill of health, Please return to THIS thread and we will pursue other options to help you solve your current problem(s).
Add a link to this topic so that malware tech can see what steps have been taken here

[rshaffer61]

I suspect that you have some malware on your computer causing issues that we are not able to solve through means we can use here in the Tech Forums. I suggest you read the 'Start Here' topic found HERE. With these self-help tools you have a high chance of fixing the problems on your own. If you are still having problems after following Step 3 of the guide, continue with Step 4 and 5 and post in the Malware Forum. If you are unable to run any programs, Please create a topic stating what you have tried so far and that you are unable to run any programs. Also, Please do NOT post the logs in this thread.

If you are still having issues after the malware expert gives you a clean bill of health, Please return to THIS thread and we will pursue other options to help you solve your current problem(s).
Add a link to this topic so that malware tech can see what steps have been taken here

[Wrinkly Pete]

I suspect that you have some malware on your computer causing issues that we are not able to solve through means we can use here in the Tech Forums. I suggest you read the 'Start Here' topic found HERE. With these self-help tools you have a high chance of fixing the problems on your own. If you are still having problems after following Step 3 of the guide, continue with Step 4 and 5 and post in the Malware Forum. If you are unable to run any programs, Please create a topic stating what you have tried so far and that you are unable to run any programs. Also, Please do NOT post the logs in this thread.

If you are still having issues after the malware expert gives you a clean bill of health, Please return to THIS thread and we will pursue other options to help you solve your current problem(s).
Add a link to this topic so that malware tech can see what steps have been taken here

Thanks for your reply.
I'll be surprised if I have any malware as this PC is scanned very regularly, and within the last couple of days has been checked by both AVG Internet Security 2012 and then Microsoft Security Essentials (after removing AVG) neither of which detected anything.

Malware is HIGHLY unlikely on this PC as it is only used for (off line) gaming and NO software is installed on it that wasn't scanned first. I never use it online, except to install the latest security updates from Microsoft. It is purely used for gaming offline.

Thanks for your suggestion though.

[rshaffer61]

Then if you are refusing the suggestion then I can only check other possible reasons.



Go to

Start and then to Run
Type in Chkdsk /r Note the space between k and /
Click Enter ...It will probably ask if you want to do this on the next reboot...click Y
If the window doesn't shutdown on its own then reboot the system manually. On reboot the system will start the chkdsk operation
This one will take longer then chkdsk /f

Note... there are 5 stages...
It may appear to hang at a certain percent for a hour or more or even back up and go over the same area...this is normal...
DO NOT SHUT YOUR COMPUTER DOWN WHILE CHKDSK IS RUNNING OR YOU CAN HAVE SEVERE PROBLEMS
This can take several hours to complete.
When completed it will boot the system back into windows.

Reboot after your done running chkdsk /r...
then Go to Start...Run and type: eventvwr.msc press Enter
When Event Viewer opens, click on Applications... then scroll down to Winlogon and double-click on it. This is the log created after running Checkdisk...copy and paste the log back here


We will advise after studying the log.

[Wrinkly Pete]

Then if you are refusing the suggestion then I can only check other possible reasons.



Go to

Start and then to Run
Type in Chkdsk /r Note the space between k and /
Click Enter ...It will probably ask if you want to do this on the next reboot...click Y
If the window doesn't shutdown on its own then reboot the system manually. On reboot the system will start the chkdsk operation
This one will take longer then chkdsk /f

Note... there are 5 stages...
It may appear to hang at a certain percent for a hour or more or even back up and go over the same area...this is normal...
DO NOT SHUT YOUR COMPUTER DOWN WHILE CHKDSK IS RUNNING OR YOU CAN HAVE SEVERE PROBLEMS
This can take several hours to complete.
When completed it will boot the system back into windows.

Reboot after your done running chkdsk /r...
then Go to Start...Run and type: eventvwr.msc press Enter
When Event Viewer opens, click on Applications... then scroll down to Winlogon and double-click on it. This is the log created after running Checkdisk...copy and paste the log back here


We will advise after studying the log.

IF this disk check is the same one as right clicking on a drive, selecting "properties", then "tools", then "check now",? then it was done 3 days ago as part of a weekly check up. No problems found. I'm very fussy with this PC as it is my purely gaming PC. I even defrag it after each session! I'm 99.99% sure it hasn't been taken over by anything untoward. That's why I'm so puzzled that one day it's fine yet the next day Microsoft tell me it needs reactivation. It doesn't make sense to me.

I think I already have a screen shot (done TODAY) of the Event viewer showing the fist hint of a problem if you'd like I 'll upload it for you?

My PCs are also periodically checked for security, by "Shields up" Gibson Research Corp. and tested with Eicar and pass with flying colours.

Edited by Wrinkly Pete, 06 May 2012 - 01:14 PM.

[Wrinkly Pete]

Here is the copy of the event viewer showing the first "out of the blue" problem. Windows activation.

Attached Thumbnails

• 

[rshaffer61]

In my experience when the Activation goes crazy it is normally due to either the OS, Memory, HD or a infection.
Since you said it can't be a infection then we will check the other options.



Go Start and then to Run ("Start Search" in Vista),
Type in: sfc /scannow
Click OK (Enter in Vista).
Have Windows CD/DVD handy.
If System File Checker (sfc) finds any errors, it may ask you for the CD/DVD.
If sfc does not find any errors in Windows XP, it will simply quit, without any message.
In Vista you will receive the following message: "Windows resource protection did not find any integrity violations".

For Vista users ONLY: Navigate to C:\Windows\Logs\CBS folder. You'll see CBS.log file.
Usually, it's pretty big file, so upload it to Flyupload, and post download link.


If you don't have Windows CD....
This applies mostly to Windows XP, since Vista rarely requires use of its DVD while running "sfc"
Note This method will not necessarily work as well, as when using Windows CD, because not always ALL system files are backed up on your hard drive. Also, backed up files may be corrupted as well.

Go Start and then Run
type in regedit and click OK


Navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup

You will see various entries Values on the right hand side.

The one we want is called: SourcePath

It probably has an entry pointing to your CD-ROM drive, usually D and that is why it is asking for the XP CD.
All we need to do is change it to: C:
Now, double click the SourcePatch setting and a new box will pop up.
Change the drive letter from your CD drive to your root drive, usually C:
Close Registry Editor.

Now restart your computer and try sfc /scannow again!


Thanks to Broni for the instructions

[Wrinkly Pete]

In my experience when the Activation goes crazy it is normally due to either the OS, Memory, HD or a infection.
Since you said it can't be a infection then we will check the other options.



Go Start and then to Run ("Start Search" in Vista),
Type in: sfc /scannow
Click OK (Enter in Vista).
Have Windows CD/DVD handy.
If System File Checker (sfc) finds any errors, it may ask you for the CD/DVD.
If sfc does not find any errors in Windows XP, it will simply quit, without any message.
In Vista you will receive the following message: "Windows resource protection did not find any integrity violations".

For Vista users ONLY: Navigate to C:\Windows\Logs\CBS folder. You'll see CBS.log file.
Usually, it's pretty big file, so upload it to Flyupload, and post download link.


If you don't have Windows CD....
This applies mostly to Windows XP, since Vista rarely requires use of its DVD while running "sfc"
Note This method will not necessarily work as well, as when using Windows CD, because not always ALL system files are backed up on your hard drive. Also, backed up files may be corrupted as well.

Go Start and then Run
type in regedit and click OK


Navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup

You will see various entries Values on the right hand side.

The one we want is called: SourcePath

It probably has an entry pointing to your CD-ROM drive, usually D and that is why it is asking for the XP CD.
All we need to do is change it to: C:
Now, double click the SourcePatch setting and a new box will pop up.
Change the drive letter from your CD drive to your root drive, usually C:
Close Registry Editor.

Now restart your computer and try sfc /scannow again!


Thanks to Broni for the instructions

Rather than waste your time and mine pursuing this (as the problem itself seems to be rectified) could we go back to my original posting.
My question was WHY this has happened, rather than how to cure this problem.
I was just trying to find out WHAT could have caused it to happen, nothing more.

Your last posting mentions "In my experience when the Activation goes crazy it is normally due to either the OS, Memory, HD or a infection".
Ruling out (for now) any infection, in what way could the O.S; HD, or Memory cause this problem?
My PC is not showing up ANY other issues, my HD was checked and is ok, what memory issue could cause this Validation/Activation problem?

Edited by Wrinkly Pete, 06 May 2012 - 01:28 PM.

[rshaffer61]

It would help if you would tell me how the issue was rectified. Then I could possibly be able to explain the reason it went crazy.
I can't explain what I don't know at this point. HD could be faulty, memory could be failing, OS could have had a hiccup. Maybe a faulty boot or the memory could have had a dirty bit. HD may have had a bad index reading.
What resolved the issue and then I can explain better.

[Wrinkly Pete]

It would help if you would tell me how the issue was rectified. Then I could possibly be able to explain the reason it went crazy.
I can't explain what I don't know at this point. HD could be faulty, memory could be failing, OS could have had a hiccup. Maybe a faulty boot or the memory could have had a dirty bit. HD may have had a bad index reading.
What resolved the issue and then I can explain better.

Yes, no problem. I eventually was able to Re Activate it by going online and entering the Product Key.

I had originally been reluctant to do ANYTHING to start with as I was suspicious that it may NOT have been genuine. You can't be too careful these days, and I though it may have been some sort of phishing scam or something. I KNEW all my details were genuine and it must have been some other thing that caused the request to appear. I was unable to verify the reactivation was genuine, as nobody seems to work a Bank Holiday weekend at Microshit UK or answer the phone!

As I wasn't online when the original warning appeared (it was at start-up before the desktop appeared), and I couldn't bypass the screen in order to connect online I couldn't actually DO anything.

When I restarted the PC again later I was able to connect to the Internet and leave it connected when the PC was next turned off. This fortunately worked as it meant when I switched on yet again and the warning reappeared that I could now select the activate it now option AND be online.

NOW for the possible cause....... The ONLY one thing out of the ordinary PRIOR to this happening was that I had an instance (that we all have from time to time) where I had been unable to "safely remove" an external drive on a prior occassion very recently. Because of that I had no choice but to switch the PC off with the external hard drive STILL CONNECTED. Once the PC was turned off and the drive powered down I THEN removed the external hard drive from the USB slot.
COULD THIS possibly be anything to do with Windows thinking I had significantly altered the hardware and justify reactivation of Windows???? It seems unlikely to me, but I'm NO expert!

[rshaffer61]

Yes since the external was connected when the OS was shut down it may have thought you changed the hardware. This is a hiccup with the OS and not something that happens all the time.
Though it does happen once in awhile the fix is exactly as you did to reactivate. If it had been a normal day then Microsoft I'm sure would have explained this also.
Since this is not connected to internet all the time have you been able to keep the Windows Updates current?
Especially the critical updates which if not done could cause such a hiccup with the system if one of the patches from Microsoft specifically deals with just such a issue.

[Wrinkly Pete]

Yes since the external was connected when the OS was shut down it may have thought you changed the hardware. This is a hiccup with the OS and not something that happens all the time.
Though it does happen once in awhile the fix is exactly as you did to reactivate. If it had been a normal day then Microsoft I'm sure would have explained this also.
Since this is not connected to internet all the time have you been able to keep the Windows Updates current?
Especially the critical updates which if not done could cause such a hiccup with the system if one of the patches from Microsoft specifically deals with just such a issue.

Oh, yes. As you may have guessed by now, I'm FANATICAL about these things.

Whenever I go online the very FIRST thing I do is check for the very latest M.S.E. updates (it used to be AVG Internet Security updates), Windows Updates, and then all the other updates such as Google Chrome, Mozilla Firefox and various others. If I'm connected to the Internet on any of my PCs and I'm on for any length of time, I will check again. Usually about every 4 hours. It's amazing just how many newer updates you can collect in 4 hours!

My other 3 PCs get treated the same. Latest updates first, before I do anything. My main PC, which can be on 24 hours a day sometimes, is updated no longer than every 4 hours.

Did I do the right thing with the external backup drive when it wouldn't disconnect using "Safely Remove"?
It was the only option, other than just unplug it, and I've always been told NEVER to do that as it can permanently damage the drive and lose some/all of the data.

[rshaffer61]

I would never suggest disconnecting a external without using the Safely Remove option.
If it doesn't work then restart the system and try again. If still no joy then shutting down and then disconnecting would be the only way then.

[Wrinkly Pete]

I would never suggest disconnecting a external without using the Safely Remove option.
If it doesn't work then restart the system and try again. If still no joy then shutting down and then disconnecting would be the only way then.

OK, good. So I did do the right thing then. I only use that 1TB External Hard Drive to store all my PC's weekly backups. Nothing else.

Thanks for your help.
Cheers!

[rshaffer61]

I'm glad to see the issue has been resolved and I hope i answered all your questions for you. Thank you for allowing me to assist you and for letting GTG be part of your computer health.