microsoft security essentials says windows not genunine

will self destruct in 30 days -

This morning, Microsoft security essentials sent this message to desktop  (XP machine):  validate windows to be genuine or MSE will discontinue after 30 days.  I have genuine windows, have disk number, etc in box that PC came in.  I tried validating, etc.  and got many confusing loops,   and 'scripts don't run on this page,' yada, yada, yada.  MS site not helpful.  Is this a scam from a very clever pflisher?   I noted a very brief message at the end, that a "zombie" file had been saved to my system.

 

whats up with MSE?  (oh, whats a zombie file)   and how do I fix this?

I did not have this problem before.  Only thing different I have done differently, recently, is run super anti-spyware for the first time.  Is this a scam / virus?

 

 

49,642 views 25 replies
Reply #1 Top

Please read the whole thing before doing anything. OK? :)

1. A zombie file? try here: http://www.exterminate-it.com/malpedia/remove-zombie

Azombie file can have more than one meaning though, Elana. 

1- A zombie (also known as a bot) is a computer that a remote attacker has accessed and set up to forward transmissions (including spam and viruses) to other computers on the Internet. The purpose is usually either financial gain or malice. Attackers typically exploit multiple computers to create a botnet, also known as a zombie army.

Typically, a zombie is a home-based PC whose owner is unaware that the computer is being exploited by an external party. The increasing prevalence of high speed connections makes home computers appealing targets for attack. Inadequate security measures make access relatively easy for an attacker. For example, if an Internet port has been left open, a small Trojan horse program can be left there for future activation.

There are a few other kinds of zombies:
In one form of denial of service attack, a zombie is an insecure Web server on which malicious people have placed code that, when triggered at the same time as other zombie servers, will launch an overwhelming number of requests toward an attacked Web site, which will soon be unable to service legitimate requests from its users. A pulsing zombie is one that launches requests intermittently rather than all at once.

2- On the Web, a zombie is an abandoned and sadly out-of-date Web site that for some reason has been moved to another Web address. Such zombies contribute to linkrot.
3- A zombie file is one left over after uninstalling software. Usually just deleting them is pretty safe.

2. Why are you using 2 antivirals/trojan/malware/rootkit? They can conflict and cause problems.  

General answer:  

http://answers.microsoft.com/en-us/protect/forum/protect_start/mse-other-anti-malware-spyware-programs/81b25b88-6097-46b7-984a-73e09be3d99a  

to remove Super Antispyware: http://www.superantispyware.com/supportfaqdisplay.html?faq=47

A list to remove various different antiviral/etc. programs:

http://answers.microsoft.com/en-us/protect/forum/protect_start/list-of-anti-malware-program-cleanupuninstall/407bf6da-c05d-4546-8788-0aa4c25a1f91

 

 

3.  I suspect the new installation is the one causing problems. Maybe it deleted an important file? After removing the super antispyware I would run from the elevated command prompt   sfc /scannow      also consider doing  sfc /revert  which should restore your system files to their original condition. You have to run them as "Administrator" (right click when you go to "Run").

A good explanation here: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/system_file_checker.mspx?mfr=true

 

4. Yrag is the resident expert in all things computer... doing the scans shouldn't harm anything, but I'd definitely remove the super antispyware first. You can certainly pm him and ask for help. He's just so knowledgable. I also think (hope) he'll be nice to you. ;) 

5. Consider doing a System Restore to a time before having installed the super antispyware. 

 

Reply #3 Top

2. Why are you using 2 antivirals/trojan/malware/rootkit? They can conflict and cause problems.  

General answer:  

http://answers.microsoft.com/en-us/protect/forum/protect_start/mse-other-anti-malware-spyware-programs/81b25b88-6097-46b7-984a-73e09be3d99a

Just to clarify this one. Using more than one *real-time* application can cause problems (this is in the link, but not emphasized very well). This is mostly the case with Anti-virus apps, which usually have "always on" components and tend to scan constantly. The anti-malware apps that you launch and run a manual scan with, and even multiple manual anti-virus scans, are perfectly fine, because those are run one at a time and you're not going to have a situation where multiple apps are trying to scan the same file at the same time.  

Reply #4 Top

I would be interested to know if you do find a virus that caused this.

Microsoft should take into consideration that a virus can change system files enough for Windows to not pass WGA.

Terminating your antivirus protection is counter productive and a bad move on their part, in this situation.

Reply #6 Top

Hi ElanaAhova!

 

Sorry to hear about your computer problems.  Internet virus infections are horrible.  However, many can be avoided by following specific web habits. 

1. Don't open unexpected emails and, if you think it is one you have to open, do not click on any links in an email if it can be avoided.  Never open a chain mail or ecard.

2. Do setup and use a limited access user account when on the internet.

3. Do keep your software up to date especially Java, Flash Player, and Acrobat.

4. Do get good cleanup software that deletes temporary files and cache files and use it when closing off the internet.

5. Don't pile the addons and toolbars into your browser.  If I see an addon or toolbar that has sneaked into my Browser I kill it.  They are just another point of attack for scammers and many are viruses.

6. Don't fill your PC with every software that's available.  Too much software loaded on a PC makes the registry a mess and increases Virus scan times to the point you won't want to scan.

7. Do regular quick scans of your computer.

If it wasn't a virus that caused your problem well then the above is just general useful advice.

Reply #7 Top

Big foot, i already follow what you wrote.  I don't have any tool bar addons, and it was by doing what i thought was  a freestanding scan with superantivirus spyware that SEEMED to cause the other.   i do not think I have more than one anitmalware running at a time.   just MSE.  The other weird thing, that just happened as i write this is, occasionally, my entire screen goes totally black, just for a second or two.   Then relights to exactly where I left off...

Reply #8 Top

Superanti spyware runs in the background/  I just wanted it to scan when I told it too.  Opps.  will try uninstall it.  then s system restore

 

 

secunda was helping me find all the software that had updates ready...  with this also conflict with MSE?

Reply #9 Top

I use both superanti spyware and MSE and never had any conflict ever. Further more Supranti spyware is a good program that I would not want to get rid of. I seldom use it and use malwarebytes more often but it comes in handy sometimes. That being said I never run programs at the same time and have it configured so its not running in the background. I just open it when I need it. By the way sometimes more then one program is needed. I have seen cases where one program will not pick something up but the other will. For years I ran only spybot search and destroy and adware se because they scanned different things. Now I do not use either of those programs.

Reply #10 Top

Quoting JuniorCrooks, reply 9
I use both superanti spyware and MSE and never had any conflict ever.

Quoting JuniorCrooks, reply 9
That being said I never run programs at the same time and have it configured so its not running in the background.

By not running them simultaneously, you are avoiding the conflicts I mentioned.

 

Reply #11 Top

Perhaps doc but I am curious now so doing the scans simultaneously. I will run them a few times just to see what happens. Call me a sucker for punishment I guess.

Scan number 1 completed with no problems. I suspect Elana's problem is not the result of 2 scans at the same time. You will not get a bot by doing that. Its still good practice not to do it so don't take me wrong and think I am arguing the point. I just like to know things for sure through my own testing.

Reply #12 Top

You all should get rid of Super AntiSpyware. Malewarebytes is a better choice.

Reply #13 Top

Quoting kona0197, reply 12
You all should get rid of Super AntiSpyware. Malewarebytes is a better choice.

 

That is a matter of opinion. I use both seldom but do use malwarebytes more then Super AS. If you say to get rid of it I would like to know why you say that instead of just saying get rid of it. It has never caused me any problems and has found the odd thing that malwarebytes did not pick up. It only stands to reason to me that some programs will do a better job in certain areas then others, at least that has been my experience and can't speak for everyone.

Now that I saw yrag's post it reminded me of something yrag had said in an unrelated post. You do not need a lot of crap installed on your computer. The more you overkill the more conflicts you will experience. Like I said I use a couple of programs seldom and the reason I do not have to use them often is because I am careful what i do with my computer. I had to learn the hard way not to be so trigger happy with links and so forth.  Its called common sense preventative maintenance.

Reply #14 Top

Quoting kona0197, reply 12
You all should get rid of Super AntiSpyware. Malewarebytes is a better choice.

Kona. you'll never change.......

If you can't add something constructive to the topic, at least do me the favor (and most others I imagine), and just STFU.

Reply #15 Top

Might not be the super antivirus, but I'm trying to eliminate things. The zombie file might not be a bot. either way, getting rid of it won't hurt.

the Kaspersky online scanner isn't working.

I'd uninstall the super... and if only to make things simpler. Then install the 30 day trial of the Kaspersky Internet Security (it'll install even on an infested computer) and run it. Elana can always uninstall it later or pay for it.

Then, if all's well, I'd do the sfc /scannow ... can't hurt. 

If both those things fail to yield an answer, then a format/restore from backup would be the next step for me (not having yrag's expertise). 

Running Malwarebytes wouldn't hurt.

Quoting ElanaAhova, reply 8
secunda was helping me find all the software that had updates ready... with this also conflict with MSE?

Secunia shouldn't bother it in the least. No need to uninstall... just beware. It can give wrong answers (if you've changed your OS). 

 

*edit: Now yrag is here, I'm heading out.

Elana: Please listen to what yrag advises and do it. He's a true pro at fixing stuff.

Reply #16 Top

Quoting DrJBHL, reply 15
*edit: Now yrag is here, I'm heading out.

...thanks a lot.

 

ElanaAhova:

Open an Elevated Command Prompt:

"C" being your root drive;

Type/run: chkdsk C: /F /R



Reply #17 Top

I bet he got the following:

LizaMoon infection: a blow-by-blow account

 By Fred Langa

http://windowssecrets.com/2011/04/07/01-LizaMoon-infection-a-blow-by-blow-account

 

A nasty piece of malware known as LizaMoon has hijacked links on millions of websites in the past weeks, including some normally safe iTunes and Google links.

Fortunately, LizaMoon is easy to avoid if you know what to look for.

Using rogue-AV scare tactics, LizaMoon tries to trick you into running bogus security-scan and virus-cleanup tools on your PC — but it's pure malware.

Reply #18 Top

Hi Yrag..  I ran chkdsk c: /F /R  It replied it could not run it because it was in use by another program.. asked if i wanted to run it next time i started up Y/N   I typed   "Y"   I already did a restore, and I have MSE installer on my drive... so i will have to wait  30 days, yes?  I really appreciate all your help.. you are the best....

Reply #19 Top

Quoting yrag, reply 14
Kona. you'll never change.......

If you can't add something constructive to the topic, at least do me the favor (and most others I imagine), and just STFU.

Whatever. What I added was constructive. I was under the assumption from reading past posts on this site and others that Malewarebytes is a better choice. No need to bite my head off.

Reply #20 Top

Quoting ElanaAhova, reply 18
... so i will have to wait 30 days, yes?

ah....no.....but thanks for the chuckle.

If you did the restore and than did the 'chkdsk' command, than it will run the on the next re-boot. Depending on the amount of data (100 GBs+) on the drive, allow for about an hour to run. If it's the other way around, re-run the command. What you describe in your above posts indicate file corruption.

+1 Loading…
Reply #21 Top

Thanks, yrag... could you take a moment and teach me the difference between C: sfc /scannow and chkdsk C: /F /R ?

Is it sfc (sys file checker) will only look at windows whereas chkdsk /f /r will do the same but for the entire C (or whatever letter) drive? 

Reply #22 Top

I'm not Yrag but that ones easy.

 

sfc  scans the integrity of protected system files and depending on the switch, can replace them to the correct versions

 

Chkdsk detects drive errors and depending on the switch, attempts to repair them

 

For a list and descriptions of the switchs, type in /? after the command.

 

Example:

sfc /?

chkdsk /?

Reply #23 Top

/?

j/k, Cars... thanx... guess what i said was ok then. 

Reply #24 Top

Yes, also in addition, chkdsk will detect and mark bad sectors as unusable.

Reply #25 Top

Checkdisk ran, all fine now... i think....  thanks for the info about the soft switches on the ckdsk command...  for people like me, its so easy to get lost because i can't see the forest because of the individual trees.. yrag, doc, ya'all  thank you for helping see whats important in the plethora of details that flood the 'self -help ' sites re malware, sys op, etc...  and who says chivalry (the good part!)  is dead?