Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running Windows XP SP2 on an old PC for my families internet. Two days ago it prompted that I had three days left to re-validate Windows due to 'Significant hardware changes'. My issue is, I know for a fact that I have not made any hardware changes since I installed windows three years ago.

My concern is that this is not a legitimate Windows prompt and may be some form of phishing malware trying to get my CD-Key. It still says I have three days left to revalidate which adds evidence to this theory.

Does anyone know why Windows would need re-validating? Is there any malware that would account for this behaviour?

share|improve this question
up vote 3 down vote accepted

If you do not have a virus, I suspect simple file corruption. If the c:windows\system32\wpa.dbl got damaged, it may cause this also. Running chkdsk /f then a system restore may fix it, but you should probably run chkdsk 2-3 times no matter what even if you decide to just re-validate.

For more on validation, you can read these two articles: (expand all and read "You might have to activate Windows again if:")

share|improve this answer
chkdsk showed multiple problems. It looks like this was the cause. – Christopher Jul 25 '11 at 8:36

The Windows Genuine Advantage Validation Tool may have been updated, but the process of "Activation" will never ask you to provide your Windows Product Key -- if automatic activation fails, then a series of codes will be presented and you'll be provided with a toll-free telephone number to contact Microsoft's Activation Centre to complete the process with an automated telephone system or an actual person.

If any of the firmware on your hardware got updated, this could trigger a detected hardware change, although this is unlikely.

Tools to detect and remove SpyWare that I've found to be reliable are:

  MalwareBytes (free)

  SpyBot - Search & Destroy (free)

share|improve this answer
I am sorry - should have mentioned that I have already run both SpyBot and MalwareBytes and they came up with nothing. Is it possible that the windows auto-update changed the firmware? – Christopher Jul 21 '11 at 6:21
@Christopher, not likely. Firmware updates, unlike driver or application updates, rarely occur without some type of user interaction (read as "I have never seen it occur"). The most likely scenario is like KCotreau stated. – Sarge Jul 21 '11 at 11:41
@Christopher: If you still suspect SpyWare after running those tools, it's certainly possible that your system is infected by SpyWare that actively hides from well-known SpyWare removal tools using a variety of stealth techniques. To circumvent this, you'll need to plug your hard drive into a "clean" computer as a secondary drive and scan it that way (then the SpyWare will definitely be dormant and can be detected). – Randolf Richardson Jul 21 '11 at 16:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .