XPE device suddenly wants re-activation

[Lucvdv]

An XP Embedded device (kiosk-type app, XPe SP2) with a build date of April
12, 2005 according to weruntime.ini, suddenly begins asking for
re-activation:

Microsoft Piracy Control
Your copy of windows was activated by another user
To help reduce software piracy, please re-activate you copy of windows now
We will ask you for billing details, but your credit card will NOT be
charged
You must reactivate Windows before you can continue to use it
[etc...]

There are two accounts:
- A plain user account for normal daily use, running a custom shell. This
still works normally (also after failed or canceled activation attempts
by the other account).
- An administrator account for management, running the standard GUI shell
(explorer.exe): trying to log on to that account causes the activation
dialog to appear.

Continuing the activation results in it failing "because another user has
already used the same key" (of course it would, there are several identical
devices with that same key, all with paid-for licenses).

When you cancel it instead of letting it activate, the system shuts down.


Now I'm trying to figure out why it started doing this and if there's a way
to turn it back without a full reinstall (restore of post-FBA disk image),
in case more devices should "get the disease".

It is running from a standard harddisk, without EWF.

Are there any ideas, besides file (disk) or registry corruption that makes
windows think its activation has become invalid?



I half suspect that someone with access to the admin account has been
playing around with it and visited Windows Update, or manually installed
some updates or SP or so.

At the same time I find that hard to believe, because WU or SP installers
would (or should) refuse to run on an XPe setup.

 

[Lucvdv]

An XP Embedded device (kiosk-type app, XPe SP2) with a build date of April
12, 2005 according to weruntime.ini, suddenly begins asking for
re-activation:

Microsoft Piracy Control
Your copy of windows was activated by another user
To help reduce software piracy, please re-activate you copy of windows now
We will ask you for billing details, but your credit card will NOT be
charged
You must reactivate Windows before you can continue to use it
[etc...]

Found the probable cause: two trojans and a rootkit, haven't figured out
yet what the rootkit was hiding.

Also found how they got in: despite the fact that the normal user account
starts a custom shell with very limited functionality, a poorly designed
printer driver creates a backdoor into internet explorer. From there to
any application is as difficult as typing "C:\" in the address bar.



This is actually not the first printer driver I find to have this bug
(which is why I found it so fast).

The first one I ever saw do it was a cheap HP inkjet. When that one jammed
or ran out of paper, the driver opened a help file with a link to the
printers control panel -- all with local system privileges. The printers
control panel is displayed by explorer.exe, but whenever explorer.exe is
started, the first thing it does is check if another instance is running,
and if there isn't, it starts as shell (taskbar and desktop) -- still with
local system privileges.

There've been several other printer models and brands since that create
similar backdoors, this time it's a Brother laser.

My problem is that it's some clueless management drone who decides on what
printers are going to be used, and price weighs FAR more than quality and
security in his decisions (I never even get to see them before the problems
arise, in which case it's always my fault until I can prove otherwise).


The XPe target had to be "complete" enough to allow someone to install a
printer driver after FBA, a requirement I personally supported during the
planning phase, and that I've regretted ever since it first bit me.

 

[Lucvdv]

An XP Embedded device (kiosk-type app, XPe SP2) with a build date of April
12, 2005 according to weruntime.ini, suddenly begins asking for
re-activation:

Microsoft Piracy Control
Your copy of windows was activated by another user
To help reduce software piracy, please re-activate you copy of windows now
We will ask you for billing details, but your credit card will NOT be
charged
You must reactivate Windows before you can continue to use it
[etc...]

Found the probable cause: two trojans and a rootkit, haven't figured out
yet what the rootkit was hiding.

Sought it out to the bottom: forget the reactivation issue.

The reactivation dialog <i>was</i> a trojan (and it looks like one of our
technicians was dumb enough to fall for it - I got a bit suspicious as soon
as I read about credit card data in his mail reporting the problem, but it
was too late).

See
http://www.symantec.com/enterprise/security_response/writeup.jsp?docid=2007-042705-0108-99&tabid=2