Thanks Howard, it works like a champ!
 
Mike
 
From: Howard.Patterson@tn.gov
To: dragonforen@hotmail.com
Subject: RE: [Vol-users] Using Windows XP VMs for testing and windows activation
Date: Thu, 12 Apr 2012 23:27:12 +0000

The easiest way I've found, and one I think will work in your situation, is to boot into Safe Mode with the XP system. Then choose "Start, Run" and enter the following:
 
rundll32.exe syssetup,SetupOobeBnk
 
Those are both the letter "Ohs" in there and it is case sensitive. If it works you won't see any sign of it until you reboot. If you type it incorrectly an error message will come back. This basically resets how long you have to activate (I believe 30 days).
 
-Howard

From: vol-users-bounces@volatilityfoundation.org [mailto:vol-users-bounces@volatilityfoundation.org] On Behalf Of Mike Lambert
Sent: Thursday, April 12, 2012 6:06 PM
To: Volatility List
Subject: [Vol-users] Using Windows XP VMs for testing and windows activation

I have not used VMs in the past to do malware testing because of the windows activation problems I run into. Clone, you have to activate; copy, you have to activate; move, you have to activate. I'm surprised that it still activates!
 
I would like to talk to someone who knows the best way to deal with this. (or not) I'd like to have a clone that is infected that I can go back to later. (I do that now with hard disk images - I can put back a disk image to disk and plug it into the computer and bring it right back up.)
 
I can continue to use my test system, which I do not have any problem with. I blow a copy of a clean system to disk and then go on testing without any activation problems.
 
Let me know if you have a solution.
 
Thanks,
Mike