WinGate License Failure

[kpfuselier]

I'm not familiar with WinGate, and I don't know how anything related to it ever got on my computer, but now every time I log into Windows, I get the following error message:

WinGate License Failure
This copy of WinGate is unlicensed, or the license has expired.
WinGate will not operate without a valid license. Consult the
help file for information on licensing WinGate.

I cannot find anything related to WinGate on my PC, except in the Registry, but I even deleted those entries, but every time I boot up, I get the error again, and the entries are back in the Registry.

How do I fully clean WinGate off of my PC?

Thanks.
Kevin

[Pascal]

I cannot find anything related to WinGate on my PC, except in the Registry, but I even deleted those entries, but every time I boot up, I get the error again, and the entries are back in the Registry.

Hi Kevin,

I can't find that message in the source code. Can you post the registry keys that it appears in, please ? (That might help narrow it down a bit)

The normal installation location for WinGate is C:\Program Files\WinGate for the Server. OR you can search your PC for a file called "Uninstall.log". This file should contain information relating to WinGate (And will normally be present if an installation of WinGate was ever done). Also, check to see if you have any files in your Windows directory that match "Qbik*"

There are some virusses that uses an older version of WinGate (One that was pre-NAT and thus not using Qbik*.sys / Qbik*.vxd) as part of its installation. That might explain the registry entries that were created and the apparent absence of WinGate on the PC itself.

http://www3.ca.com/virusinfo/Virus.asp?ID=9739

Or, alternatively, Trojan.Downloader.Cile.

If you have an antivirus scanner available, it might pay to check your system to ensure that this is not the case.

[kpfuselier]

Hi Pascal,

Thanks for your response. Here is additional information based on your suggestions of what to check:

1. I do not have a C:\Program Files\WinGate folder. Actually, I don't have any WinGate folder on my PC.

2. I do not have anything for Qbik* (except history items for these forums).

3. uninstall.log

4. Virus scanning... I have Norton AntiVirus, and I keep it current (including regular scans and regular checks for new updates). Virus definitions date is 1/29, and my last full system scan was yesterday (1/31).

5. Registry... The following entries are in my registry (despite my attempts to delete them permanently - they'll reappear after rebooting):

HKEY_LOCAL_MACHINE > SOFTWARE > Qbik Software
Name - Type - Data
Default - REG_SZ - (value not set)
There is also a WinGate folder under the Qbik Software folder,
and it contains the same entry as above (default, REG_SZ,
value not set)


[quote="Pascal"][quote="kpfuselier"]I cannot find anything related to WinGate on my PC, except in the Registry, but I even deleted those entries, but every time I boot up, I get the error again, and the entries are back in the Registry. [/quote]

Hi Kevin,

I can't find that message in the source code. Can you post the registry keys that it appears in, please ? (That might help narrow it down a bit)

The normal installation location for WinGate is C:\Program Files\WinGate for the Server. OR you can search your PC for a file called "Uninstall.log". This file should contain information relating to WinGate (And will normally be present if an installation of WinGate was ever done). Also, check to see if you have any files in your Windows directory that match "Qbik*"

There are some virusses that uses an older version of WinGate (One that was pre-NAT and thus not using Qbik*.sys / Qbik*.vxd) as part of its installation. That might explain the registry entries that were created and the apparent absence of WinGate on the PC itself.

http://www3.ca.com/virusinfo/Virus.asp?ID=9739

Or, alternatively, Trojan.Downloader.Cile.

If you have an antivirus scanner available, it might pay to check your system to ensure that this is not the case.[/quote]

[kpfuselier]

> 3. uninstall.log

I forgot to elaborate on this one before sending my last message... I only found 3 uninstall.log files on my PC. Two were related to TurboTax products, and the other one was under Windows, but it did not have anything with qbik or wingate in the text.

[Pascal]

1. I do not have a C:\Program Files\WinGate folder. Actually, I don't have any WinGate folder on my PC.

That sounds even more suspicious then.

3. uninstall.log

The additional details you posted about this might help. Does it mention WGIC or Internet Client at all ?

5. Registry... The following entries are in my registry (despite my attempts to delete them permanently - they'll reappear after rebooting):

Those registry entries are basically the root keys. There should be more there ... no subkeys off WinGate at all ?

What Operating System are you running ? (It might be possible to identify the task easily by running Task Manager and seeing if there is a WinGate.exe or other unknown service running).

[kpfuselier]

The 3rd uninstall.log file I mentioned earlier is actually one for QuickTime ( the other 2 being for TurboTax). The QuickTime one is under Windows\System32\QuickTime. I did check it for WGIC (found nothing), and there was also nothing noteworthy with "internet" in the string.

> There should be more there ... no subkeys off WinGate at all ?

Correct. I deleted the Qbik Software (again) while I was in there. I'll reboot shortly, and it should be there again.

> What Operating System are you running ?

Windows XP. There is no Win* task running in Task Scheduler (I guess that's the problem with the error I get - it's trying to run a task, but it encounters some license issue, and thus, never makes it to Task Scheduler?

[Pascal]

Correct. I deleted the Qbik Software (again) while I was in there. I'll reboot shortly, and it should be there again.

Okay, I'm just trying to discover which one it is - WinGate / WinGate Internet Client that is causing this.

As you're fairly comfortable with the registry (Although the usual editing warnings apply) you can check:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion.

Check through:

Run
RunOnce
and RunOnceEx.

I know 98, etc. have a handy tool to show you all this, not sure where to find it on XP though. You can possibly find an abberant application in there that should not exist.

Alternatively, check through the list of Services as well (Service Control Manager) to see if there is a Qbik WinGate Engine in there. You can always set that to manual start.

The fact that you don't have a WinGate folder would indicate to me that it is some kind of trojan / malware, hence the executable might not be called "WinGate.exe".

If you have an application that lists ports -> applications you can always check that to see which application is the largest user of ports (And thus track it down) - Qbik PortList, part of the NetPatrol installer will do this for you.

[kpfuselier]

Thanks for all your feedback...

I'm not familiar with the Service Control Manager you mentioned...do you know where I would find that list in XP?

I'm also not familiar with the ports comments you mentioned, but hopefully one of the other areas will target it.

I'm e-mailing you the list of Run entries in my Registry, in case anything jumps out to you as out of the ordinary. I have to leave for a bit, but I'll go through them later to see if I can target any as unusual.

Oh, and after I rebooted, it did return as before (the Qbik and Wingate subfolder within the registry).

[Pascal]

I'm not familiar with the Service Control Manager you mentioned...do you know where I would find that list in XP?

Right click on My Computer, select "Manage". Scroll down to "Services and Applications" and expand that subkey. Then you should see a "Services" one as well. Clicking on that takes you to the page for Service Control Manager.

I'll check through the email when I get it.

[Pascal]

Just a brief note to anyone experiencing this - check for the presence of "MMTask.exe" as a running service.

While this can be a legit. multimedia service, there are some rather malicious applications that uses the same name. It is basically a renamed WinGate.exe, so a right-click to see the version information resource OR a cmd line "mmtask -?" will tell you which of the two it is. (In the case where your scanner did not pick up on it)

A Google search for "MMTask.exe" will point at all the appropriate links.