View or change the Office Product Key

I’ve got several licenses for Office and Outlook but I’m not sure which one which ones I’ve used and which ones are free.
How can I find out which license I’ve used for which computer and how can I change the key if needed?

While you could simply try one of your Product/License Keys and see if it gets accepted, it’s not a very sophisticated approach. The proper method to determine or change the Product Key depends on your version of Office or Outlook. However, for either version there is no need to completely reinstall Office.

Determine the Product Key
Determining the used Product Key when using Office 2007 or previous isn’t directly supported by Microsoft. However, you can use a little program called Magic Jelly Bean Keyfinder to find out your used Product Key. Simply install and run the application to find out the Product Key (note: during the installation, there will be a prompt to also install a sponsored application which you can choose not to install).

If you are using Office 2010 or Office 2013, then this application will not work. However, Office 2010 and Office 2013 already include a vbs-script which will reveal the last 5 characters of your Product Key. It’s pretty safe to state that these 5 characters would already be more than enough to find out which Product Key you have used (as you should already have safely stored the full Product Key code somewhere else together with your other license information).

You can run the vbs-file in the following way;

1. Open a command prompt. For instance via;
   • Start-> All Programs-> Accessories-> Command Prompt
   • Windows XP
     Start-> Run; cmd
   • Windows Vista and Windows 7
     Start-> type; cmd
2. In the command prompt, type the following;
   • Office 2010 (32-bit) on a 32-bit version of Windows
     cscript "C:\Program Files\Microsoft Office\Office14\OSPP.VBS" /dstatus
   • Office 2010 (32-bit) on a 64-bit version of Windows
     cscript "C:\Program Files (x86)\Microsoft Office\Office14\OSPP.VBS" /dstatus
   • Office 2010 (64-bit) on a 64-bit version of Windows
     cscript "C:\Program Files\Microsoft Office\Office14\OSPP.VBS" /dstatus
   • Office 2013 (32-bit) on a 32-bit version of Windows
     cscript "C:\Program Files\Microsoft Office\Office15\OSPP.VBS" /dstatus
   • Office 2013 (32-bit) on a 64-bit version of Windows
     cscript "C:\Program Files (x86)\Microsoft Office\Office15\OSPP.VBS" /dstatus
   • Office 2010 (64-bit) on a 64-bit version of Windows
     cscript "C:\Program Files\Microsoft Office\Office15\OSPP.VBS" /dstatus
3. You should now get a screen with some license details such as the license name, type and the last 5 characters of the Product Key. 

Office 2010 and Office 2013 offer a scripted method to lookup your Product Key.

Changing Product Key for Office XP/2002, Office 2003 or Office 2007
Changing the Product Key for Office 2007 or previous requires you to go into the Registry.

1. Browse to the following key:
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\<version>\Registration
2. Now is a good point to make a backup of that key;
   Right click on the key, choose Export… and save the file to for instance your Desktop.
3. Expand the Registration key in the Registry and you’ll see one or more sub keys which contain a lot of characters between curly brackets; { and }
   Each sub key stands for an installed Office application.
   The proper name for this identifier string is called a “GUID”.
4. Click on the sub key to reveal its contents in the right pane.
   The SuitName key will reveal the name of the package that you have installed. If you have multiple GUID sub keys listed, you can use this key name to determine for which installation you’ll be changing the Product Key.
5. In the pane on the right, delete the following keys;
   • DigitalProductID
   • ProductID
6. Close the Registry and start Outlook (or any other Office application); you’ll now be prompted to fill in your Product Key and activate Office again.

Delete the DigitalProductID and ProductID key to reset your Product Key.

Changing the Product Key for Office 2010 or Office 2013:

Changing the Product Key for Office 2010 or Office 2013 doesn’t require a trip to the Registry and can be done directly from the Control Panel or via a command line.

To change it via Control Panel, open the “Add/Remove Programs” applet (Windows XP) or the “Uninstall a Program” applet (Windows Vista or Windows 7). Locate your Office 2010/2013 application and press Change. Setup will now start with the option “Enter a Product Key” which allows you to enter a different product key.

You can also change the Product Key via the OSPP.VBS script. Instead of using the /dstatus switch, you must use the /inpkey:value switch where you should replace value for your Product Key. 
For Example: cscript ospp.vbs /inpkey:xxxx-xxxx-xxxx-xxxx-xxxx

Hope this will be useful...
Share it.

Malware attack strikes, posing as Skype password change notification

If Skype users didn't have enough to worry about this week security-wise (with a worm spreading across the system), there's now another threat to warn about.
Emails have been spammed out by cyber-criminals, posing as messages from Skype, claiming that you have changed your password on the service.
Here's an example of one such email (click on it for a larger version):

If you look carefully, you may spot that the spammers made a clumsy spelling mistake:

Password successfully changed
Your new Skype password has been set.
You can now view your attached call history and inscturtions how to change your account settings.
If the changes described above are accurate, no further action is needed. If anything doesn't look right, follow the link below to make changes: Restore password
Talk soon,
The people at Skype

Perhaps surprisingly, the links really do point to the genuine Skype website at skype.com.
However, a file (Skype_Password_insctructions.zip) is attached to the email, and if you make the mistake of unzipping and executing its contents (Skype_Password_inscructions.pdf.exe) you run the risk of infecting your Windows computer.

The malware, which is detected by Sophos products as Troj/Backdr-HN, opens a backdoor onto your computer, giving remote hackers access to your system.

The danger is, of course, that users worried by the recent worm will be frightened that their Skype password has been changed without their consent, and open the attachment - and thus infect their PC.

As always, be on the lookout for unsolicited suspicious emails and always be wary of opening attachments which arrive out of the blue. In this case, the file is using the well-known "double extension trick" to dupe the unwary into believing that they might be clicking on a PDF rather than executable code.

Metropolitan Police malware warning issued - Beware the ransomware attack!

ComputerWorld today reports that the UK's Metropolitan Police has warned Windows users of a malware attack that poses as a message from the computer crime-fighting cops themselves.

The ransomware attack attempts to lock the computer, and posing as an unofficial notice from a law enforcement agency, claims that the victim's PC has been determined to have visited illegal websites.

Only payment for a fine, claims the message, will restore the computer's functionality.

Various versions of the alert messages have been seen - here's one example:


Part of the poorly-worded alert reads as follows:

Attention!!!
The process of illegal activity is deleted. According to UK law and Metropolitan Police Service and Strathclyde Police investigation your computer is locked!
The following violation is detected: You IP-address "[redacted]". Forbidden websites containing pornography, child pornography, Sodomy and called violence against children on, violent material toward people were visited from this IP-address!
Moreover and e-mail spam was sent you're your computer, emails containing terroristic materials. This locking serves to stop your illegal activity.
To release a lock your computer you should pay the fine in amount of £100. In the case of ignoring the payment, the program will remove illegal materials while keeping your personal information is not guaranteed.

Of course, it's very likely that you haven't been visiting extremist websites or viewing child abuse material. That may just be the hook used by the fraudsters to trick you into taking the warning seriously. Ransomware is nothing new. We've seen plenty of examples in the past where cybercriminals have duped users into coughing up cash in order to get their computer working properly again.

But the threat of legal action, and what - on first glance - might appear to some computer users to be a sign that they are in trouble with the police, could be enough to scare some into electronically transferring funds post haste.

The police recommend that anyone who is duped by the scam should contact their credit card company immediately, and underline that they would never use such tactics to make contact with the public or demand funds.

It's likely that the messages are appearing on computer users' screens because they have become infected whilst visiting compromised websites, or have been duped into installing malicious software onto their computer.

Sophos has linked Mal/Bredo-Q to some of the reports we have seen of this particular ransomware attack, but of course it's perfectly possible that malicious hackers could use other malware to display the same or similar messages posing as police warnings.

As always, keep your security patches and anti-virus solutions updated, and your wits about you.