Windows Genuine Advantage Validation Tool — это объект ActiveX. Используется только на страницах Windows Update. Реализован в модуле LegitCheckControl.dll. Распространяется как обязательное обновление KB892130. Назначение: сбор сведений и отправка их на сервер Microsoft, и проверка «подлинности Windows». Т.е. его основная задача имеет скорее шпионский характер, тайком от вас собирать информацию. Вот информация, которую собирает WGA:
Это взято из оффициальных источников, остается только гадать, что может быть скрыто от общественности, учитывая маниакальную тягу Microsoft постоянно темнить и лукавить. Но даже этот набор очень сильно впечатляет. Microsoft уже настолько сильно обнаглела, что считает любой компьютер, на котором установлена Windows чуть ли не своей собственностью (В новой операционной системе Vista положение дел ещё хуже).
Итак, на вопрос «Кто в доме хозяин, Я или тараканы Microsoft?», бодро отвечаем — Я! Что делать с этим WGA? То что он является неудаляемым, это очередные басни Microsoft. Удаляется этот жучок элементарно, нужно выполнить две команды:
Всё, поганца больше нет! Но это не самое лучшее решение, поскольку при посещении узла обновлений вас первым делом заставят установить его по новой. Поэтому задача такая: чтобы этот поганец был установлен, но не мог проводить свою вредоносную деятельность.
Чтобы лишить этого жучка возможности шпионить, нужно заблокировать доступ к серверу mpa.one.microsoft.com, порт 443. Лучше всего это сделать с помощью надежного брандмаузера (а не встроенного в Windows, ему нельзя доверять). Если такого нет, то можно следующий трюк: Открыть блокнотом файл \WINDOWS\system32\drivers\etc\hosts и дописать в конец файла следующую строку:
Она нужна для сброса кэша DNS. После этого, при попытке WGA обратиться к серверу mpa.one.microsoft.com, все его запросы будут отправляться на IP=127.0.0.1 (адрес локального компьютера), а не на настоящий IP=131.107.115.40. Поэтому WGA не сможет ничего передать и получить.
Основная задача выполнена — шпионящему модулю заткнули рот! Осталось разобраться, что делать с проверками «подлинности». Для начала нужно убедиться, что всё исправно. Если вы попадаете на страницу с сообщением об ошибке (типа код ошибки: 0x80080205), то это говорит о каких то неисправностях самой системы проверки подлинности, а не о проблемах с вашим ключом. Подробности о кодах ошибок, и что с этим делать, можно найти здесь. Для теста работы непосредственно самого модуля WGA можно использовать утилиту RunWGA. Если всё исправно, и вам предлагают купить за «бесценок» лицензию, то начинаем дурачить WGA:
На заре развития этой системы также родилось достаточно большое число способов её обхода. Со временем Microsoft некоторые из них поборола, но часть до сих пор работают (против лома нет приёма).
1. Прямые ссылки
В этом случае вообще вся эта система WGA никаким образом не задействуется, вы просто скачиваете то, что вы хотите, если точно знаете где оно расположено. Проблема может быть в получении прямых ссылок.
2. Смена ключа.
Самый простой способ обойти WGA — это заменить ключ на признанный подлинным. Проблема только в том, что где его взять, и в том, что активное распространение ключа приводит к его блокировке, поэтому прежде чем приступать к этой процедуре, заблокируйте сервер mpa.one.microsoft.com (см. выше).
Существуют разные приемы смены ключа, расскажу как это быстро сделать для VLK (корпоративная версия, не требующая активацию).
Нужно запустить редактор реестра и экспортировать ключ реестра:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wi
например, в file1.reg. Затем его скопировать и переименовать file2.reg. В файле file2.reg изменить значение параметра.
Было: "OOBETimer"=hex:ff,d5,71,d6,8b,6a,8d,6f,d5,33,93,fd Стало: "OOBETimer"=hex:00,d5,71,d6,8b,6a,8d,6f,d5,33,93,fd
С помощью file2.reg портим значение параметра в реестре, с помощью file1.reg — восстанавливаем.
C:\WINDOWS\system32\oobe\msoobe.exe /a
Инструменты готовы. Последовательность следующих действий:
- портим параметр (file2.reg)
- ярлыком msoobe.exe запускаем активацию
- выбираем «по телефону»
- выбираем «изменить ключ продукта»
- набираем новый ключ
- нажимает «обновить»
- нажимает «напомнить позже»
- закрываем msoobe.exe
- восстанавливаем параметр (file1.reg)
- Перезагружаемся
- Удаляем C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage\data\data.dat
Новый ключ установлен.
3. С помощью брандмаузера или файла hosts.
Избежать не желаемого результата проверки можно лишив возможности проверочный модуль получать и/или отправлять информацию на сервер Microsoft mpa.one.microsoft.com (IP=131.107.115.40, порт 443). О том, как это сделать, написано выше. Но есть один нюанс. Дело в том, что сам проверочный модуль содержит «черный список» ключей. Версии WGA регулярно обновляются, черный список соответственно расширяется. Поэтому есть вероятность, что однажды, после установки свежей версии WGA, ваш ключ может оказаться в этом списке.
4. Патч проверочного модуля.
Обойти проверку подлинности можно также пропатчив проверочный модуль LegitCheckControl.dll, либо заменив его на уже пропатченный. Но это не очень эффективный способ, учитывая достаточно небольшой интервал времени (около двух месяцев) существования версии. Как только будет выпущена новая версия, пропатченный модуль будет заменен на оригинальный. Я впервые столкнулся с этим явлением в начале 2006, а концу года мне уже надоело подгонять патчи под новые версии, к тому же Microsoft стала шифровать в модуле участки кода, наиболее подходящие для патча. Поэтому появились другие инструменты: IeBlinder и MgaBlinder 3.5.
5. С помощью MgaBlinder 3.5.
Это новый подход к проблеме обхода WGA. MgaBlinder 3.5 представляет собой браузер, использующий движок InternetExplorer. Фактически это и есть InternetExplorer, только пользовательский интерфейс (органы управления) не от Microsoft. Конечно он выглядит недоразвитым, но зато он свободен от всяких пакостей, и его назначение — беспрепятственно ходить по сайтам обновлений. Кроме этого он в ходе путешествий собирает прямые ссылки на загружаемые файлы, и адреса страниц, где эти ссылки находятся.
Найти MgaBlinder 3.5 можно здесь
6. С помощью IeBlinder.
Это небольшой модуль расширения Internet Explorer. После его установки в меню «Сервис» браузера появится два дополнительных пункта «Редактировать файл hosts» и «AntiWga». Первый открывает блокнотом для редактирования файл %WINDOWS%\system32\drivers\etc\hosts, очень глубоко закопанный в недрах системных папок. Второй активирует систему обхода проверки подлинности непосредственно для Internet Explorer, после чего можно свободно посещать сайты обновлений и скачивать интересующие вас файлы. Находится здесь.
7. С помощью подмены регистрационной информации.
Это не очень надежный способ. Смысл его в том, чтобы подсунуть модулю проверки фальшивую регистрационную информацию. Она находится здесь:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion] "DigitalProductId"=hex:a4,00,00,00,....
Именно здесь находится информации установки, ключ, и пр. информация, которую анализирует WGA. Если сюда записать информацию с подлинной системы, то и проверка пройдет успешно. Это как бы неполноценная замена ключа. С этой информацией много чего связано, и всё это не изменится, поэтому замена ключа будет неполной, и нет гарантии, что операционная система будет устойчиво работать длительное время. На каком то форуме я даже видел совет записать сюда регистрационную информацию Windows Server 2003! Например так:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion]
"ProductId"="69831-640-1780577-45389"
"DigitalProductId"=hex:a4,00,00,00,03,00,00,00,36,39,38,33,31,2d,36,34,30,2d,\
31,37,38,30,35,37,37,2d,34,35,33,38,39,00,5a,00,00,00,41,32,32,2d,30,30,30,\
30,31,00,00,00,00,00,00,00,00,0d,04,89,b2,15,1b,c4,ee,62,4f,e6,64,6f,01,00,\
00,00,00,00,27,ed,85,43,a2,20,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,31,34,35,30,34,00,00,00,00,00,00,00,ce,0e,\
00,00,12,42,15,a0,00,08,00,00,87,01,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,94,a2,b3,ac
Лучше родную информацию сохранить в отдельном файле. Перед обновлениями записать сюда подложную информацию, а после завершения обновлений обязательно восстановить исходную. И не забывайте про блокировку сервера mpa.one.microsoft.com
Office Genuine Advantage (OGA)
В принципе всё совершенно аналогично, только реализован этот ActiveX в OGACheckControl.dll, и проверяет подлинности продуктов серии Office. Так же шпионит, используется только на страницах OfficeUpdate, методы обхода аналогичны.
KB905474
Это Windows Genuine Advantage Notification. Об этом написано здесь.
Copyright © 2007 http://wgapatcher.ru/contact.php
Posted Date:
01 Jun 2006 |Updated:
01-Jun-2006 |Category: .NET Framework | |Member Level: Gold |Points: 10 |
This article explains a simple way to check if you and your client are running the genuine windows software from Microsoft.
Introduction
With Visual Studio 2005 and express editions, you have a component called Windows Genuine Advantage Validation Tool. Currently, this tool is used with downloading of any Microsoft tools and software from the internet.
Next time, you install your .NET application, you can check that you are deploying it in a system, where genuine windows software is installed.
The name of the assembly is LegitCheckControlLib.dll, and you can find it in the references dialog in Visual Studio. To use this tool, goto Add References —> Components tab —> Select the Windows Genuine Advantage Validation tool.
To accomplish this, you can add a few lines of code in your setup project or the actual project to be deployed.
LegitCheckControlLib.LegitCheckClass lcc = new LegitCheckControlLib.LegitCheckClass();
if (lcc.LegitCheck().Equals("0"))
MessageBox.Show("You are running Genuine Windows Software! Proceed further..");
else
{
MessageBox.Show("You are running Pirated Windows Software! Deployment process aborted.");
Application.Exit();
}Using this kind of check before deployment, would help you provide support and solutions to your clients better than as usual.
Conclusion
The above C# code should work in most of the Windows XP, 2003 systems. Try it in your system and get back to me, if you have any questions or suggestions.
Welcome to the DEFINITIONS category of our blog! In this series, we aim to demystify complex concepts related to technology and provide clear explanations for our readers. Today, we’ll be delving into the topic of Windows Genuine Advantage (WGA), a term that you might have come across while using Microsoft’s Windows operating system.
Key Takeaways:
- Windows Genuine Advantage (WGA) is a program developed by Microsoft to verify the authenticity of Windows operating systems.
- WGA helps protect users from counterfeit software and ensures they are using authorized copies of Windows.
Understanding Windows Genuine Advantage
Windows Genuine Advantage (WGA) is an anti-piracy system introduced by Microsoft to validate the authenticity of the Windows operating system. Its primary purpose is to combat the use of counterfeit software and protect users from the potential security risks associated with such practices.
So, how does WGA work? When you install or update Windows, the WGA program runs a validation process to confirm whether your copy of Windows is genuine or not. This process involves checking the product key used during installation, as well as any accompanying licenses. If the validation is successful, your operating system is considered genuine, and you gain access to Microsoft’s latest updates, security features, and support services.
If WGA detects any issues, such as an invalid or pirated product key, it will notify you of the problem and restrict access to certain features of Windows. This is done to encourage users to use authorized copies of the operating system that comply with Microsoft’s licensing terms.
While some users may find WGA restrictive, it plays a crucial role in maintaining a secure and authentic Windows environment. Removing or bypassing WGA can expose users to potential vulnerabilities and deprive them of essential updates, leaving their systems at risk.
It’s important to note that with the introduction of Windows 7, Microsoft replaced WGA with a new program called Windows Activation Technologies (WAT). WAT performs a similar validation process but includes additional anti-piracy measures to enhance security.
Key Takeaways:
- Windows Genuine Advantage (WGA) is a program developed by Microsoft to verify the authenticity of Windows operating systems.
- WGA helps protect users from counterfeit software and ensures they are using authorized copies of Windows.
Now that you have a better understanding of Windows Genuine Advantage (WGA), you can navigate through Microsoft’s licensing requirements confidently and ensure that you have a genuine and secure Windows operating system.
We hope this blog post has provided you with valuable insights. Stay tuned for more explanations and definitions in our DEFINITIONS series!
This article describes the most recent release of the Microsoft Windows Genuine Advantage (WGA) Notifications application for Windows XP. This program notifies you if a copy of Windows is not genuine.
The following file is available for download from the Microsoft Download Center:
Collapse this imageExpand this image
Download the Windows Genuine Advantage Notification (KB905474) package now.
(http://go.microsoft.com/fwlink/?linkid=78651)
Back to the top
Windows Genuine Advantage Notifications for Windows XP notifies you if a copy of Windows XP is not genuine. The notification messages only appear on computers that have failed the WGA validation process and that are running a copy of Windows XP that is not genuine. If you are running a validated, genuine copy of Windows XP, you will not receive notification messages.
Back to the top
How to install Windows Genuine Advantage Notifications
If you obtain the WGA Notifications for Windows XP application through Windows Update or through Microsoft Update, the application will be installed on your computer according to your Automatic Update settings. In some cases, installation will occur at your next logon. During installation, you will be able to review the license terms and you will have the option to decline the update. If you decline the update, the application will not be installed. Upon acceptance of the terms and installation of WGA Notifications, you will receive updates that are specific to the application automatically.
Following installation, the WGA Validation tool will run to verify that your copy of Windows is genuine. If your copy of Windows does not pass validation, you will receive notifications the next time you restart and log on to your computer. These notifications will inform you why your copy of Windows did not successfully complete the validation process, and give you with options for resolving the issue. If your copy of Windows is genuine, you will not receive any notifications.
If you download and install WGA Notifications for Windows XP from the Microsoft Download Center, an installation wizard will help you with the update process. This includes a review of the license terms and the option to decline the update. When you accept the terms and installation of WGA Notifications, you will receive updates specific to the application automatically.
Note After WGA Notifications for Windows XP is installed, it cannot be removed from the computer.
The Windows Genuine Advantage privacy statement explains what information is collected, how it is used, and how Microsoft helps protect your privacy. For more information about WGA and genuine Windows, visit the following Microsoft Web site:
Back to the top
Notification messages
If your copy of Windows does not pass genuine Windows validation, you will experience the following symptoms.
- Logon notifications
When you log on, you see the following message in the lower-right corner of the screen:You may be a victim of software counterfeiting.
This copy of Windows did not pass genuine Windows validation.In addition, you see the following message:
You may be a victim of software counterfeiting.
Click Resolve Now to get help with this problem.When you see this message, you have the following two options:
- You can click Resolve Now to obtain more information about the specific reasons for validation failure and to resolve the problem.
- If you choose not to click Resolve Now, you will be able to view and then click Resolve Later, after a short delay. If you choose this option, you will receive periodic reminders, after you log on, that your copy of Windows is not genuine. These notifications are described next. You will also see an icon in the notification area that you can right-click to view options for learning more about how to obtain a genuine version of Windows.
- Notification area
If your copy of Windows fails validation, you will receive notifications in the lower portion of your desktop that indicates your copy of Windows did not pass genuine validation. You can click the notification or click the WGA icon in the notification area to open the Windows Genuine Advantage Validation Failure Web page. This Web page gives you the specifics of the validation failure and the steps that you can take to make the operating system genuine. - Persistent Desktop notification
The persistent notification is an image that floats above the lower-right corner of the desktop. If your copy of Windows XP is not genuine, a persistent notification will appear below any active window to indicate that your copy of Windows did not pass genuine validation. You may interact with any icons that appear to be under the persistent notification. However, it cannot be hidden with objects on the desktop. - Desktop background change
If your copy of Windows fails validation, the desktop will also be set to a plain black background. You may reset the background to a wallpaper or to another background color, but the desktop will be reset to a plain black color every 60 minutes, until your copy of Windows passes validation.
Every time that a notification appears, you can choose to receive detailed information about the specific validation failure. The information includes the steps that you can take to resolve the problem.
Back to the top
Previous releases
The previous sections describe features for the most recent release of the WGA Notifications for Windows XP application. If you are running a previous release of WGA Notifications, you may not have all the features that are described in this article. However, you will receive detailed information about the specific reasons for validation failure time every time you receive a notification. In addition to receiving options when you log on, you will also receive periodic notifications while you are logged in. To view the options that are available or to learn more about how to obtain genuine Microsoft Windows software, you can click the notification or the icon in the notification area.
Back to the top
Attention Before you read this post, I highly recommend you check out my resources page for access to the tools and services I use to not only maintain my system but also fix all my computer errors, by clicking here!
The Windows Genuine Advantage Validation Tool is a system that was designed and created by Microsoft in order to implement online validation of their most recent operating systems. In one of the more recent operating systems, Windows 7, the Windows Genuine Advantage (WGA) Validation Tool is renamed to Activation Technologies. This tool (WGA) is made up of two components:
- The WGA Notification, which is a component that is installed onto the system. It attaches itself to the Winlogon so that it can validate the authenticity of the operating system every time you boot up.
- The second component is an ActiveX Control; this is used to validate the licence of the operating system when the user attempts to download a Windows Update.
The WGA Notification is able to validate Windows XP/Vista/7 & 8 operating systems only. The ActiveX Control on the other hand, is able to validate all of the above including Windows 2000.
The WGA, when installed on your computer, will advertise the latest service packs for your operating system, this is especially the case with Windows XP based system. WGA was originally a voluntary system, which was changed to mandatory in July 2005.
The Installation Process
Whether or not the Windows genuine advantage validation tool installs on your system, depends on your Windows Update settings. In most cases, the tool will be downloaded automatically, then install itself when you next restart the computer. During the installation process, you may or may not be able to review the licence terms and choose whether or not to decline the update. If you choose to decline the install, then the operating system will never ask you to install the update again. Once the license terms and installation process has been completed, you will be greeted with the occasional update, relevant to your version of Windows.
After the installation is complete, the tool will run its validation process in order to verify whether or not your copy of Windows is genuine. If your copy of Windows is found not to be genuine, then when you next restart the computer, you will be presented with various notifications. The notifications will inform you that your copy of Windows is not genuine and then present you with the appropriate option(s) to resolve it. However, if your operating system passes the validation process, then you won’t be greeted with any notification.
If you opt to download the Windows genuine advantage validation tool directly from the Microsoft Download Center, then you will be taken through the typical installation process to apply the update. This will include you having to review and agree to the licence terms of the update. However, once the tool has been installed onto your computer, there’s no install shield that you can run to uninstall it.
When WGA Validation Fails
On systems running Windows Vista without any install service packs, failure of WGA validation has a much harder felt impact then on other platforms. In addition to the notifications, that persistently show up, across the screen, and the disabling of non-critical updates, the Windows genuine advantage validation tool also disables Windows Defender, Windows Aero and Windows ReadyBoost. The user is then given a certain period of time to authenticate Windows Vista, after which the entire operating system will be disabled, restricting the user to using the system in a reduced functionality mode. However, this does not occur on Windows Vista systems that have Service Pack 1 running on them, instead, the user will simply be inundated with notifications.
On Windows XP Professional, Windows 7 Ultimate and Windows Vista Business, the user will initially be presented with a pop-up notification. However, once the user boots into the system, they’ll find that the wallpaper has been changed to black, and on the lower right hand side of the screen, there will be a notice, which cannot be removed. However, the user will still be able to interact with objects in and around the notices. Windows XP users will also be presented with a notification on the login screen. However, the user will be able to change the wallpaper to whatever he/she likes, but after an hour has lapsed, it will revert back to the black wallpaper.
Below, I’ve outlined a number of methods that you can use to remove the Windows genuine advantage validation tool, once it has been installed and is running on your computer.
This is a fairly complicated procedure that will require you to edit your registry, modify certain system files and restart your system a number of times. Though, if you’re adamant about removing this tool, this is the only sure-fire way of doing it. Anyway, to manually remove the Windows genuine advantage validation tool, simply do the following.
1. First, log into your computer with full administrative rights.
2. Then click on Start -> Run [Windows Vista/7: Press + R], type %Windir%\system32\ and click on OK.
3. This will take you to your System32 folder, from here, you’ll want to right click on WgaLogon.dll, and then click on Rename.
4. Then change WgaLogon.dll to WgaLogon.old.
5. You’ll always need to change the file extension of WgaTray.exe, however, in order to do this, you’ll need to download and install Change Type, which is a file extension editor program. To acquire this tool, I suggest you check out my post on changing file extensions.
Once you have the tool up and running on your system, simply right click on WgaTray.exe, and then click on Change Type.
6. This will bring up a small applet, from here, change the file extension from exe to old, and click on OK.
7. Once you’ve changed the file extension of these two files, restart your computer.
8. When you’re computer has finished rebooting. Click on Start -> Run, type cmd and click on OK. [Windows Vista/7: Start -> Type cmd (into the Search programs and files box) and Press CTRL + Shift + Enter, then click on Continue]
9. This will bring up Command Prompt, from here you’ll want to type Regsvr32 %Windir%\system32\LegitCheckControl.dll /u and then press Enter.
10. Once you’ve successfully unregistered the LegitCheckControl.dll file by using Regsvr32, restart your computer, once again.
11. When your computer finishes rebooting for the second time. Load up Command Prompt again, by clicking on Start -> Run, typing cmd and clicking on OK. [Windows Vista/7: Start -> Type cmd (into the Search programs and files box) and Press CTRL + Shift + Enter, then click on Continue]
12. On Command Prompt, you’ll need to type Del %Windir%\system32\wgalogon.old then press Enter.
13. Then type Del %Windir%\system32\WgaTray.old and press Enter.
14. Finally, type Del %Windir%\system32\LegitCheckControl.dll and press Enter, to delete the last and final WGA file.
15. Close the Command Prompt and click on Start -> Run [Windows Vista/7: Press + R], type regedit and click on OK.
WARNING: Delete or editing the wrong registry entry can cause irreparable damage to your operating system.
16. This will bring up the Registry Editor; from here you’ll want to navigate to the following path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\Notify\WgaLogon
17. Then right click on the WgaLogon sub key and select Delete.
18. Once you’ve successfully deleted the first sub key, navigate to the next path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WgaNotify
19. Then right click on the WgaNotify sub key and select Delete.
20. Once you’ve done, restart your computer and you’re finished.
Use System Restore
If you think manually removing the Windows genuine advantage validation tool is too complicated, then you may want to try System Restore. However, this method only works if you’ve only just recently installed the Windows Genuine Advantage notification. All one needs to do is use system restore to set the computer back to a restore point prior to the installation of the WGA update, then configure you’re computer so that you can pick and choose which updates you would like to install, that way you can refuse the installation of the WGA update.
Anyway, to utilise this method, you’ll first need to have some understanding of how to use System Restore to set your system back. Fortunately I’ve written a post on this feature, so I suggest you check it out here.
Once you’ve set your system back, you’ll want to change your Automatic Update Settings. This can be done by doing the following.
1. First, ensure you’ve logged into your computer with administrative rights.
2. Then click on Start -> Control Panel.
3. Once the Control Panel loads up, double click on Automatic Updates.
4. This will bring up Automatic Updates applet, from here click on Download updates for me, but let me choose when to install them. Then click on Apply and OK.
Are you looking for a way to repair all the errors on your computer?
If the answer is Yes, then I highly recommend you check out Advanced System Repair Pro.
Which is the leading registry cleaner program online that is able to cure your system from a number of different ailments such as Windows Installer Errors, Runtime Errors, Malicious Software, Spyware, System Freezing, Active Malware, Blue Screen of Death Errors, Rundll Errors, Slow Erratic Computer Performance, ActiveX Errors and much more. Click here to check it out NOW!