WGATray.exe - Genuine Windows Advantage (WGA)

WGA Install now works (thanks to your blog!)

Thank You for your wonderful blog site and all your efforts to inform and enlighten people on computer issues.
I have been struggling with many software problems due to running OneCare beta, IE 7 beta etc, even trying an early Vista beta.

These have created a host of problems for my laptop and since I am "away for home" in medical school, I have need help in fix things. MS beta support folks are apparently too overwhelmed to offer any real assistance. Yet, time and time again, I have found workable solutions on your blog (usually by Googling) and can't never find these via MS KB or support forum searchs. Most recently, your note on "WGA install work-arounds" was awesome and fixed a long-running problem for me.

While I chose the HKEY_CLASSES_ROOT\ LegitCheckControl.LegitCheck permissions path over the PiratBay.org WGA defeat path, the second one was very tempting since MS has become so obsessed with catching and punishing software pirates that it is willing to treat its paying customers like criminals.

Folks like you, along with Mark and Bryce at sysinternals.com, are really making a great difference in how, dare I say, millions of Windows users keep their systems functioning and productive. I myself, and Microsoft users in general, really owe you, Man!

Thanks Again,
Russ

Even better, as the WGA will probaly be reinstalled next update, just instal Zone Alarm and 'Kill' WGA in the allowed programs section.

Thus it is never ever allowed to run on your PC again!!!!

For those who dont want to install zonealarm go over to www.sysinternals.com and download autoruns. Run the program, go to the winlogon tab and uncheck the WgaLogon entry. No more boot screen or or tray icons. Simple!

This is all you have to do:

Start Windows Registry editor and delete the folder "WGALOGON" located in the following location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\WinlogonNotify

Removing this is easy. Too easy infact. Click on the start menu and select run and type this:
%windir%\system32\wgatray.exe /u

Click on the start menu again and select run and type: regedit
Navigate to the following key and delete the key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon
Reboot and enjoy

Or you may then safely delete the following files
Just click on the start menu and select run and type the following

cmd /c "del %windir%\system32\wgatray.exe"
then this one
cmd /c "del %windir%\system32\WGAlogon.dll"
and finally this one
cmd /c "rmdir /s /q %windir%\SoftwareDistribution\Download\6c4788c9549d437e76e1773a7639582a"

Um, I hate to state the obvious, but if you right click the WGA tray icon, and select "change notification settings", then select "Don't notify me again", and "Yes I know this voids me from product support", and then all notifications are gone - no workaround required!

Dudes, all you have to do is get from the internet one copy of that Windows Live on CD (XP version), burn it on a CD, boot from that cd, go to the Windows folder of your installation, delete all the files (dlls and those exe) mentioned here above in the in this blog, and also go to registry ediror from your Windows and delete all the entries mentioned above! And to be more shure, also replace your LegitCheck.dll file with the "patched" one. You can find that with google. Good luck!

Hi! Everybody!

I assumed that the windows xp update was harmless, Ha! Ha!

I renamed the wgalogon.dll to wgalogon.lld and the wgatray.exe to wgatray.xex, both of those in the windows system32 folder. Then I made a backup of data.dat (just in case) way down in the documents and settings, all users, application data, windows genuine advantage folder and edited the original file with notepad. I simply highlighted all of the data in there and hit the delete key and saved the file. WGA-BE-GONE! Woo hoo!

And for you who think that I'm evil. My original xp home disk and my upgrade to pro disk have been verified by the evil empire as genuine. I went round and round with microsquish in August of 2005 analyzing my system. They would not offer me a non dollar relinquishment to fix the problem. If you add that up, I'm already in for $300.00. No mas!

It was some moron at the store that I bought the computer from that cut the corners that resulted in my computer failing the wga test.

I hope that this may work for you should you have any problems with windows xp.

Btw I'm looking forward to Vista.

---tommy

I found away that works (so far!).. I just went into windows/sys32 and changed a couple letters in wgadll file and WGAtray.exe.. and I alos ran sysgate personal firewall... it is great anyway and I used the KILL option to keep WGA from messing with me... so far so good...

I'd just re-installed windows xp and don't update it, most of the time windoze updates do more bad than good, as long as you have good Anti-Virus/Spyware progs you'll be fine, I myself use Aone Alarm Pro, Ad-Aware SE, Spybot S&D and Spyware Doctor, I also have FireFox as my browser, i have hardly ever had any problems, why are you guys so persistant on updating your windoze?

Darn it, M$ is becoming a pain in the arse, heres a big workaround, why doesn't someone with a legit copy of windows server dowload all their patches and start their own windows update site.

If you already installed the new WGA update do a System Restore (WGA makes a restore point) at the point WGA was installed to remove it.

Then set your Auto-Updates (in Control Panel) to “Download updates for me, but let me choose when to install them”.

Eventually WinXP will check for updates and notify you with a yellow shield on Taskbar near your clock. Click the yellow shield to open the update and choose “Custom” (not express) for install.

Update will then ask you to accept the “Windows Genuine Advantage” update, choose Decline and then another box will popup and select “Never ask me again”

I you don't set your Auto-Updates to “Download updates for me, but let me choose when to install them”, does this mean that Windows Genuine Advantage may be installed automatically?
Because most of the time, you have to click on the windows update icon to icon to instll updates anyway.

Can someone please tell is Melhackers fix qenuine or just a piece of mailious code?

Melhacker, thank you so much for your patch. It worked very nicely on my comp and all is gone now! Keep up the good work.

Hi,Everyone!
This is an other idea to solve the problem of"Disable Non Geniue Windows Warning Massages: WGA"

1.Go to:WINDOWS/System 32/System Restore Application

2.Choose a date before you updated your Windows and start the restoring process.(Just following the instructions)Take couple of minutes and you are done!

That easy it is!
By the way, I tryed all version u guys posted in here, but non of them was work for me. Untill I figured out this one.(I did on Windows XP,but different systems could be work if they have this option.

(: AnimatedBread
Csilla:)

Hi again,
Now, I just read it some people already try it this option.Anyway, I posted earlier my correction, but I don't see yet so, I will repeat.
I forgot to write that, before I did the restoring process I deleted the C:WINDOWS\Prefetch folder.Which is the EWGATRY.EXE-OED38BED.pf.That is why, I do not think it will be come back!
GOOD LUCK!
You have smart ideas by the way, what I haven't try yet! Next time!
(:AnimatedBraed:)

The Melhacker patch is the hammer.
Download it, run it, and wga is gone...its not malicious code at all.
Thanks Mel

I have just used Melhacker's fix. On start up I have had a message about a file called wgatmp (can't remember the suffix)The message asked if I wanted to run it as it did not have signature. I opted for run. Is that the correct thing to do? If so I will tell it not to ask me in future.

This is what I did, Windows update installed the offending update and I hated it on site, I then did a system restore and found I had to restore two days back, OK I did that, I then waited for the windows update, then when it was finished, I right clicked on the yellow icon for the update and checked the box to not allow this particular update to install then checked the box do not notify me again for this update, simple, though I am unsure I will recieve updates in future doing this, but I didnt recieve any warning that I wouldn't recieve any.

>If you already installed the new WGA >update do a System Restore (WGA makes >a restore point) at the point WGA was >installed to remove it.

>Then set your Auto-Updates (in Control >Panel) to “Download updates for me, >but let me choose when to install >them”.

>Eventually WinXP will check for >updates and notify you with a yellow >shield on Taskbar near your clock. >Click the yellow shield to open the >update and choose “Custom” (not >express) for install.
>Update will then ask you to accept the >“Windows Genuine Advantage” update, >choose Decline and then another box >will popup and select “Never ask me >again”

All I can do is repeat the above advice for not getting the WGA tool again(or even the first time), as that is what I have found out from experience, and what I was going to say before I saw someone had got there first.

P.S. This is how to get sp2 if you want it, but don't have valid windows xp:
Go to microsoft auto update, turn 'em on, and sit back and relax. :)

All of these fixes work until you reboot. Then windows Prompts you that you have updates to install via Windows Automatic Updates. Then it simply reinstalls the WGA Software and updates, then your back to square one again.

This works for me to disable the logon screen bug, the systray remover is easy

1: Goto windows update site and download the full toolkit, the one from the automatic updates doesn't work correctly.

2: Install the full toolkit.

3: Single right click the icon bottom right in the systray and choose "Change Notification Settings"

4: In the IE window single left the + next to "notification options" and untick "display windows genuine..." then click "save settings".

5: Tick the "yes I understand" button and then click "Yes I am sure" and then click "close".

DONE! 8D Weeeeeeeeeeeee

Hi. I am trying to install Windows Media player 11 on a computer that is not genunine. It tells me that it is not genunine. How can i install it? Thanks
PS I have tryed the legitcheckcontrol file.

Just extract the files from wmp11-windowsxp-x86-enu.exe into a new folder then install wmp11.exe, wmfdist11.exe, wmdbexport.exe and umdf.exe then restart your pc.

I just used melhacker's link and now my computer won't boot at all ... Ntfs.sys is missing or corrupt so perhaps beware of this particular "fix".

Other idea, tested and it works :

1) Start Windows Registry editor and delete the folder "WGALOGON" located in the following location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\WinlogonNotify

2) Deactivate Microsoft Update

Boot on CD thin another Os (Windows or Linux on a CD)

Then rename wgatray.exe (vagtray.exe_zzz) on windows\system32, windows\dllcache.
renamee wgalogon.dll and LegitCheckControl.dll too.
Then reboot with Windows and enjoy.

After reinstalling XP SP1 I took "ALL" the updates and found the puke colored splot on my task bar warning me that my build won't be supported by $MS$ anymore....like it ever was. Just use HijackThis and ZoneAlarm to temporarly disable the "NEW" ad for Vista (WGA) and all the other nice free stuff $MS$ offers and if you need more nice upgrades just undo HijackThis and allow ZoneAlarm to show $MS$ you paid for your OS, then upgrade away...simple..no file removals...no nasty reminder from $MS$ that they "CONTROL" all.
It was funny, I went to Task Manager to unload WGATASK.EXE and when I did a reboot I was informed that my retail copy of Micro-Snoop XP Pro was a boot-leg copy. I paid cash for it so it must be s__t.

I have an actual legit copy of windows XP Pro. I have also downloaded windows Media center edition. are there files i can transfer from the legit hard drive to the non-legit hard drive that will trick Microsoft Update into thinking that my Media Center is legit...With my legit system, windows update must be reading a file that tells the site that my system is legit. Is there a file i can copy over or over write on my non-legit system, so that when ms-updates reads my system it also thinks this is a legit system too??? Thanks.

i dont have any wgatray file on my computer at all ?? and still cant download windows media player because i get the non geniune message??? please HELP!

rename the wga protocall check it with a regedit and follow up by changing the numeric value associated within the registry. After that non-genuine becomes genuine. Changing the binary 1-0 factory switches the system from being non-genuine to genuine.

I found the best fix of all...
Get a Mac.
With Bootcamp, you can run XP if you are really into self-abuse, or you can run OSX and relax.
Just trying to help ;)

Its funny. All I had to do was got to the system32 folder and rename wgalogon.dll. Nag completely gone and it doesn't renistall up OS load. WGAtray.exe proved impossible to end process as the first instruction says to do. AS it automatically reloads. On a whim I renamed the above DLL and had sucess. But I also wnt into safe mode after the fact anddeleted the wgatray.exe just to make sure I don't see it on my nexrt reboot. There wasn' one in the software distrubtion folder and there is no dllcache folder

I located Wgalogon.dll and renamed it to Wgalokgon.dll and everything was GONE. This really works!! If U want to get rid of the update sheild, then go to the MS home site and click the message that "don't notify me again" it is gone like the wind.

hey...how about paying £92 for a genuine key and CD...
no more problems after that

I have found another way to disable this WGA garbage, by changing the file permissions so the files used by WGA cannot be accessed at all, not even by Windows. Please note that the following only works if the partition on which Windows is installed is formatted NTFS:

1. Reboot in Safe Mode
2. Open the folder C:\WINDOWS\System32 (Replace "C:" with whatever drive letter if necessary)
3. Right-click on WgaTray.exe, and select "Properties"
4. Click the "Security" tab
5. In the "Permissions For" list at the bottom, put a checkmark next to "Full Control" under "Deny"
6. Select the next entry in the "Group or user names" list, and repeat step 5. Do this for every name under the Group/Names list
7. Click OK. You will be shown a warning saying how Deny overrides Allow. Click the Yes button.
8. Repeat steps 3-7 for the files "WgaLogon.dll" and "LegitCheckControl.dll"
9. Open the folder C:\WINDOWS\System32\dllcache
10. Repeat steps 3-7 for the files "WgaTray.exe" and "WgaLogon.dll"
11. Reboot the computer

Assuming the permissions were set correctly on all necessary files, you should now be enjoying WGA-free bliss.

System Restore worked for me. It's been six days now, and it has not returned. I restored the system to 10 days before.

Updates can be obtained with Autopatcher.

Also, if users download and install the beta 2 version of Vista using the key provided by e-mail when they register to download, it will validate. Updates for other operating systems can be downloaded and saved using Vista.

Well,
After I installed patches including wga on a genuine XP professional, my system failed to return from the sleep mode and only reboot could help. That happened every time pc was getting into powersave mode, not to mention that it became much slower to boot. Finally, I got a blue screen (for the first time) and after that I could not boot. Beleive it or not, this f****n wga crap changed the boot order of disks in the bios!
I removed it and system works like a charm again.

This is why i'll be purchasing a macbook with intel core duo come december, I'll use osX for surfing the web and install my bootleg XP to run my other bootleg programs... Be aware that i am in a third world country that the only means of knowledge is to persevere and find ways. $100++(xp price) is a month's worth salary here, and i'm lucky. some might get as less as $10 a month, So i will patronize bootleg programs until i get a chance to get out of this country... I'm just glad that macs nowadays are starting to reach out to the masses and offer reasonably priced computers.

Easy Fix

Use Hijack This: (Find it at http://www.majorgeeks.com/download3155.html)

1. press Scan and Save to log file
2. Check the Check-box for
O20-Winlogon Notify:Wgalogon-C:\WINDOWS\SYSTEM32\Wgalogon.dll
3. press FIX Checked
4. Restart
5. DONE

Hey everyone! Thanks for the help, disabled the bi*ch, shut off auto-updates, and am happily using my PC again. I was almost cotemplating the possibility of thinking about switching to Mac (shudders), just because of how Microsoft are behaving with this.

Great to see the real spirit of WWW alive and kicking, cheers all!

Umm all you have to do is load up hijackthis in safe mode and delete the key. All these other steps aren't even necessary.

No people...its not that difficult ;)
I found a way that made it sooo easy to remove this microsoft warning shit:D

1. Go to windows->system32
2. Delete wgatray.exe
3. download this file:

http://rapidshare.de/files/26244781/WGANotify.settings

Just choose free download and write the letters to start the download...

Save te WGANotify.settings file to:
c:\windows\Temp

4. Restart your computer and the ugly banner is gone :D ;D

Okay. Not only can I not get the notification off my screen, but now I am receiving messages upon starting my comp that I am in danger of imminent hard disk drive failure. I tried changing the settings on the tray for the notificaiton. It didn't work. I tried changing permission on the legitcheck and legitcheck1. It didn;t work, and it was right after doing this that I rebotted and the hard drive failure message began coming up. (Black screen. Press F1 to continue) I tried the microsof settings thing. I turned off my automatic updates. I can not restore system settings, nor can I reload the xp cd. I can't afford to wipe my system. What really sucks is that this copy is genuine. It came with my laptop that I bought for too much $ from best buy. My luck! Anyway, any ideas would be appreciated, and just to let you know that I only know enough about computers to mess them up usually. So kiss--(simple). K

I just used the system restore wizard to restore my computers settings to the day before i installed the update. Not sure if i can still get updates (don't really care either) but at least it removes the annoying warnings.

hey there, i struggled to find the wgatray files on my computer, but used the autoruns program suggested above to sort out this problem. It has worked brilliantly so thankyou. It was becoming a nightmare as often my PC would not shut down properly and would just leave the windows non genuine bubble up. All sorted now. cheers.

When you stopped the WgaTray.exe and delete the file immidiatly in 1 second, then the only problem is de WgaLogon.dll because it is in use. Simply start the explorer. Select c:\windows\system32\WgaLogon.dll and choose the option REPLACE FILE.
Replace the file to another folder and reboot your system.
After the reboot delete the file WgaLogon.dll

Mouse

Hi people,
I just found out that if you rename the wgalogon.dll to wgalogoff.dll and the wgatray.exe file to wgatray.qdf, you are able to delete them with the explorer. After that you can use taskmanager to shut down the wgatray.exe and it won't come back. After a reboot all my troubles were gone. Hope this works for you too!

Its very simple.

What you will need?
1> A blank floppy
2> Floppy Drive

How to remove.
First Stage

1.Start you Windows normally.
2.Go to My computer
3.Insert blank Floppy Disk
4.Right click on Floppy Drive and Click on 'Create MS DOS Start up Disk'.
5.Click on Start then click on OK(1st Stage finished)
6.Click on Start-> Search
7. Type in 'wga' and wait till the search is finished
8. Now select and delete all the files.
9.Note down the name and path of those files which are not deleted (write on paper).

Second Stage

10.Now Rebbot the computer,
11.Let the floppy disk be in the drive
12.Your computer will automatically start in MS-DOS mode. (If it doesn't then you may need to change your boot prioprities settings from BIOS this link [] will explain on how to do this.
13.Now go to path where the previously un-deleted files are left. (By typing 'C:' to switch to any drive, and 'cd folder' followed by the name of the folder.
14.'del filename' followed by the name of the file, will allow you delete any file.
15. Now delete wgatray.exe, and wgalogon.dll files.

Now restart the computer and its done.

I dont have any wgatray file on my PC at all ?? and already replaced data.dat still cant download updates getting "Unable to validate this copy of Windows
The validation process could not be completed because the validation control is unable to read the product key stored on this computer. We are unable to verify whether this copy of Windows is genuine."
please HELP

why dont you all just go macintosh and then you wouldn't have to worry about all this macro$hafting. ive never heard of mr. mac invading your privacy or complaining about how you didn't pay $$$ for him. and who cares about compatibility? btw, i thouroughly enjoy not being able to run any programs with ease

Help i'm trying 2 install window media player and it wont work.It keeps saying my computer is not a genuine or somthing and i also got rid of all the wgatray i think.Some help me or email me at im_azn@msn.com

I just happened to bump upon this wonderful blog which really proves to be rather useful.

i have an additional method: it's even more idiot-proof

Simply go to your search button and search for "wgatray.exe". You should get 2 files being located somewhere in Windows folder. When you try to delete them, by the old classical method of just hitting the "delete" key, they would give an error that it is in use. When u *ctrl+alt+delete* and stop the "wgatray.exe" process, it "smartly" re-establishes its process.


Solution? simple, gotta be a little quick that's all.
keep both the searched files window and the task manager open. Stop the "wgatray.exe" process, and instantly *alt-tab* to the search files window. And quickly hit the delete key. Then, POOF all gone :D

stupid method. Microsoft was thinking of preventing ppl to delete it's process, but i guess they forgot the basics...

The absolute for sure way to remove this little bast ard so it cant return is - uninstall Windows XP and install Linux Ubuntu 6.06 Microsoft wouldnt try to send WGA to a Linux machine would they hahaha

I agree with Mr KISS - My solution was even easier just Rename C:\windows\system32\winlogon.dll to winlogoff.dll

problem solved for me and all my friends

Thanks aaaaaaa loooootttttttttttttttttttt

I have found that the procedures mentioned above as: "Start Windows Registry editor and delete the folder "WGALOGON" located in the following location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\WinlogonNotify" is the best for my case. Appreciation is due to Posted 5/5/06 1:19 AM by Anonymous

Thanks! I've just tried the solution below, it works 100%!!!

End the process wgatray.exe in Windows TaskManager and restart Windows XP in safe mode. Now delete the following files:

Delete WgaTray.exe from c:\windowss\ystem32
Delete WgaTray.exe from c:\windows\system32\dllcache



Start Windows Registry editor and delete the folder "WGALOGON" located in the following location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\WinlogonNotify. Delete all references in your registry to WgaTray.exe

Hi, I'm jagdeep using Microsoft windows xp media center edition but i can't install the new softwares like windows media player 11 & internet explorer 7. it gives the error of windows validation. can you please help me out in resolving this issue?

Please reply me at my E-mail address : jagdipkundan@gmail.com ; jagdip_kundan@yahoo.com