Disable and Remove Windows Genuine Advantage Notifications Nag Screen
The “Windows Genuine Advantage Notification” (KB905474) cannot be uninstalled by Add/Remove Program in Control Panel by default, contrary to the claim in the knowledge base article. To enable the removal of KB905474 WGA Notification tool, follow the below steps:
Note: It seems like it’s not possible to uninstall WGA Notifications from Add/Remove Program. Cobolhacker has details on why KB905474 cannot be uninstalled. Suggested steps to “uninstall” are search and delete all WgaTray.exe and WgaLogon.dll files in your boot drive (if you using search, check the “Search system folders”, “Search hidden files and folders” and “Search subfolders” checkboxes), delete all the register keys in the following tree: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon, and to remove the entry from Add/Remove Programs list, delete the registry key in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ CurrentVersion\Uninstall\WgaNotify. With uninstallation, WGA Notifications will try to install again next time.
- Click on Start.
- Click on Run.
- Type in regedit in the Run text box.
- Click OK or press Enter.
- In Registry Editor, browse the the following registry key branch:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\WgaNotify - On the right panel, modify the value of NoRemove (by right clicking on the key and choose Modify) to 0.
- Exit the Registry Editor.
- Re-launch the Add/Remove Program, and Windows Genuine Advantage Notifications (KB905474) is now removable.
Prevention is always better than cure. So the best to avoid the the KB905474 Windows Genuine Advantage Notification application to be automatically downloaded and applied by Automatic Updates is to disable Automatic Updates. Go to Automatic Updates in Control Panel and disable it by selecting Turn off Automatic Updates, or if you still want to receive the critical patches from Microsoft, select Download updates for me, but let me choose when to install them or Notify me but don’t automatically download or install them. Remember to uncheck (deselect) Windows Genuine Advantage Notification (KB905474) when prompted to install any updates.
If you have already install the WGA update, you can use the hacked/cracked version of LegitCheckControl.dll (newer version suggestion by tyler) to remove the annoying nagging message. (For old version) But Windows Update will still ask you to install it since it’s a newer version which is 1.5.526, unless there is newer version of cracked LegitCheckControl.dll available. You may however try to “up” the version of hacked LegitCheckControl.dll yourself by using the following method:
- Get the patched/hacked “LegitCheckControl.dll” from the internet (e.g from link above or any file sharing service)
- Install Resource Hacker if you still don’t.
- Open both (original in Windows/System32 and hacked version) “LegitCheckControl.dll” files with Resource Hacker.
Go to “Version Info”, replace the version info of the patched File with the version information from new original LegitCheckControl.dll.1 VERSIONINFO
FILEVERSION 1,5,526,0
PRODUCTVERSION 1,5,526,0
FILEOS 0×4
FILETYPE 0×1
{
BLOCK “StringFileInfo”
{
BLOCK “040904B0″
{
VALUE “CompanyName”, “Microsoft Corp.”
VALUE “FileDescription”, “Windows Genuine Advantage Validation”
VALUE “InternalName”, “LegitCheckControl”
VALUE “LegalCopyright”, “Copyright © 1995-2004 Microsoft Corp.”
VALUE “LegalTrademarks”, “Microsoft® is a registered trademark of Microsoft Corporation.”
VALUE “OriginalFilename”, “LegitCheckControl.dll”
VALUE “ProductName”, “Microsoft® CoReXT”
VALUE “FileVersion”, “1.5.0526.0?
VALUE “ProductVersion”, “1.5.0526.0″
VALUE “PrivateBuild”, “Built by gacald on WGA-FILE-SVR.”
}
}BLOCK “VarFileInfo”
{
VALUE “Translation”, 0×0409 0×04B0
}
} - Save File.
- Put the modified version of hacked LegitCheckControl.dll in Windows/System32 folder, replacing the original from Microsoft.
Beside, WGA Notifications tool is also reported to be able to be bypassed by emptying (deleting the contents of) the data.dat in C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage\data as detailed here.
If you disable Automatic Updates, you can always download any updates from Windows Update or Microsoft Update using the hacks and tips from here and here. If you are prompted to mandatory must install KB905474, the above tricks should disable the checking of existence of KB905474 notification application. Again, remember to deselect the Windows Genuine Advantage Notification (KB905474) which will listed in High Priority section and selected for you by default.
Note: Visit the a more tidy article on how to bypass and disable the WGA with various tricks and hacks or a host redirect method to make Windows genuine permanently.
Share and contribute or get technical support and help at My Digital Life Forums.
Related Articles
- Crack and Patch to Bypass and Disable WGA Genuine Windows Validation and Notifications version 1.5.554.0
- Crack for Windows Genuine Advantage Notifications (KB905474) 1.7.17.0
- Bypass and Disable Genuine Windows Validation Check
- Cracked LegitCheckControl.dll 1.7.59.0 for WGA Validation by ETH0
- Windows Genuine Advantage (WGA) Validation v1.7.69.1 Update
- Download Microsoft Software from Download Center Bypass and Without Genuine Windows Validation
- Windows Genuine Advantage Crack for WGA 1.5.722.0
- Windows Genuine Advantage Crack 1.7.18.5
- Windows Genuine Advantage Validation 1.5.723.1 Crack
- Firewall Leak Tester RemoveWGA Stop Microsoft WGA Notifications Callbacks & Phones Home
April 26th, 2006 13:46
Hi,
The reg fix worked and showed the Remove button, but when you click the button, it will ask for the uninstall file or such like. I got this window -
http://img145.imageshack.us/img145/7620/14hv.png
April 26th, 2006 15:18
Hi PSnet, you’re right. Seems like it’s not possible to uninstall the WGAnotify yet. But the dll hack should works.
April 26th, 2006 19:22
i downloaded the patched version of LegitCheckControl.dll and also Reshack. The instructions above say to copy the version info of the microsoft original LegitCheckControl.dll (because it has newer version info) and to paste that into the version info of the hacked one. You then replace the original dll with the hacked one (now with newer version info), correct?
unfortunately i think i had already DELETED the original LegitCheckControl.dll because i tried another method for removing the Genuine Windows Notifications, which predictably failed miserably.
therefore with only the one hacked dll, there is not much use of it, correct?
i also tried copy and pasting the version info text u have in step 4 but when i save the dll, it says theres some error in line 5 of the version info or something like that. is the version info text in step 4 even supposed to be used?
help asap please, thanks.
April 26th, 2006 20:02
Admin,
Ok. I hope the fix will be there soon!
I’m still not using the .dll way, because I don’t know if that’s really safe? Is it safe?
April 26th, 2006 23:02
Kori, try the version information above. Let us know your result.
PSnet. I use data.dat hack, so far still working.
April 26th, 2006 23:57
What’s the data.dat hack?
April 27th, 2006 01:35
There’s a new LegitCheckControl.dll in Windows.Genuine.Advantage.Validation.v1.5.526.0.CRACKED-ETH0
April 27th, 2006 01:44
PSNet, I wrote about it before here. Notice that some users successfully get rid of the notification nag screen with the modified data.dat.
April 27th, 2006 02:36
I can confirm the release I mentioned in my first comment does indeed prevent the nag screen from popping up.
Windows Update and everything still works. And Windows Update doesn’t re-install a “proper” LegitCheckControl.dll if it finds a hacked one.
That release can be gotten here:
http://www.9down.com/downloads.php?fileid=319
April 27th, 2006 02:58
Hi,
I changed the values in the registry, but i even can’t see the KB905474 program in the Add/Remove screen, is there something i missed?
April 27th, 2006 03:03
Koby, I believe you need to check the “Show updates” option on the “Add/Remove Programs” screen.
April 27th, 2006 03:45
Hi,
I tried all solutions here (which are great) and got rid of most but when I start up windows, it still tells me that I’m not genuine.
When I want to uninstall KB905474, it cannot find the uninstall program (I can’t find it either it should be in c:\windows no?) and in regedit the uninstall string is empty - any ideas?
April 27th, 2006 06:54
Hi,
Got to the uninstall bit in add/remove programmes & it said it required a location as someone posted above…
http://img145.imageshack.us/img145/7620/14hv.png
I clicked cancel then another box appearted which i clicked yes to & now I cant see or retrieve windows validation in add/remove programmes.
Any help appreciated.
April 27th, 2006 06:57
also what do i need to open that hacked/cracked version of LegitCheckControl.dll? comes as a RAR file?
April 27th, 2006 07:18
This requires some patience and reboot often I found helped me get it going.
It does however work nicely. Appreciated
April 27th, 2006 08:01
kon and donkjaer, it’s unable to the uninstall.
Kon, use winrar to open RAR file.
April 27th, 2006 09:29
Just copied the .dll into system32 but still get message when I reboot. Is there anythin else I need to do?
April 27th, 2006 10:49
Admin,
Will that data.dat hack remove the nag screens, notifications and other things MS had put?
April 27th, 2006 10:58
admin, as in my previous post (post #3), i have once again tried copy and pasting the info version you provide in step 4. i did this by opening the LegitCheckControl.dll with Reshack and saved the file after pasting the info version but when i close and reopen to check it, it has not saved the new info version. when i navigate in that dll with reshack i find something about an error on line 5 again.
this was done AFTER downloading TYLER’s dll, which didnt work either. (yes i found the hacked dll in the rar folder, extracted and put it in sys32).
the data.dat procedure also didnt work for me. the new data.dat which i created and then applied READ-ONLY and HIDDEN attributes, does not work. (this is done under the docs and settings/allusers/applicationdata/windowsgenuineadvantage folder.
i managed to stop the pop up whihc appears on the system tray a while ago but i still get the prompt when i start windows.
a final word, TYLER and ADMIN, …could it be your procedures didnt work for me because i deleted the original windows dll from sys32 even before replacing it with a hacked dll??
i think im going insane here.
April 27th, 2006 12:59
Maybe the thing to do is reinstall WGA to get the original dll lol. I’m in the same exact boat. Nagged but can access M$ d/l’s.
April 27th, 2006 14:44
re install it?? sounds risky, wat if this newer one is of a very updated version, and then no one can release a higher version of hacked dll? or would you simply copy the version info from the original and paste it into the hacked dll to increase its update??
but at the moment im really struggling to copy and paste and then actually saving it. refer to my previous posts about the saving problem.
April 28th, 2006 02:17
I’ve found that disabling and renaming the files “WgaLogon.dll” and “WgaTray.exe” in C:\WINDOWS\system32 by using the program Unlocker seems to get rid of all the nags/popups.
April 28th, 2006 04:23
You got it Jules. I looked at the install log and found those two files as well.I deleted them both and nag is gone. Good to go for the time being.
April 28th, 2006 05:09
Hey friends!
The easiest way to get rid of the damn notification is to perform a System Restore to an earlier date.
After completing the Restore, delete any files in the C:\WINDOWS\SoftwareDistribution\Download folder because the WBA files still exist there which may cause further problems in the future. Bye
April 28th, 2006 07:00
After installing XP one of the first things I do is turn off system restore. Usually never need it and a huge resource hog. Here’s a good example why to use it. lol So for those like me who have it off…
April 28th, 2006 13:01
Hey Admin, and to all other people reading this…
Good news, looks like I’ve solved the problem.
First - Make a new System Restore point in case you did something wrong.
Second - Now let’s download the tools needed. Download AutoRuns from here -
http://www.sysinternals.com/Files/Autoruns.zip
Extract and double-click on the file. Next click on the Winlogon tab, uncheck “WgaLogon”. Then restart your computer. On next boot, those nag messages will be GONE!
—-
You can stop there, because that will make the files not run, but if you want to delete the files, do this -
Find and delete these files (note: delete these when you already disabled WgaLogon using AutoRuns, because if not, it will crash your system and force you to reboot)
system32/LegitCheckControl.dll (an update for the original WGA Tool)
system32/WgaLogon.dll
system32/WgaTray.exe
system32/dllcache/WgaLogon.dll
system32/dllcache/WgaTray.exe
After deleting those files, you are now free of that damn thing. Note again, Windows will display an update of “LegitCheckControl.dll” because we also deleted it, so if you go to the update site, don’t install the “KB905474″ update because that’s the one responsible of this mess.
April 28th, 2006 13:10
Thanks for sharing. Have updated the post with all the resolutions known so far.
April 28th, 2006 19:08
Thanks PSnet. The Autoruns method works fine.
April 28th, 2006 19:47
Thanks for updating this Admin!
Hey, about the solution of renaming the files with Unlocker, tried it but it crashed my system. It is because it is hooked with Winlogon, so we need to use AutoRun first before deleting the files.
April 29th, 2006 05:32
A combination of the third method and sixth method worked like a charm. I did both, then the whole data.dat thing mentioned above, restarted, tried to download windows defender as a test and it worked. Wonderful, thank you all for helping us out with this, its greatly appreciated, I have to bookmark this page, some very useful information right here.
April 29th, 2006 13:36
HALLELUJAH!! i had initially managed to prevent wgalogon to appear in system tray and not bother me while i wa logged on, but still had the notification at the log on screen.
today, i noticed this page has been edited, and needless to say…its brilliant. i used method one and it worked! three cheers for mr.admin!!
thanks also to all users who contributed to this thread, all for one and one for all!
if you didnt notice, i is now a very happy man…i mean RELIEVED.
April 30th, 2006 10:58
There is another very effective method that you have forgotten. Get a genuine copy of Win XP
Happy Computing, guys!!!
May 4th, 2006 02:41
(Update) WGA Notification Patch -
(Part 1)
Double click My Computer -
Click Tools (at the top)
Click Folder Options
Click Tab View
Check Box Display the full path in the title bar
Check Box Show hidden files and folders
Uncheck box hide Extensions for known files types
Uncheck box hide protected operation system files - Press ok
Click Apply - Click Ok
(Part 2)
double click C: Local Drive
click Documents and settings
click All Users
click Application Data
click Windows Genuine Advantage
click data
(your Adress bar should look like this)
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage\data
Click on Data.dat once so its highlighted, Now Right click on data.dat and select Open With.
-> Select the program from list
Click on Notepad, Click Okay
Find Edit then Select All
Press Delete on keyboard
Click File, click Save
Now click ( X )
Click Once on data.dat (Right click, select propertys, Check box Read Only - Click Ok )
(Part 3)
Uparrow - 6 times back to C:\ in the File Explorer
File Windows folder - Double click
scroll down to SoftwareDistribution
double click softwareDistribution
double click Download
now find this file folder name 6c4788c9549d437e1773a7639582a
click on file folder ONCE, then press Delete on Keyboard - Press Okay
(Part 4)
Click My Network Places
Find LegitCheckControl.dll
Copy - and Paste into
C:\Windows\System32\
Paste into system32 folder.
click ( X ) .. ShutDown Computer -= Do Not ReBoot =-
Power System back up after complete shutdown.
Once back up.. Must ShutDown computer Second time..
Nag screen should be gone.
May 6th, 2006 20:06
Tried the third method, worked a treat. Thanks a lot guys, my cpu was fucked enough as it is!
May 7th, 2006 00:00
Thanx to ALL. God Bless You All. Please Keep Microsoft busy. And continue helping the unfortunate…the poor!
May 7th, 2006 02:39
Can someone recommend which method above (simplest one)or something different to get rid of the download balloon I have? I didn’t get my Automatic Updates setting changed before it downloaded the WGA, but I Did Not install it. Just want to get rid of the balloon before I accidently install it.
Also how do I make sure I don’t download again?
May 7th, 2006 03:13
Hi all,
Without doubt the easiest method to stop the Windows Genuine Advantage from annoying the hell out of you after it’s been installed is the autoruns method mentioned above. This is THE one to go for - dead simple.
Steve
Thanks for whoever posted the original
May 7th, 2006 04:29
I mistakenly installed WGA via automatic update and used 2nd method to restore to an earlier date. Then used control panel>security center to turnoff automatic updates and disable the annoying “automatic update is off, windows at risk” ballon in the resources>change the way security alerts me>alerts setting.
May 7th, 2006 11:48
Program : Windows Genuine Advantage Notifications Remover
Version : 1.1.0.5 (Build 5)
Download :
http://rapidshare.de/files/19816559/WGANotify_Remover_v1.1.0.5.exe.html
Regards,
Dhilip
May 7th, 2006 12:36
Hi all:
first of all, thanks for all ur replies, its very useful! Much appreciated!
Just wanna add one, the third method is the best of all (its also the one of the easiest way), in fact, its the only one that will allow your pc to pass the microsoft genuine test to download future updates like Windows Defender or IE 7, the rest methods are more like to prevent the notification (good also), the third method is more like a cure which not only prevent the notification but also let you download the future update from microsoft website.
May 7th, 2006 13:46
Just buy a original Window XP … this is the best solution … dont try to be a pirate …
if you make a software and research at all your time, then another person just copy it and sell, are you happy?
May 7th, 2006 14:00
hey guys,
i tried deleting the data.dat file but it’s not working. the balloon’s still here! :S eeek!! i’ll try another step. that sux
May 7th, 2006 15:51
Hi Dhilip,
Thanks VERY much for the link to the Windows Genuine Advantage Notifications Remover. How did you find out about it and do you think it’s safe to use
and lastly will it be updated to cope with newer WGA Notifications?
Thankful soul.
May 7th, 2006 16:11
Hi soul,
That program is written by me.
Regards,
Dhilip
May 7th, 2006 21:35
Hi again Dhilip,
Brilliant programme and thanks a million. It makes the removal process simplicity itself.. If I gave you my email thecoachinghouse@hotmail.co.uk could I stay in touch with you for future patches maybe like the WGA Notification Remover?
Regards Thankful Soul (Steve)
May 8th, 2006 00:00
I tried Method 1, it worked, so I haven’t tried anything else.
Keep up the good work!
May 9th, 2006 17:54
Hi,
I got rid of my nag-message by doing the following:
1. Go to \windows\system32 in explorer
2. Rename WgaLogon.dll to WgaLogon.dll.bak
3. Create a new empty WgaLogon.dll in notepad and save to the same location
4. Right click on the task bar, and open Task Manager at the Processes tab
5. (Quickly) delete WgaTray.exe, then it will give you approx 5 seconds to click on WgaTray.exe in Task Manager and click End Task, and confirm
6. Restart your computer and the login and nag messages should be gone
May 9th, 2006 21:37
#comment-1324
May 10th, 2006 07:12
[...] Also: Remove WGA [...]
May 10th, 2006 07:44
This is so easy to fix! I fixed it in about 2 minutes after knowing what files to delete and rename while in safe mode.
May 10th, 2006 14:16
I’ve tried a couple of these methods, and all of them have worked. HOWEVER, with all of them I have still ended up with a download balloon (from Windows Automatic Updates) that wants me to install the “Windows Genuine Advantage Notification” update. Obviously I won’t download it, but is there a way to get rid of this annoyance without completely turning off automatic updates?
May 11th, 2006 03:11
I was able to resolve the problem with a combination of methods 3 and 4. I used the patch from 3 to get rid of the balloon popups and the tray icon. Then I used method 4 to unlock and delete the wgatray.exe and wgalogon.dll from the System32 folder. Rebooted and no logon nag screen or desktop pop-up balloons.
Thanks everyone for the great tips!!!
May 11th, 2006 18:58
http://www.mydigitallife.info/2006/04/26/disable-and-remove-windows-genuine-advantage-notifications-nag-screen/#comment-1324
>480 downloads and no feedback….lol
Ragards,
Dhilip
May 12th, 2006 15:01
The ultimate solution to the WGA notification:
Download a free copy of Linux and install it right over top of the Windows OS.
Time to get off that crack folks!
May 12th, 2006 17:34
I have provide a little tools for anyone who want to remove WGA that could be annoying for some user. Trust it, there is no harmful code. Feel free to distribute this tools.
File content:
- wgaremover.exe
- readme.txt
Download from any of the link:
——————————
http://users.cjb.net/melhacker/wgaremover.zip.zip
http://www.rapidsharing.com/043d4e78f5439e89dac500a1ab039afe
http://media3.uploadjar.com/file.php?file=uploads/wgaremover.zip.zip
http://ez-files.net/download.php?file=a347697ce9b22f2b9b4a665fc0c5f7c9
http://www.filehosting.cc/download.php?id=BE2C99C6
Regard,
Melhacker
May 12th, 2006 22:58
There’s no iffiness with regard to “may be a victim of piracy” for those in the know and who look at how they sew up their boogie boards.
Though the suggestion of #54 is always something good to hear.
May 13th, 2006 01:50
I used the hacked DLL, Then choose custom updates, unslected WPA 5474 Installed the other 24 updates… everything sweet!
May 13th, 2006 02:18
Thirteenth Method:
Actually go out and buy the software instead of stealing it.
May 13th, 2006 09:44
How about you just don’t install the fucking thing in the first place? You do know that Windows Update will continue to serve you updates even if you don’t install the fucking KB905474 WGAN package, don’t you? Just use the good-old javascript to bypass WGA.
javascript:void(window.g_sDisableWGACheck=’all’)
And you’re golden.
May 13th, 2006 23:36
To all the people telling us to “use the 13th method” and buy the software, please STFU.
Thank you
May 14th, 2006 13:00
[...] crack wga [...]
May 14th, 2006 13:08
#51
Yes. Open the the balloon. Click custom install. This will show the update with a check mark beside it. Uncheck the box beside the update. This will show an option that says something like “Never install this update”. Check that and click ok. The balloon and update goes away.
May 15th, 2006 04:10
I’m using Spybot - Search & Destroy to disable the WGA.
And when I checked windows update site I didn’t see any WGA installation offers.
Open S & D (Advanced Mode)
and go Tools -> System Startup
then uncheck the “System.ini; WgaLogon; WgaLogon.dll” (I unchecked only this one).
Restart windoza
And all Notifications are gone
May 15th, 2006 08:43
cyExy,
By FAR the easiest ‘fix’. I just talked a friend through it over the phone and it worked like a charm. (The line started winlogon on his PC, but it still ended with WgaLogon.dll.
I tried it on my own PC (Which is legal.) and when checking for Windows Updates, I was asked to install it again. I Hide the Update, never to be bothered again…..until MS comes up with another check.
May 15th, 2006 22:35
Dhilip,
Great remover! I have a few questions. Do you have a website with additional tools? How will we be able to get a new version, if you have to make one? Can I see the source code? If not, what process is the executable taking to remove WGAN?
http://www.mydigitallife.info/2006/04/26/disable-and-remove-windows-genuine-advantage-notifications-nag-screen/#comment-1324
May 16th, 2006 02:28
All gone. Great stuff. But they’ve got wise to a few things..ending wgatray via task manager just spawns another copy, switching values of norepair etc seems to work (method twelve)
Also, now when I try to get updates the first thing it does is try to install wga checker! Will it still get updates or does it have to have this beastie to work, now?
May 16th, 2006 04:39
Found this on another site. Cannot verify
Download and install WGA after clicking “Express” or “Custom”. Then click Start, Run, then type the following (without speech marks): “regsvr32 /u LegitCheckControl.dll”. Then go to Windows Update and it will ask you to install WGA again. Then click Start, Run, then type (again without speech marks): “regsvr32 LegitCheckControl.dll”. Click “Back” on the browser, and then “Custom” or “Express” - the updates should now be shown.
May 16th, 2006 08:33
[...] Disable and Remove Windows Genuine Advantage Notifications Nag Screen Here are 12 method’s to removing the nag screens that have recently been appearing for many people using windows. Since Microsoft is a bunch of retards it appears for people who do not have a “legal” serial code even though many people probably have already bought Windows XP before from OEM companies but would rather bypass their crap because they lost their valid code or plain just don’t want to put up with the crap that microsoft forces it’s customers to go through like calling the company everytime you upgrade your hardware. Microsoft has released WGA Notifications application which effectively turned Microsoft Windows operating system into a ‘nagware’, with a ‘This copy of Windows is not genuine’ warning. What the Windows Genuine Advantage Notifications application does what it will check your Microsoft Windows XP validity. If it found that the copy of Windows XP is not validated, not genuine, counterfeit, unlicensed, pirated, illegal, unauthorised or simply failed the Windows Genuine Advantage validation process, then the notification messages will appear at various places and time. [...]
May 16th, 2006 08:34
[...] Disable and Remove Windows Genuine Advantage Notifications Nag Screen [...]
May 16th, 2006 09:56
Remove and Disable Windows Genuine Notification…
There are several methods available in the Internet to disable and remove Windows Genuine notifications
……
May 16th, 2006 20:54
Better use this cracked WGA files and you will still eble to use WindowsUpdate. eMule link:
ed2k://|file|WGA%20Crack%201.5.512.0%20LegitCheckControl.dll
%20wgalogon.dll%20WgaTray.exe%20by%20daro.zip|355244|
68C30021651242B19C2AB41DB56717A7|
h=DCJRGOJRGPUPFDTAYNQX3IHH3IGXKOUL|/
Note: Above link should be in one line.
Overwrite the original file with that cracked one and
Windows Genuine Advantage Notifications and check and procedure will gone!
Copy it here:
system32/LegitCheckControl.dll
system32/WgaLogon.dll
system32/WgaTray.exe
system32/dllcache/LegitCheckControl.dll
system32/dllcache/WgaLogon.dll
system32/dllcache/WgaTray.exe
do it in safe-mode or better in linux-knoppix
May 16th, 2006 21:11
I still like Dhilip’s removal tool. Just double-click the .EXE, click “Remove”, and restart.
Simple! Easy!
Dhilip’s Post: http://tinyurl.com/erh75
Rapidshare Link: http://tinyurl.com/jj3po
=)
May 17th, 2006 12:02
Was easy for me. I did a two step method.
First Download and replace LegitCheckControl.dll with the hacked version.
Second Open folder
Documents and Settings\All Users\Application Data\Windows Genuine Advantage\data
Open data.dat clear out the contents and save empty file.Change file properties to read only and hidden.
Reboot
Balloons and warnings gone. Windows Updates work 100% Never asks to reinstall WGA…
May 17th, 2006 12:09
Thanks a million!
I got it right using the first try itself!
Also, pls tell me if I can visit the microsoft update/Windows update now after removing the nags and replacing the legitcheckcontroll.dll?
Also, I downloaded the windows defender, but not able to install earlier because it said my windows was not genuine. Can I install it now?
Thanks again!!!!!
All the best!!!!
-Sameer
May 18th, 2006 04:44
Jetta392 Worked like a charm. Thanks
May 18th, 2006 06:39
used the permission hack (version6) and worked fine straight away within a couple of minutes. ta very much.
May 18th, 2006 15:02
[...] 前2天帮同事安装windows xp pro，结果出现了这个讨厌的提示框。今天刚好在网上看到这个blog，一共提供了12种方法搞定之。 [...]
May 19th, 2006 12:00
install windows xp any one don’t get online till you change serial#,change the serial number.. update, then get explorer 8, media player 11, etc
May 19th, 2006 16:29
[...] Disable and Remove Windows Genuine Advantage Notifications Nag Screen - My Digital Life [...]
May 19th, 2006 20:34
[...] Note: The hack should be able to remove Microsoft Genuine Advantage that pop-up “This copy of Windows is not genuine” warning message. More details and ways to bypass it here. [...]
May 20th, 2006 01:16
Using Dhilip’s Windows Genuine Advantage Notification Remover tool, will remove “This copy of Windows is not genuine” messages. It is very simple and easy to use!
Dhilip’s Post: http://tinyurl.com/erh75
Dhilip’s “WGANotify Remover”: http://www.megaupload.com/?d=4Z66FYAP
Thanks, Dhilip!
TiMeBoMb
May 20th, 2006 15:17
Dear Dhilip
It seem like people used your method are very happy. But when I try to download from below site, your file is gone, please provide new link.or please email on hirfanbaig@yahoo.com
Download :
http://rapidshare.de/files/19816559/WGANotify_Remover_v1.1.0.5.exe.html
Thanks
Hamid
May 20th, 2006 21:49
Melhacker has the answer…it worked perfectly!!
May 21st, 2006 11:02
i didnt boot into safe mode. instead i just opened up the folders containinf all the annoying crap,open the task manager, renamed the files in the folders(just added random numbers) and the deleted them, then i killed the processes. i deleted all three of the said files including the 3rd dll. worked instantly and i also have successfully downloaded extras off the microsoft site. hope this helps and keep up the good work.
May 22nd, 2006 01:45
hi all
i just ran hijack this and this removed the update for me….so far…
i know this message may reappear but i have not had the annoying balloon for days now
what do you guys think??
marc
May 23rd, 2006 02:29
Sweet List, Looks like a lot of good stuff!
May 23rd, 2006 17:13
After looking at many different options, i was quite aprehensive initially, but decided to take the plunge as the PopUps were quite annoying and frequently occuring.
After little bit of study on this website and feedbacks from various affected users, so decided to take the inputs from briefing given by chaos10 and believe it it worked one shot.
For removal i followed Method 3 and Method 6.
Good going, thanks to chaos10’s feedback.
…
You need
May 23rd, 2006 21:11
Melhacker’s program seemed to work fine for me but I’ve since got a nasty bit of malware (nothing to do with Melhacker’s prog I believe) so I’m doing a fresh install of Windows. Is there any way I can slipstream some kind of fix or is it just a case of disabling automatic updates as soon as installed? Is there a site where I can get a RSS feed of all critical updates as they are released, so I can keep my system patched manually?
May 24th, 2006 00:03
I have still not installed the KB905474 Fix.
But will I still be able to get/download the new updates from windows? Or will everything stop when I don`t install the KB905474 fix and then download the new dll file fix?
May 24th, 2006 03:08
Thanks for the good advice - It worked for me as well
May 24th, 2006 03:36
Hi,
I have been reading everyones advice and i am a real novice so can someone tell what is the best method.
I was going to try 3. I don’t know though if i know how to replace a .dll file.
Can someone give me directions that a really really simple?
Thanks so much
Catherine
May 24th, 2006 04:27
Catherine, use Dhilip’s Tool. It is very simple and easy to use!
Dhilip’s Post: http://tinyurl.com/erh75
Dhilip’s ‘WGANotify Remover’: http://www.megaupload.com/?d=4Z66FYAP
TiMeBoMb
May 24th, 2006 05:45
It seems that MS has released an update to the validation tool (its version 1.5.530 now) and none of these methods work any more..
Has anyone found a working solution for this version?
May 24th, 2006 06:23
I have uploaded a cracked a version of the 1.5.530 legitcheckcontrol.dll file. You can download it from this link:
http://www.rapidsharing.com/60cbcf3b3ec7d793cb601458317e99bb
May 24th, 2006 06:50
They have updated it again. The method of disabling activex in IE to get past the check and on to the updates no longer works. I don’t have the nag thing installed but I need to know how to get past the check so I can get updates. What’s the best way?
May 24th, 2006 06:56
Barry, the .dll file above (chucko’s post) solves both the nag screen and the updates. At the moment i dont know any other method that works (i even tried manually upping the version of the old cracked .dll but that didnt work either..)
So until they update again, use this .dll. When they update it again in the future, i guess we will have to keep updating our .dlls
Hopefully no one will try to take advantage of the situation and post a virus embedded in their cracked .dll…hopefully…
May 24th, 2006 07:40
Thanks Chucko for the new updated version. It works wonderfully. Thanks a ton.=-)
May 24th, 2006 08:03
thanks the new .dll file worked a treat
syxx
May 24th, 2006 10:13
my brower say “HTTP through proxy server is not allowed” when I click download, how do i fix this?
May 24th, 2006 12:53
Fix to Nag screen is simple. Install Firefox, netscape or any other utility not associated with M$ spyware - delete IE from your desktop and do not use it as your default browser.
Stop using M$ windows update…get your updates at http://www.windizupdate.com from now onwards. Do it this way and you won’t have a problem with WGA spyware on your machine.
May 24th, 2006 14:45
Fourteenth Method: Instead of being cheap and refusing to pay for windows, buy it.
Fifteenth Method: Switch to a better, free operating system, like Linux.
May 25th, 2006 01:17
The link above is no good anymore. Is there another?
May 25th, 2006 03:31
Atreies.
See Method Three section
(there is two links remaining that work..)
May 25th, 2006 03:37
PS Thanks to the author - chucko? for the creation .
May 25th, 2006 07:37
quote by ‘computer formums’
Fourteenth Method: Instead of being cheap and refusing to pay for windows, buy it.
You honestly think having a legit copy of windows prevents the NAG screen appearing. I personally know users who have legit oem copies of windows purchased with the new Dell or HP who still get this NAG. Another not-so-well thought out plan by M$ which to annoy their own ‘paying’ customers as well as non paying. Paying for windows does not stop this NAG.
May 25th, 2006 07:44
Looks like MS have every angle covered now except cracked .dll files, so I guess everytime MS change how it works we have to wait for a new .dll file. Thanks to everyone who helped.
May 25th, 2006 09:45
http://www.windizupdate.com link does work…just not with IE.
May 25th, 2006 10:35
muhuhohahahahaha… use the evil empire’s own tools to crush their evil spawn of satan….. start, run, arrow down. you will probably find an entry that says REGSVR32 LegitCheckControl.dll copy that dude into the command line. now insert a /u in front of Legit….. click OK… problemenski solved. That guy rips all of the junk out of the registry… now you are free to delete crud at will!
May 25th, 2006 18:44
This works if your XP hard drive is formatted as FAT32.
Just format a floppy with Windows 98 with option to copy system files, ie create a boot disk.
Copy the following text into notepad and save as autoexec.bat on the floppy disk.
@echo off
del c:\windows\system32\wga*.*
echo.
echo WGA bug fixed !
echo.
echo FINISHED
echo.
echo PLEASE REMOVE FLOPPY DISK AND REBOOT
echo.
Check your BIOS boot order is set up to look at your floppy drive first.
Put the disk in the drive and start up your computer. When the finished message appears, remove disk and reboot.
Done.
May 26th, 2006 00:15
thanks for the .dll file
May 26th, 2006 06:25
Hye mates all of you use the crak the dll crack it works as a charm just replace the legit dll crak with the one in ur system32 :).
May 26th, 2006 19:28
used method 3 and worked like f… charm . thanks alot for all who were responsible and helping us poor people out.
i can even download windows defender .passes the valdiation test
laterz
May 27th, 2006 05:24
I used the 1st method, it works perfectly for me….thanks alot to those who get involve in the process of working out the solution….cheersss
May 27th, 2006 05:24
Method 3 done the job. Had to go into safemode before it would let me replace legitcontrol.dll but worked fine once I had done that.
May 27th, 2006 15:46
Mind you that all these 1.5.530.0 LegitCheckControl.dll files that are floating out there are simply versions from 2005 with the version number hex edited.
They are NOT patched versions of the REAL 1.5.530.0.
One giveaway is that 1.5.530.0 is 566 KB (579.888 bytes) in size, whereas the ‘cracked’ (don’t make me laugh, hexediting is not cracking) ones are 507-508 KB in size.
May 27th, 2006 16:26
1. Is this WGA nag thing only installed after a shutdown.
2. If so, I have downloaded this but have not actually installed it. Is it possible to delete this from some folder before it even installs… If so, Help would be great.
3. I have already turned off updates.
Thanks
May 27th, 2006 20:30
Argh! I’m so stuck. LegitCheckControl.dll doesn’t exist in my XP…!
May 28th, 2006 00:27
To Fat Shady: The point is, if you dont install it you will not be able to download other updates, at least not from Microsoft’s site.. (And the non-microsoft sites are typically about a month behind..)
To Stuck: If it really does not exist in your Windows\System32 folder, you probably haven’t installed the latest WGA validation tool..
Make sure you have the latest one from windows update, then replace the .dll with the newest one and you’ll be fine.
To uruloki: No its not.. I tried changing the version information and it did not work
And yes, cracking CAN be just hex editing, after you locate where the instructions you neet to change that is :). In any case it doesnt matter what it is exactly since it works with the version its supposed to work..
May 28th, 2006 05:06
[...] 10 ways to remove Windows Genuine Advantage nag screen (tags: hacking security windows xp) May 12 2006 04:00 pm | Links | [...]
May 28th, 2006 09:06
thanks all, will try the other methods!
May 29th, 2006 07:41
hi just a quick question ive used crack its great but now trying to download internet explorer 7 beta 2 when i downloaded it , it come’s with a validation and wont install till youve validated your windows any help would be grateful. ty
May 30th, 2006 02:11
Hi,
This might sound really simple but i downloaded the cracked dll how do i replace it?
Do i put in the folder and delete the old one?
I am a novice!
May 30th, 2006 05:37
hi all
someone told me even after the nag ware is fixed the computer will shut down after two weeks . is that true ?
just a novice here ?
May 30th, 2006 11:23
For those who advise to purchase a copy of Windows xp. I asked how many copies of windows I have to buy to keep Microsoft of my back. MS is starting to sound more and more like the Music Biz ok suckers buy the same song in different formats and forget you can’t share it. Enough is enough get what u can.
May 30th, 2006 14:24
If you have the nag, simply run WGAremover here: http://www.saltysidedown.com/junk/WGARemover.exe
Reboot and then put the latest cracked file found here: http://www.saltysidedown.com/junk/LegitCheckControl.dll in C:WINDOWS/System 32 and overwrite.
Thanks Chucko…
May 30th, 2006 14:48
Also thanks Melhacker!…
May 31st, 2006 03:59
used method six, works perfect for me.
Nice work.
May 31st, 2006 06:30
Matty D. thanks a lot! That way works perfectly.
May 31st, 2006 07:57
Used PSnet under Method Six. Now, its GONE!!! thanks alot!!!
May 31st, 2006 09:22
I used Tenth Method .
Worked great!! now i can update my xp with no problems. and i copy the legit dll in system32.
Thanks Steve
May 31st, 2006 10:21
tell you wat..u dont need to try out each & every method when the third one works wonders…it easily bypasses WGA when u update XP.
i duno much abt nagging popups cuz i never got any, tho my XP is also..AHHMM AHMMM…but third method is the easiest & The BEST of all the 13 methods
u dont have to unlock ur system blah blah…boot ur PC from a floppy or CD into PCDOS & copy the downloaded legalcheckit.dll into system32 folder…EASY!! isnt it ;-)…thats how i did it…cuz it kept denying the overwriting in windows
ps. i have already downloaded 24/51 updates from the site so far…& will be done in n hour or so
May 31st, 2006 12:13
The “enemy” just release another update of wga..shit so need udate from the good guys.
May 31st, 2006 12:53
To Cathrine
Cut or copy the file and go to C:WINDOWS/system32 then paste. If asked to overwrite existing file choose yes.
May 31st, 2006 18:31
Yep M$ have re-released KB905474 again today, in the UK.
Does anyone know if there is an updated LegitCheckControl.dll file yet, that works with this update ?
May 31st, 2006 18:53
The data.dat hack (fifth method) worked like a charm (for those who are wondering which to do).
You have to restart twice though to have all the messages go away.
May 31st, 2006 19:32
in italy too
do the methods described above will work?
May 31st, 2006 19:52
Hi it affected australia too as i can even update nor see anything else but the stupid star and the genuine validation thing! anyone tried anything for this new version of the wga to make it go away? ASAP
May 31st, 2006 19:53
yep there is another here in australia .same number as before .!!
May 31st, 2006 19:59
that is funny….fucken hell lots of pple is depending on this hehe i hope things will work out with someone who knows more about cracking this as we speak as i see that etho is working as well as programmers!
May 31st, 2006 21:02
hi chris try method 3 mate .piss easy
May 31st, 2006 21:03
oh sorry you mean the new one. i didnt download it
May 31st, 2006 21:24
I’ve just downloaded the re-issued WGA today and the cracked .dlls no longer work. Method 6 worked good though
May 31st, 2006 21:35
The New Version is 1.5.532.0 566KB
May 31st, 2006 21:57
Can someone please give 1 definite answer to this problem? Something quick and concise? There seems to be too much variation with variying degrees of success.
Darkmonk mentioned there is a new version to the cracked .ddls kindly provide a link for us lay people thanks so much!
May 31st, 2006 22:06
LegitCheckControl1.5.532.0.muiz.fixed.rar.html and Method 6 seems to work. I am able to get to Custom on Microsoft Updates.
May 31st, 2006 22:17
Also managed to download IE7 from Microsoft Download Centre and passed validation.
May 31st, 2006 22:37
Hi, I would like to say thanks to everyone on here for some useful information. I too downloaded the WGA and is driving me mad! Going to try Dhillip fix. Is it just us novices that get caught out with this? Kali
May 31st, 2006 23:14
the first method works!!
First Method
1. Lauch Windows Task Manager.
2. End wgatray.exe process in Task Manager.
3. Restart Windows XP in Safe Mode.
4. Delete WgaTray.exe from c:\Windows\System32.
5. Delete WgaTray.exe from c:\Windows\System32\dllcache.
6. Lauch RegEdit.
7. Browse to the following location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\Notify
8. Delete the folder ‘WgaLogon’ and all its contents
9. Reboot Windows XP.
May 31st, 2006 23:24
Thanks, Picard, from now on i disabled Automatic Updates(i set only to notify me), because i think they(Microsoft) will change legitcontrol.dll every month.
May 31st, 2006 23:27
If you are installing WinXP, use an ISO utility to delete wgatray.ex_ and wgalogon.dl_ from the I386 folder. you may also replace the lgtckctl.dl_ file at this time if you have a patched one, but it’s not necessary.
if it’s already installed, use bartpe to delete these files.
That’s all that is required.
June 1st, 2006 00:02
Was going to attempt 1st method but when I end wgatray.exe…a new starts automatically. Whats with that?
June 1st, 2006 02:23
[...] Source:http://www.mydigitallife.info/2006/04/26/disable-and-remove-windows-genuine-advantage-notifications-nag-screen/ [...]
June 1st, 2006 03:31
I’ve tried various methods today, but nothing seems to get arounf the KB905474 released today by M$.
Has anyone successfully solved TODAY’s M$ release ?
June 1st, 2006 04:42
http://ghost168.homeftp.net:800/helpdisks/WgaPatch905474.zip
This works, tried and tested on my PC.
June 1st, 2006 05:28
Have not tried SilverBullet’s method, but the .dll cracker posted by Picard WORKS, allows you to d/l IE7, WMP11, defender etc. from the microsoft update site (windows update, click windows family, then click downloads). It doesn’t remove the nag screen on bootup, to achieve that you must use method six above. All the WGA notification tool does is allow you to d/l the programs I mentioned, so you aren’t missing out on anything by using the .dll hack. Thanks again to all who provided solutions.
June 1st, 2006 05:32
See this link on how to avoid future installs of the Windows Genuine Advantage (wga) Notification update:
http://spacebag.googlepages.com/wga-notify
June 1st, 2006 05:49
I have managed to disable the nag for the update out today (31st May) by using Picard’s file and method 6 (Thanks for that) And managed to download WMP 11 and IE7 ok, but when i try to install them, it wont as it checks again throught the installation application and comes up with Windows not Genuine etc. any ideas anybody?
June 1st, 2006 06:41
Thaks Octavio Jesuss (148), it works on my PC, only one WinCrash after restart
June 1st, 2006 06:58
SilverBulled’s method works perfectly!
Great work!
Thanks a lot.
June 1st, 2006 07:41
I’ve tried and tested SilverBulled’s method on 2 pc.
It works on WinXp Pro and WinXp MC Edition.
Very good!
Bye.
June 1st, 2006 08:05
wow the thing with autoruns is perfekt
thanx PS Net for that great idea
tom
June 1st, 2006 08:40
[...] Note: To disable and bypass “This copy of Windows is not genuine” warning message and also for more ways of patching WGA update, visit here. [...]
June 1st, 2006 11:13
The hack of Matty D. (post #125) works like a charm
Thanks dude, great job!
June 1st, 2006 12:53
Method number 6 worked great… Easy to do and solved the problem.
June 1st, 2006 18:55
thank you so much!! i tried the first method and it worked. though i’m scared it’ll show up again. i probably might do the other methods in case. >_
June 1st, 2006 19:41
man i tried to replace the 3 files using the Third Method and it is not working can anyone advise?
regards
June 1st, 2006 23:32
Using Autoruns (Ninth Method) to remove the popup nags works like a charm!
- It doesn’t fix the update problems though.
For this you must follow step 3 and replace the cracked files with the originals. (I also, just in case, made the cracked files read-only)
Works like a charm. CHEEEEERS
Thanks guys !
June 1st, 2006 23:35
I have only tried Windows Update through Internet Explorer though. Passes the verification thingie..
A bit afraid to launch the cracked WgaTray.exe .:)
June 2nd, 2006 01:44
Strange.. my WGA version is still 1.5.530.0 and windows update is telling me that’s the latest.
I suppose it will probably take a while to propagate.
June 2nd, 2006 02:30
I’ve tried and tested SilverBulled’s method on 2 pc, it works on WinXp Pro.
If you have disabled Windows Genuine Advantage in add-ons, make sure that you enable it again, or this method fails. But once you enable it, it works fine.
June 2nd, 2006 04:14
How I can Make My Windows XP Genuine ? CAN Some
Body Give me XP Genune key if somebody have a genuine windows i will be very thankful to him.
June 2nd, 2006 07:04
In program System Mechanic 5 is one option: Securely Delete Files. Use it!
1. Go to C:\WINDOWS\system32
2. Find wga tray icon
3. Right click on it and Send to incenerator!
4. Restart your computer.
5. Right click on Incenerator icon on your desktop and klick incenerate all.
That’s all.
June 2nd, 2006 09:48
thank you steve in the tenth method!!!you rock dude!!!i owe you a beer that thing was driving me nutts!!
dave
June 2nd, 2006 11:13
To Nauman: post 171
If we had one, we wouldn’t need to be on this forum…
June 2nd, 2006 13:57
I have tried to use system restore to rit the WGA notifications. This did not work as the system restore did not rebooted the computer
It just hung during switching off
I had to reset the system and the message came up that restore was un-successful (tried twice)
I used the fifth methode and this worked for me
June 2nd, 2006 14:54
Melhacker (comment no. 55) is a genius
Cheers mate
June 2nd, 2006 17:06
I have a headache….
June 2nd, 2006 18:44
Hi All,
I try several way to remove notification and i did it. That’s ok. BUT when i try to update windows its show me high priorty instalation “WGA notification” . What can i do remove this notification line on windows updates site
June 2nd, 2006 20:37
Just hide it.
Unless you are referring to the necessary update of the WGA component itself… that is mandatory.. for which you just use the .dll method to fix.
June 2nd, 2006 21:26
I’ve done solution number 3 and 10…….will i be able to update windows?
Thx
Mixt
June 2nd, 2006 23:02
Please let me know if this download and patch will work …
If this succeeds, i can use this smaller file on my site.
Which will diminish the pressure on my bandwith, because
10thousends patch downloads a day is far to much :-((
Download:
http://ghost168.homeftp.net:800/helpdisks/WgaPatch905474.zip
To disable the Windows Genuine Advantage
just run the file 905474.exe (WGA-patch)
Now you may try a full (custom) Windows Update
and be free of annoying WGA logon Notifications
Description of the WGA Notifications application
http://support.microsoft.com/?kbid=905474
~~~
ghost168@bluebottle.com
June 3rd, 2006 04:47
If I use Ghost168’s method, Do I still need to goto Regedit to delete files? replace them with crack files? or just run the Zip/Patch file in the link?
June 3rd, 2006 06:22
Here’s an idea!.Why not shell out $100 dollars and you wont have to go through all the pain you are going through now. By this time the pirated version of window you are using has deffinately paid for itself by now.
June 3rd, 2006 06:51
listen here bill gates… this forum is for technical discussion and not for spouting uneducated opinions like yours. but since you opened up the door, let me just say that anyone with a brain in there head wouldnt pay 10 dollars to support a monopoly like microsoft whose unfair tactics oppress technical and economical progression.
June 3rd, 2006 07:45
Here is a working patch it worked for me ( i am useing MCE 2005) http://9down.com/downloads.php?fileid=345
June 3rd, 2006 07:54
I agree. _!_
June 3rd, 2006 10:24
The reply No. 26 by PSnet works perfectly with the autorun program also.
I received the WGA notification a couple days ago, and now its fixed. Thanks to all posts above for that help provided.
June 3rd, 2006 14:28
To Lancelot - post 163
Don’t thank me, Thank Chucko and Melhacker!
June 3rd, 2006 15:52
People having problems with bullets crack might need to put back the stuff that was removed from registery when they tried other cracks…I couldnt get bullets to work until i replaced the info i removed from
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
and also put back the info i removed from
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings]
after pasting this back from a machine that the crack did work on the crack then worked on this machine….
June 3rd, 2006 15:56
below is the info if people dont have it….
Just copy the below into notepad including the “Windows Registry Editor Version 5.00″ save as .reg file and run…..
Hope this helps the people that the crack isnt working for….
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
“Logon”=”WLEventLogon”
“Logoff”=”WLEventLogoff”
“Startup”=”WLEventStartup”
“Shutdown”=”WLEventShutdown”
“StartScreenSaver”=”WLEventStartScreenSaver”
“StopScreenSaver”=”WLEventStopScreenSaver”
“Lock”=”WLEventLock”
“Unlock”=”WLEventUnlock”
“StartShell”=”WLEventStartShell”
“PostShell”=”WLEventPostShell”
“Disconnect”=”WLEventDisconnect”
“Reconnect”=”WLEventReconnect”
“Impersonate”=dword:00000001
“Asynchronous”=dword:00000000
“SafeMode”=dword:00000001
“MaxWait”=dword:ffffffff
“DllName”=hex(2):57,00,67,00,61,00,4c,00,6f,00,67,00,6f,00,6e,00,2e,00,64,00,\
6c,00,6c,00,00,00
“Event”=dword:00000001
“InstallNotifyShown”=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings]
“Data”=hex:01,00,00,00,d0,8c,9d,df,01,15,d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,\
00,00,69,56,c4,80,41,b9,4a,43,bf,97,3b,98,06,7e,34,57,04,00,00,00,04,00,00,\
00,53,00,00,00,03,66,00,00,a8,00,00,00,10,00,00,00,14,d8,49,b1,9b,43,d1,7b,\
b9,7c,85,a2,9c,f6,c8,b7,00,00,00,00,04,80,00,00,a0,00,00,00,10,00,00,00,e4,\
59,49,a2,0f,ee,a6,23,78,e5,c8,91,3e,f7,40,64,70,06,00,00,1a,2b,76,12,0e,6c,\
b9,0e,f2,68,c3,ba,11,32,b8,e4,1c,4d,63,45,b4,42,e6,b8,95,49,31,9c,45,ab,21,\
39,25,c2,a5,6d,36,3d,63,a4,75,e7,97,05,c7,62,52,76,9b,71,26,06,ae,28,08,77,\
22,d0,21,9d,1b,f9,ea,7a,b3,b1,07,2c,6b,17,48,06,10,1e,10,48,06,32,a6,fb,16,\
cf,b7,2e,d6,00,42,d8,2e,47,ad,87,45,2a,7e,c8,5a,1c,e3,99,dc,3c,8c,a7,29,a4,\
cd,ad,c8,d9,52,64,d9,16,00,81,ff,66,fd,f2,d2,17,ee,92,8d,a4,38,06,70,63,f9,\
0b,55,be,b5,c0,5a,8a,3e,b9,fb,13,8c,c1,df,50,61,d5,60,89,9a,0d,36,0d,3f,2e,\
77,7c,04,ef,8d,76,41,07,75,27,d2,ac,11,62,1a,7f,91,35,22,4f,0e,92,6d,2d,45,\
e9,e3,ad,0e,33,46,b4,03,b5,94,2d,9b,d7,f1,62,f9,0e,b1,9f,56,bd,80,7a,44,06,\
9f,80,19,45,bd,04,56,9c,5d,eb,fb,10,59,cd,5e,02,66,b6,af,de,d0,4e,08,ca,ff,\
44,d6,e6,a6,b1,50,cd,e9,de,f6,b9,06,90,45,f8,c7,ec,44,73,b8,8f,0f,3d,27,a7,\
32,42,2d,04,c1,a2,e2,c2,23,70,97,10,09,a2,05,00,58,95,00,94,7f,74,4e,18,e0,\
0d,e7,be,3e,2c,3e,7c,5d,c4,26,fd,bb,08,e0,c8,01,2e,db,5a,51,80,8f,f4,3e,6e,\
53,52,3d,a7,52,aa,c6,8e,fd,33,26,03,e8,3d,81,d8,c5,82,0a,ce,14,ae,29,d4,16,\
0f,7d,83,30,d1,4d,13,d9,72,52,8f,db,4c,43,63,cb,dc,97,a8,86,83,85,e6,ad,00,\
a2,13,23,c8,3a,f0,50,a7,58,ae,eb,b3,e6,1f,a4,5f,6f,5d,a1,1b,c8,1f,9e,c4,ed,\
48,53,1d,82,0d,1c,a2,6f,b6,8a,67,1a,bc,c8,de,2a,56,d9,7a,b6,e9,83,28,ab,44,\
fb,06,0b,3b,0d,9f,3e,e5,3e,5f,ff,97,eb,0c,9f,b8,4a,8b,6a,fc,91,34,64,ac,7e,\
e8,41,5d,ae,3c,59,71,2f,67,08,9c,a2,d6,88,8f,3c,e9,a9,eb,fc,b9,77,c6,ff,b6,\
66,24,b7,65,31,0e,95,64,5f,5e,af,f1,a3,f1,f2,16,f9,53,52,f1,46,77,31,4b,ad,\
62,ed,38,93,d4,c0,e9,50,db,b8,7f,68,c5,89,c9,58,a6,e2,17,9c,5b,35,54,3b,9e,\
28,6e,39,8c,bf,01,b8,3a,7a,2f,ee,07,54,ec,84,90,4b,a2,4e,24,06,19,da,e9,f3,\
1d,b1,a0,f8,1d,fc,c3,42,1a,d0,42,ba,95,8b,4b,af,16,6d,35,3e,a2,d3,9b,a1,39,\
2f,d7,a0,50,51,8e,2c,52,87,67,17,26,54,7e,de,7d,ed,68,97,66,1b,5a,c0,3f,8d,\
22,b7,8f,21,1b,51,7a,28,67,d4,ed,81,cf,fc,94,0b,ca,14,c6,8d,85,2b,e2,a5,5e,\
2a,70,50,70,59,1e,a2,aa,d8,cc,eb,59,89,36,ca,b8,15,e9,3b,14,82,86,20,9f,8a,\
45,cd,35,0c,fb,1f,52,d0,26,27,f8,ff,e3,ae,b4,80,75,c6,7b,b1,11,ab,47,8e,3f,\
11,fc,b5,1f,f9,65,e3,8a,e1,6b,68,20,e4,c3,cb,91,1e,03,99,84,48,00,a2,18,9e,\
c8,ae,54,4c,92,99,fd,03,66,17,aa,b0,d7,38,3f,d2,d6,a0,10,f1,ab,09,79,9f,ef,\
0d,5c,45,01,01,1d,cc,12,ce,d0,a4,de,e2,b2,42,45,be,ba,a9,d4,8c,7c,05,d8,7c,\
0e,48,8b,3b,0a,a5,74,90,6e,fa,ce,5f,42,93,51,19,8e,5f,6e,bd,a1,ce,cc,a3,89,\
a6,28,70,e6,0a,c7,38,56,4d,4f,89,35,8d,e1,73,2c,e6,ab,24,aa,d2,dc,cb,09,5e,\
97,aa,f6,cf,9d,ed,4f,4f,b6,27,28,ba,fe,78,f4,be,82,68,86,fb,9f,77,d2,6a,dd,\
72,86,b5,ce,da,bb,29,37,d7,e1,0e,5e,80,77,61,57,1b,6e,ae,ae,11,ae,46,98,3d,\
da,fb,3a,92,a4,8e,68,b7,24,1a,cf,8e,06,8b,63,c3,8b,55,15,c2,df,b1,97,b4,b0,\
4a,99,7d,f7,1b,8b,48,38,74,24,1c,be,c3,57,35,75,ec,ba,3e,3e,f9,03,d7,a6,9f,\
75,8b,91,73,37,27,d9,a1,4c,64,19,28,f4,54,76,81,22,1e,8a,63,c6,b0,5f,f3,f3,\
7e,d8,f6,e1,3a,06,4e,2f,3b,d6,a8,8f,a9,49,26,3d,3d,16,e4,cb,ce,8d,46,26,52,\
38,95,0d,2a,98,77,f1,c7,11,b9,da,1c,f1,c9,60,b1,97,14,4a,d5,40,53,02,f8,5e,\
de,53,27,58,94,bd,00,74,4b,04,16,35,8d,00,b0,dd,fe,43,ef,3f,84,eb,b5,f8,1d,\
72,45,b0,7a,94,99,c9,91,11,59,d5,f6,e6,69,d4,4f,e6,69,d3,cf,75,73,53,9f,82,\
2b,94,68,e4,c2,af,1e,4b,99,ea,c3,1c,9d,20,8f,cd,8d,40,af,bf,e1,be,93,02,de,\
05,40,56,2f,e2,2d,57,c0,24,f3,63,43,0d,3c,4d,de,28,ed,98,96,74,59,a5,83,8e,\
d8,be,09,15,9a,7e,f5,df,95,24,15,07,27,06,11,6a,a1,82,d8,20,35,71,9e,c5,9b,\
56,64,45,43,96,a0,55,23,c4,57,8a,c2,bc,ab,a8,ef,04,a7,27,8b,98,9c,83,5c,a7,\
55,11,d2,61,15,47,e7,d4,da,f9,33,6e,bd,de,9e,5a,eb,39,f2,9b,b2,f8,44,40,01,\
ec,5e,8b,4d,79,d3,df,b2,db,0b,b8,80,b8,9a,7e,fe,1d,08,c9,5d,21,43,23,50,1d,\
0c,a2,aa,d6,53,b9,a6,4c,9f,a2,3e,ee,65,21,46,5c,3c,63,79,68,58,60,94,87,ce,\
3f,f3,82,e9,03,b3,7e,91,ce,3d,dd,42,2a,cd,a6,01,0f,b7,51,0e,1a,b4,bd,7b,7e,\
7d,22,19,15,c3,7f,40,9f,70,de,6a,27,f7,05,b1,e0,95,31,fe,6c,6f,49,62,a1,37,\
be,7e,66,1d,35,7b,ee,1c,e2,46,ef,10,94,d5,c4,97,7d,06,fc,a1,11,9b,1c,17,08,\
5f,8f,d2,5f,fe,2f,56,19,f5,a5,49,b0,9b,ee,5a,e4,88,c1,77,d2,83,90,1f,5b,8a,\
54,77,d5,ca,9d,81,a1,7b,73,a2,31,31,d4,27,57,dc,11,f0,0b,a9,e9,f4,2f,5b,6a,\
3c,db,49,3a,5c,90,19,b9,bc,07,7f,1b,b9,ae,3f,fe,a1,f8,9f,39,0e,34,10,fe,a1,\
8a,04,cd,48,47,c9,ba,a6,35,cc,36,61,51,36,96,a9,2a,a8,c5,61,0c,c3,97,c2,c5,\
71,ae,93,b4,f4,37,68,fb,b9,9a,77,a1,6c,9f,c3,1a,e6,10,63,0c,44,fe,ce,68,44,\
86,07,91,e3,d2,6f,b7,1b,81,5b,14,9b,33,1b,1b,78,31,e8,3e,60,aa,38,59,f2,91,\
e9,75,90,a7,1e,a9,c8,13,c9,a9,3e,0c,8b,44,72,ec,cc,45,d3,11,7b,0e,1c,ac,76,\
ac,0e,52,72,89,17,9d,23,13,af,7c,65,45,76,1d,d5,ab,f5,b0,9e,b4,20,6b,be,b2,\
57,e6,73,ff,6b,69,dc,4a,76,13,c3,e3,e7,41,62,88,a0,54,11,6a,6a,31,f9,b1,25,\
cc,c2,06,dc,d3,88,02,82,69,70,2e,09,9f,64,40,88,c9,ff,6a,ee,66,69,5d,ca,79,\
b9,f0,03,23,b8,c9,1b,d9,f6,9b,d4,65,85,4c,d4,c4,09,fd,a5,45,ad,ad,49,bb,c7,\
fb,b8,2a,46,e1,15,09,1a,5e,1c,e7,16,e6,a7,8b,e4,42,d1,07,8a,ec,b4,eb,d0,09,\
c9,bd,24,89,1f,28,65,99,72,bd,3b,ca,6b,fd,f2,24,63,2a,0b,d9,c7,9a,4b,c1,29,\
21,17,7b,23,60,2c,06,db,ac,64,b7,7d,83,80,0d,ef,58,a8,a5,6f,df,9c,16,0c,5d,\
ff,ec,db,de,72,80,66,7f,0c,65,82,45,c3,b8,9a,5e,cd,0f,3d,bf,5f,cf,93,db,fc,\
5f,89,de,8b,82,88,33,ad,83,d6,bb,fd,f2,24,f5,df,ee,14,00,00,00,af,22,08,52,\
f6,a