Genuine Advantage Tool Phones Home (WGA)

"A 'safety measure', says Microsoft

A major concern with the new Windows Genuine Advantage tool, designed to limit piracy, is that the application phones home daily via your broadband connection, reports the Associated Press. Finally confirming the previously undisclosed activity, Microsoft says the the daily report was implemented as "a safety measure designed to allow the tool - to quickly shut down in case of a malfunction." There's a massive thread in our security forum discussing the tool for those looking for additional information and discussion."

http://www.dslreports.com/shownews/75198

Microsoft plans better disclosures of tool

"Microsoft Corp. acknowledged Wednesday that it needs to better inform users that its tool for determining whether a computer is running a pirated copy of Windows also quietly checks in daily with the software maker.


The company said the undisclosed daily check is a safety measure designed to allow the tool, called Windows Genuine Advantage, to quickly shut down in case of a malfunction. For example, if the company suddenly started seeing a rash of reports that Windows copies were pirated, it might want to shut down the program to make sure it wasn't delivering false results.

"It's kind of a safety switch," said David Lazar, who directs the Windows Genuine Advantage program.

Lazar said the company added the safety measure because the piracy check, despite widespread distribution, is still a pilot program. He said the company was worried that it might have an unforeseen emergency that would require the program to terminate quickly.

But he acknowledged that Microsoft should have given users more information about the daily interactions.

"We're looking at ways to communicate that in a more forward manner," he said.

Lazar also said the company plans to tweak the program soon so that it will only check in with Microsoft every two weeks, rather than daily.

The tool, part of the Redmond company's bid to thwart widespread piracy, is being distributed gradually to people who have signed up to receive Windows security updates. The company expects to have offered it to all users worldwide by the end of the year.

Lazar said that so far, about 60 percent of users who were offered the piracy check decided to install it. Once installed, the program checks to make sure the version of Windows a user is running is legitimate, and gathers information such as the computer's manufacturer and the language and locale it is set for.

That information-gathering is disclosed in a licensing agreement. But the agreement does not make clear that the program also is designed to "call home" to Microsoft's servers, to make sure that it should keep running.

At least every 90 days, the tool also checks again to see if the copy of Windows is legitimate. Lazar said that's because the company sometimes discovers that a copy of Windows that it thought was legitimate is actually pirated."

Been blocked by ZA since the first time it asked on my system ;)

Steve, what version of ZA are you using? If ZA Pro, how does its array of features compare to the competition (especially interested in its antivirus protection)?

I'm a ZA Free user so I can't comment on the AV component. My preference is for seperate baskets for my eggs, ZA for just Firewall and Kaspersky AV ;)

Same here. I blocked it as soon as it popped up. I also noticed that it keeps trying to phone home, but keeps getting blocked :)

Neil

What is it listed as in ZA? And how do I shut it off?

In Program Control it's called "Windows Genuine Advantage Notification".

Hit the KILL button.}( :+

Thanks.Will also block.So far I have been permitting acess daily

Can someone give me the information that ZA gives you on that app?
What ports, protocol and so on so I can block is as well?

in ZA free,see under Program control/programs/Windows Genuine Advantage notification

Don't use ZA, use IPTables on FreeBSD. Why I'm asking for info :)

WgaTray.exe - Port 1110, dunno what protocol.

Thanks


I Just blocked in all my machines using ZA

If you look in the Windows\Temp folder you find a folder
called WGAnotify.settings if you open it up you will find the
following:

Show notification for every 1 logins
DaysBeforeBuyNow Unactivated = 31
DaysBeforeBuyNow Nongenuine = 14
Server DisableAll = false
Server DisableVLKID = true
Server DisableGetSP2 = false
User ReducedReminders = false
User ReducedVLKID = false
User ReducedGetSP2 = false
BalloonInterval = 2 hours
BalloonIntervalVLKID = 24 hours
BalloonIntervalGetSP2 = 504 hours


I do not know what it means or what it is used for, that is
for the wiser ones on this board determine

Soon to be every 14 days.

http://www.betanews.com/article/Microsoft_Responds_to_WGA_Concerns/1149918983

And it'll still get blocked ;)

Hmmm ???
I too thought I had it blocked by ZApro . Then again , maybe NOT x(

http://www.dslreports.com/forum/remark,16292120

beenieman

Premium

2001-08-27
Loc:Trenton,Ont.
·Cogeco Cable


--------------------------------------------------------------------------------

edit: Tuesday June 13th, @06:19PM

said by docchat :

What can we do to stop it/shut it down? I know in ZA, you can block WGATRAY.EXE, but is there anything else, outside of System Restore or Reinstall?

If you use Za to block WGATRAY.EXE it will just go through the Generic host process for Win32 Services and if not there it will use Application Layer gateway service and so on and so on until it finds a way to send the info.

Mmmm - Well that sucks.

Has anyone tried the tool to remove WGA? Any downsides?

Last night I found this !Also some suggestions to rename wgatray.exe to .old .

http://www.wilderssecurity.com/showthread.php?p=774395

Quote:

Has anyone tried the tool to remove WGA? Any downsides?

I just used the aforementioned tool, and everything seems fine! After removing WGA, and returning to Windows Update, it showed the install of WGA in Critical Updates, but the choice was optional! ... George

Works good on mine even the sick birds.

I don't see why anyone with a legitimate copy of XP would care, and I have no sympathy for anyone using a pirated copy of XP.

Sure Shelly. So you had no issues with Sony installing its rootkit either?

Good point, Robin.

Sony never installed anything on my machines, since I don't listen to that crap. But I see absolutely no connection between the two issues. MS has not secretly installed a trojan on anyones computer.

Also a good point, Shel. But my take on what Robin's comment has more to do with is digital media producers secretly putting crap on the stuff we pay good money for to do things that are not in our interests. Give them an inch and they will take a yard (that's what my old gardener used to say about weeds :-)) I think Robin feels that, if we don't bitch about this crap now, then, it'll be too late later. I certainly think that we have to be ever vigilant when it comes to our personal freedoms and rights. Don't get me wrong, I know you are equally concerned with these issues, as well.

Being a Systems Administrator (in the past and in the present), Shelly, I see no reason why the hell MS or any other company has to invade my networks and start running crap I don't authorize because they are insecure in their product use.

These companies just assume its ok to do what ever the hell they want on my networks. Not gonna happen here.

WGA does do a specific function and it is voluntary. However, it was not initially released to constantly spam my networks with their information. In essense they are using their "protective" measures to effectively eat up my bandwidth. Yes its tiny, hell its barely on the scope. However, 1+1+1+1+1+1+...Etc... It counts and it starts to load things down. Its not just going to be MS doing it, once they see that MS can get away with it. Its a precedent and it needs to be stopped.

So now that we're no longer in the state of network neutrality, I should be charging every product cost for using my networks and its infrastruture to get its information to and from on my systems... Hell, I paid for it, not them. So why should I give them unlimited rights again??

Thanx for the expansion on your motives, Robin---just as I thought, and, I totally agree ;-)

>I don't see why anyone with a legitimate copy of XP would
>care, and I have no sympathy for anyone using a pirated copy
>of XP.


Q.E.D.

Shelly, I have had legal copies of Windows XP, installed from the factory (Dell and Toshiba) that have failed on this crap. Do you have sympathy for me?

This is clearly extremely poorly implemented and written software.

Advocates of the scheme would just dismiss you as a rare statistic because the vast majority of users don't have problems with it (until it happens to them, of course :-) )

Thats with everything in life though... not just WGA. It will never happen to me, so why should I care? *until it happens to you*

>I don't see why anyone with a legitimate copy of XP would
>care, and I have no sympathy for anyone using a pirated copy
>of XP.

From my point of view, I paid real money and bought my legal version of my box of WinXP. Why do they still have to 2nd guess if my windowxp is legal or not. It's in insult.

That is too silly to warrent a reply.

I have four computers in my home: I planned them, spent hours choosing the best deals for the components, ordered the components and PAID for them. Then I spend hours assembling them, installing PAID for OS and various software, and finally tweaked them for top performance after hours of studying and troubleshooting the mistakes I made. I currently maintain them, upgrade on occasion and repair them.

These are my units that I built and paid for. Where does Bill Gates get off insisting on installing monitoring software on my units so that he can make money?? And that is why he is doing it.

Now, if he wants to have a check in my mailbox for $100 dollars the 1st of every month for each unit he is using to increase profits for Microsoft, I am a happy camper! But I don't think he will do that. He wants me to help his business profit for free.

That jest ain't capitolism, Billy Boy!

If as you said, you "PAID for OS", then ol' Bill already has your money. The Genuine Advantage Tool will not get one more red cent from you. So I don't see how you have arrived at the conclusion that "He wants me to help his business profit for free." He's already made his profit off you.

On the other hand, "monitoring" honest individuals like yourself, who have purchased licenses, surely costs Microsoft a few bucks. Maybe someday they'll figure out a way to monitor only dishonest individuals, then they really will increase their profits.

So since you're honest, you're costing MS a little money each time they (try to) monitor you. Now don't you feel better. lol

Jim.

Jim, Jim, grade school math!

In theory: for every pirate you stop, he is forced to go out and purchase (note, PURCHASE=pays $ to M/Soft)a retail copy of Windows. Right?

So if you load a monitoring problem (ooops, I mean program) on every computer, including your loyal, praise-singing customers, you are helping Microsoft police their product, Right? Resulting that Bill makes more money, right? Right?

After all, Jim, why don't you volunteer to donate a few hours every week to work around Microsoft's office in Redmond for free, just to show your good will? Maybe empty waste baskets, water the lawn, etc. Why, I am sure that Bill would be grateful for the free labor. After all, he wants us to provide free security checks on our computers so M/Soft can make more money.

Obviously, this is my opinion. :)

Sorry, but everything you posted is just bar stool bullshit.

1. You do not own a copy of Windows or any other commercial software program. You only paid for the right to use it under the published terms of the user license agreement. You further specifically agreed to those terms when you installed that software.

2. Any publisher or manufacturer has a right, and a legal responsibility, to protect their intellectual property. If they fail to do so, they forfeit all patent and copyright protection.

3. Since at least 50% of all copies of Windows in use are pirated, every honest user is paying for the actions of the pirates. The cost of stolen software is figured into the price of every program you buy.

4. Beyond the cost to the injured company, theft of intellectual property sucks billions of dollars out of our national economy every year hurting the country and every honest person, raising personal tax payments, and hurting employment.

If you are an honest consumer you should be applauding every legal effort by anyone to catch the criminals.

>If you are an honest consumer you should be applauding every
>legal effort by anyone to catch the criminals.

Unless Shelly, the "legal effort" actually hurts the honest consumer (see my prior reply).

I'd like to add to that...
I would not be so against all of this as long as it doesn't make it harder to do my job right. Its MS' responsiblity to resolve their issues with their manpower and time, not mine. I didn't sign a contract with them saying I was going to fix their problems. I cannot help it that they've done a piss poor job doing their job right. However, I can help how I do my job, and I will not tolerate nor condone their efforts when it requires me to take time away from doing my real job. Unless they're willing to pay me for my time to fix their problems.

I'm content as long as my firewall blocks it.

It doesn't !!!
see my post #24

Well damn! I'm not feeling so content now. My brother loves his MacBook so much, he wants to sell me it and buy himself a newer one. Maybe I should seriously consider it.

Shelly, you owe me an apology for your bad language.

Read my post, Big Man. Jim didn't understand my comment how M/Soft was making money by installing monitoring equipment on my machine. I was merely answering his question. That's all I did, and I tried to keep it in a humorous vein. I wasn't trying to be sarcastic or cutting. Notice my smilie at the end of the post? Don't take your own opinion so seriously.

I just installed and ran the "WGA Removal Tool". All seems well and I'm very content now. :)

I understood your comment perfectly. Apparently you didn't understand mine. Microsoft has made absolutely no money off YOU by using WGA. Period. Nor will they in the future. Take a look at your checkbook - you won't seen any WGA fee paid. Nor did Bill use your credit card. Nor did he pilfer your petty cash. Nor is he panhandling for "donations".

Shelly stated it perfectly in his post #27, item 2. If in exercising their rights, they earn additional income, so be it. But as I said before, it won't be your money. Your an honest person - you already paid for your OS's.

But since you're an honest person, what I don't understand is your seeming willingness to protect petty thieves (software pirates) from paying for the OS as you, an honest person did. And by logical extension, it seems that you may actually condone software pirates having full, free access to all new updates, upgrades, and security protection for pirated MS software, just so Microsoft doesn't "make more money".

>I was merely answering his question. That's all I
>did, and I tried to keep it in a humorous vein.

Really? I missed the humor, not to mention the relevance of your comment: "After all, Jim, why don't you volunteer to donate a few hours every week to work around Microsoft's office in Redmond for free, just to show your good will? Maybe empty waste baskets, water the lawn, etc. Why, I am sure that Bill would be grateful for the free labor. After all, he wants us to provide free security checks on our computers so M/Soft can make more money."

Jim.

Quote:

But since you're an honest person, what I don't understand is your seeming willingness to protect petty thieves (software pirates) from paying for the OS as you, an honest person did.

You can't be serious? This will not stop 'petty thieves' one bit.

And lets not forget, its MS's problem that they are unable to manage their software, not mine.

And Shelly, this is certainly MS' software. And they are well within their right to protect said investment. To a point. What is also just as certain, is that this is my computer, and I, have the only and final say of what goes on it, not Bill.

What I"m glad to see though is that this issue is only growing. More and more I'm seeing mainstream/online media with WGA stories.

The latest...

http://news.zdnet.com/2100-3513_22-6083204.html

Quote:

You can't be serious?

Of course, I'm serious.

Jim.

I owe you nothing. I answered your misinformed posts with specific reasons of why you were wrong. It appears you are more interested in joining the bash Microsoft and Gates nuts than in having any serious discussion of facts.

If the word bullshit offends your tender sensibilities, you are in mortal danger here. I think I write pretty clearly and I use specific words that fit the situation. The drivel in your posts that I replied to are reminiscent of the kind of thing I would expect to hear from a barstool philosopher in any saloon in America after several drinks.

Right or wrong, you didn't answer my specific points.

I'm sorry Doc, but I saw no points to answer in your post. You complained that your copies of MS software did not pass even though you paid for them. What am I to say? Your question should be directed to MS. All I know is that thousands of counterfiet copies of software are sold to honest people every day, who have no reason to suspect the software they purchased. Only MS can tell you why your programs failed to pass, and if they don't have a reason, they will surely rectify your problem. I can't help you, and any sympathy from me will not help you.

Actually, I called Microsoft. I was bounced around to three different people. The last one was really nice and stayed with me for about an hour. He could not explain it. And, he couldn't help me either. And, the newest version of this crap software made no change. Neither does an even newer version not widely released yet. Microsoft can't help me, who can? The pirates have already gotten around the newest version that isn't in wide release. The only ones getting hurt are the honest people where this crapware fails. I know I have been hurt. I have spent over 12 hours trying to get this idiot-ware to work right. :bs:

And if you are thinking I pirated this, forget it. All my software is 100% legal. The Windows installs in question came from the factory preinstalled.

My suggestion would be for you to perform a Repair Installation of Windows, and see if that solves the problem. Pre installed software id copied at high speed to a drive from a master copy. Who knows what small glitches might occur during the process?

That's what Microsoft told me to do. The problem here is the Toshiba doesn't have a regular XP disc. It has a recovery CD that effectively wipes the drive and restores the computer to purchased conditioned. It will not do a repair install. The files are stored in a Ghost 2003 format behind a password which I don't have. So, I can't create an XP disc from the recovery disc.

If 2 Dell's and a Toshiba are doing this, I doubt it is a problem with the way the machine was created. I manage 19 XP machines at work, 3 at home, 1 for the local users group, and any that I help people with. In that small percentage of machines, what are the odds that I would run into 3 different models of computers from 2 different manufacturers with XP installed that all have this problem where an XP installation didn't get installed correctly in the exact same way? The common denominator is the WGA Notification update (KB905474). Occam's razor would say it is the WGA software not the Windows installation.

The odds are steep, but turn that around, most of the worlds 200+ million XP PC's have no problem with the update, what are the odds of one person having three machines that all have a problem? It is most likely some program that you installed on all three machines that corrupted something in the Windows files. Occam's razor cuts both ways! That is why a repair install could fix the problem on all three machines.

Many, if not most, computers that have those damnable worthless recovery disks also have the windows installation files tucked away somewhere on the hard drive.

I think all this stuff about Bill making money throws up all off. The oil companies can also charge whatever they want because it's their business and, like it or not, if you want what they or Bill has to offer you can buy or not.

What ticks me off is that WGA reports back with so much more info (and has the potential to report back with even more in the next update of that program) than is necessary for the protection of the MS product. I wouldn't necessarily object even to MS turning off an unauthenticated OS from headquarters.

But, as it is, WGA is unequivocally SPYWARE by almost any standard and coming from the world's biggest software company rather than from dinky fly-by-night software company, it is a chilling developement. The rationale that it's being intalled voluntarily (unlike other so-called spyware) is hokum. We (and all the spyware companies) know that practically no one reads the EULAs and the limits of the transmitted data are not clearly defined anyway.

It is unfathomable that we can defend the MS position with the thought that they're simply defending their intellectual property.
Yes, we're renting Bill's property but I think we have a little right to privacy in using it.

Actually, you have no personal knowledge of what if anything is reported back to MS, so you are just engaging in speculation. With over 200 million computers being checked frequently by WGA, MS would ned to double their staff to be able to use mountains of data. WGA does what it is designed to do, look for known pirated versions of MS programs.

Actually that has been disclosed.
One needs to decide (I suppose learn first), whether that information is of importance.


"Q: What information is collected from my computer?

A: The genuine validation process will collect information about your system to determine if your Microsoft software is genuine. This process does not collect or send any information that can be used to identify you or contact you. The only information collected in the validation process is:

* Windows product key
* PC manufacturer
* Operating System version
* PID/SID
* BIOS information (make, version, date)
* BIOS MD5 Checksum
* User locale (language setting for displaying Windows)
* System locale (language version of the operating system)
* Office product key (if validating Office)
* Hard drive serial number"

Suprised they don't log your NIC (MAC address).

There's always the chance that the OS's you paid for were pirated copies, no matter the reputation of your supplier. I understand that those copies are virtually impossible to detect.

That said, I can't understand the need to continuously monitor installs that have been checked and found to be good. It's enough, IMO, to do it at update time.

MS even has a forum for WGA ...

Quote:

Windows Genuine Advantage Talkback

WGA Validation Problems
Genuine Benefits
Feedback and Comments

http://forums.microsoft.com/genuine/default.aspx?siteid=25

What am I missing? I have the option of installing WGA from Window's Update. I just never chose to install it. Not because I don't have a genuine copy of Windows.......I have an OEM from Gateway. Why did everyone install this? I go through all the updates and decide for myself if I need them or not. For example, if it's an update that addresses a specific error and I have never gotten that error, I don't install the update, etc. I didn't think I needed the tool so I never installed it.

Supposedly this comes in through Automatic Updates. Some people let Automatic Updates do a full non-supervised automated update. It also shows up as a Critical Update; so, you think if it is Critical you need to install. I just love how the honest users have to pay for the dishonest ones. Shouldn't it be the other way around?

Without it you will not be able to download certain updates and programs, like Windows Defender. I doubt that they will ever withhold security updates, since they are in Microsoft's interest too, but new versions of Media Player, etc could well be unavailable to you without verifying that your Windows program is legitimate. Why should they be expected to upgrade stolen software?

There are many people who unknowingly were sold bogus software from sources they would never suspect, and have no reason to believe their program is illegal. MS is not interested in making trouble for them, but they want to find the crooks who are selling illegal software in quantity. That is why MS has been replacing illegal microsoft programs at no or little cost to people, if they will simply tell MS where they got it.

Actually, the latest released version blocks everything on Windows Update site (I know because I saw it last night); but, the Automatic Updates still pull the High Priority Updates down.

Quote:

update gives you two methods of installation. The "Quick" "Express", & the "Custom". (I probably have the names wrong).

Anyhow, I have always used the Custom.

...

The Quick option gives no indication of what is being installed.

What I don't understand is, who in their right mind would blindly install a program, without having the faintest idea what it does, or what it is for?

http://www.pcqanda.com/dc/dcboard.php?az=show_topic&forum=2&topic_id=369964#370066

I've done that a few times, but only because I wasn't sure what the program did, or what it was for...

I always use Custom; (obviously I have Automatic Updates turned off) and so far have not installed the WGA tool. As Shelly said, I may need to. I don't install updates that don't apply, e.g.,there is one concerning the Windows firewall. I have WF turned off, so I see no reason to install the update. Another refers to a problem with certain antivirus software. I haven't had the problem so have not installed the update, and so on. I also try to check the posts here before I install updates.:7

If it really bothers anyone, it can be removed.

http://www.firewallleaktester.com/removewga.htm

Terry

Aye, was just about to post this...
http://www.theregister.com/2006/06/22/wga_remove/
Looks like they are getting hammered the world over right now though... Website down for maintenance...

Would like to capitolize that I'm not the only one with the following view:
That said, FirewallLeakTester pulls no punches about its view of WGA. Once the tool has validated a copy of Windows, it says, “there is no decent point or reason to check it again and again every boot.”

What I'd been saying from the begining. MS should only need validated the OS once.