Hacker's Adda

The fix works a treat.

1.C:Documents and SettingsAll UsersApplication DataWindows Genuine Advantagedata

inside you will find a file called Data.dat open that file with notepad and
delete all the stuff in it… now save the file and set it as read only and restart pc but in SAFE mode ** Yes, this step is required ** ** Will NOT immediately solve problem until rest of steps completed **



Now go to c:windows system32 folder: MUST be in safemode

wgalogon.dll ** You CANNOT delete this file. RENAME it to wgalogon.bbb ***
spmgs.dll ** This is a spelling error. File is actually spmsg.dll. RENAME it to spmsg.aaa **
wgatray.exe *** DELETE this file ***


Now go to C:WINDOWSSoftwareDistributionDownload and DELETE the following folder



6c4788c9549d437e76e1773a7639582a



REBOOT & all should be resolved








End the process wgatray.exe in Windows TaskManager and restart Windows XP in safe mode. Now delete the following files:

Delete WgaTray.exe from c:\windowss\ystem32
Delete WgaTray.exe from c:\windows\system32\dllcache



Start Windows Registry editor and delete the folder "WGALOGON" located in the following location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\WinlogonNotify. Delete all references in your registry to WgaTray.exe

Another alternative suggest that three files are installed Windows XP System Folder:

\WINDOWS\system32\WgaLogon.dll
\WINDOWS\system32\WgaTray.exe
\WINDOWS\system32\LegitCheckControl.dll

The wgatray.exe process makes the check for genuine windows software. You can disable WGA by removing the execute bit on WgaLogon.dll. That way, winlogon can't call it as a notification package at boot, and since WgaLogon is responsible for running and maintaining WgaTray.exe, no more tray popups either.

To change the execute bit of WgaLogon.dll, first turn off Simple File Sharing. Now right click the file in Windows Explorer and open the Security Tab. Hit the Advanced button, uncheck the Inherit box at the bottom, hit the Copy button, then hit OK. Go through each listed user/group and remove the "Read & Execute" permission for that file, leaving the "Read" permission as-is.

Hit OK to apply the permission changes and close the file properties dialog. Restart the machine. You can now turn "Use simple file sharing" back on, if you want.

A third alternative posted on the internet suggest that users clear the content of file data.dat located in the following directory:
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage\data

Posted in HT-Windows Xp , Operating System , WindowsHacking