WgaTray.exe (Windows Genuine Validation)

Apparently Winpatrol does not list this file at startup:

Quote:

---

Wednesday, May 31, 2006
WgaTray.exe opens security hole

It’s called Windows Genuine Advantage. I’ve received a couple Emails about the file WgaTray.exe which was part of this weeks Windows Update. Some questioned how this file was able to run on startup but isn’t listed by WinPatrol or other programs as an AutoStartup program.

Well, the answer is simple; this program is part of the Windows Operating system. After Windows starts it looks for this file in the system32 folder and runs it. Unfortunately, there’s a serious problem in with the way how Microsoft has implemented their anti-piracy system. The way Windows handles this file opens up a big security hole that most programs won’t plug. Any malicious program can delete the WgaTray.exe and replace it with its own malware using the same name. Windows does nothing to verify this program before running it the next time you reboot.

Microsoft describes this program as follows: "By using genuine Microsoft software, you can be confident that your software is legitimate and fully supported by Microsoft.” As if “you” didn’t already know. More information can be found at http://www.microsoft.com/genuine/default.mspx and http://www.microsoft.com/genuine/dow...yValidate.aspx

You can also find a discussion at Broadband Reports.com http://www.dslreports.com/forum/remark,15963038 The topic of the discussion is more about flaws in Windows piracy then security. If you have your system set for auto-updates the newest version of WgaTray.exe will have been downloaded this week.

---

BillpStudios Winpatrol

OoOo!

This is *almost* as good as Sony BMG's anti-piracy "rootkit". :rolleyes:

Way to go m$!

Does anyone know under which account the program is run? Logged on user? System?

I don't have a machine to play around with at the moment.

Or, should I more accurately say, I don't have a machine I've let this program get installed onto at the moment.

I saw it when I installed, didn't think much of it. It wants to connect to the internet every time you boot you machine. Sygate picks it up. I beleive it runs as a system. I'm not sure though. I don't use user accounts just admin. I know big fault :P

AFAIK it runs as "system" which is what makes it a relatively "dangerous" vulnerability, given that it is apparently not protected in any way.

I must admit that I am rather confused and disappointed by Microsoft with their latest WGA/DRM activities. Please do not misunderstand me; I have no objection to a corporation defending its commercial/intellectual rights or whatever, so long as they do it PROFESSIONALLY.

What irritates me is that this is being done at the expense of legitimate, honest, bona fide customers. :mad:

What is the merit in telling me that my version is "pirate" just because my CMOS battery is flat, or I happen to be testing month end or year end processes/applications...........like you are SUPPOSED TO DO before rolling them out?

Most AV and anti-malware vendors attempt to provide some protection against their software being crippled or taken over................MS don't even seem to have given this a second thought?

As I see it, there are so many pirate copies of XP out there, MS are p1$$ing into the wind at this stage. Whatever they do is bound to get circumvented because the pirates are well ahead in the game.

I would have thought that they would be far better occupied in channeling this resource into Vista, and getting their DRM to work so that it does not inconvenience genuine customers.

Hey, hands up, I have designed a fair bit of crap in my time, but this is starting to look sloppy and out of control?

Just my thoughts

:)

i second that Nihil
*raises hand*

I found when it was installing after downloading the update, that it wanted to call home during the install.
I figured that it wanted to download more necessary files, so i allowed it.
Now i've noticed that the one machine i allowed it to install on, takes a hell of a long time to shut down or boot up.
And before it was installed, it was quick to boot up, and shut down. :(

I wonder if Ms can get in trouble as this would come under antitrust or something like that.?

f2B

Not antitrust, nothing really infringing on privacy of the user or anything, there may exist some risk of getting a bootlegged copy of the OS without knowing it. I don't know. Certainly kind of a wierd grey, um, gray area.

"I wonder if Ms can get in trouble as this would come under antitrust or something like that.?" -front2back

M$ looks out for itself pretty good in the EULA...Unknowing to most users, after they agree to the terms in that harmless looking little dialog box, M$ has the legal authority to do just about anything they please; patch deployments, "feature enhancments", bug fixes, data collection, ...ect

<rant>

I mean come on now...Who has the time and legal knowledge to read such things. Just like in running unaudited binary code, there's certain legal and privacy risks when agreeing to the terms...Legal voodoo sentences like:

"Microsoft reserves the right to change the terms and conditions without prior consent and knowledge at any time without notice."...

</rant>

I mean you cant really blame M$ for wanting to protect their products and make a buck. After all thats what it's all about. Who cares about quality software anywayz?... :)

By the time everyone realises they werent kidding when they said, "Total Information Awareness" it will be too late.

[ oh right, the Windows Genuine Advantage thing ]

Wouldnt this have not been an issue if Windows File Protection was enabled by default?

Here's another thought I have about this whole thing. MS constantly says that what it wants to do with this is to stop casual piracy, not the dedicated pirates. I think this last effort pretty is their last ditch attempt to stop casual piracy, because to crack this one, you have to commit a deliberate action. Just re-installing Windows with a different key doesn't work anymore. Therefore, anyone still having a pirate copy of Windows XP after a few months of rolling out this patch is an active pirate and can be prosecuted without arousing sympathy. MS's way of getting out of the way the record labels got blackballed by the internet community maybe?
Cheers,
cgkanchi

I mentioned something not too long ago about WGA... and how much of a headache it can be.

ARTICLE

Not sure if any of you have had a similar experience as mine, (in a nutshell story) I was doing some work on a server, and each time I replaced some hardware on it, WGA kept asking me to reauthenticate my copy of Windows. Even though my copy was legitimate, it locked me out of my production server saying I had reauthenticated too many times. M$ would not assist me in resolving the issue. They wanted me to pay something like $35 a call to their Tech support to resolve a problem I did not create!

Anyway... some google searches led to several other frustrated people.... and I remember reading something about a file called "AntiWGA" *cough cough buuurp*

Sorry... hairball.

Found a torrent for *cough, cough* antiwga.exe *cough, cough* but it seems the...ahem...tracker can't find some place called "Pirate Bay".

Anybody know the way to Pirate Bay?

How 'bout San Jose?

SEATTLE - Microsoft Corp. acknowledged Wednesday that it needs to better inform users that its tool for determining whether a computer is running a pirated copy of Windows also quietly checks in daily with the software maker.

http://news.yahoo.com/s/ap/microsoft...JlYmhvBHNlYwM-

Any wonder spyware is so extensive on PC's when the prevailing ethos among industry leaders is to sneak around inside your PC?

Have you tried just renaming WgaTray.exe in WgaTray.bak or something like that. Then it won't load the annying icon but there are no registry entries for it. I wonder if that would negate the risk it creates.

Hmmmmm,

"Pirate Bay" is in Denmark.................the Danish cops closed them down the other day at the request of the MPAA.

Eyecre8 Yes, that is a familiar story and what really makes my blood boil. If you replace a motherboard MS consider that to be a new machine, unless it is to repair a defective one (you don't need any great skills with an engineering hammer to make that true :D ) This applies to OEM licences.

In the past I would just ring them up and get a number to reactivate the box..............I don't trust them to write competent DRM software so I avoid it where possible.

There are a number of obvious flaws with the WGA software:

1. It will report a dead CMOS battery as pirate software.
2. It will report a deliberate system date setting more than 24Hrs out, as pirate software.
3. It will lock a system based on the number of reauthentications AND reactivations...........even if it is a commercial version!
4. The WGA program cannot differentiate hardware replacements that are permitted, and those which are questionable. Even though they are stated in MS's EULA :rolleyes:

All in all, not something that would give me confidence to rush out and buy Vista.

:(

I found THIS link on abcnews.com about that stupid anti piracy tool of M$. just for yall's info. I like to keep people informed. :p

Quote:

---

"Really what you're talking about is someone saying, 'Look we've put something on your computer and it might go screwy, so we're going to kind of check in every day,'" he said.

---

Exactly my point about Vista :rolleyes:

Johnno, do your realize your inching closer and closer to 10,000 Posts.... that is insane! :)

10 print "This is genuine microsoft software honest!!"
run

compile WgaTray.exe

copy wgatray.exe / %windir%

mwahahahahaaaaaaaa hahahah aha hhha aaaaaachooooo !"!

Quote:

---

All in all, not something that would give me confidence to rush out and buy Vista.

---

Unfortunately, it's the customers who will be rushing out and buying Vista. I'll probably be using Vista whether I like it or not.

Quote:

---

That information-gathering is disclosed in a licensing agreement. But the agreement does not make clear that the program also is designed to "call home" to Microsoft's servers, to make sure that it should keep running.

---

What a wonderful business model...

Hi brokencrow ,

My emphasis was on the "rush" aspect, I would hang back a while and let the dust settle.

I would guess that MS will release the corporate version(s) first and try to time the home and SOHO for the Christmas rush? A lot of these will be bought in cut price stores, so I won't see them for a year?

That would be a good thing IMO because corporates would give it a thorough testing before deployment and the small guys will get the benefit.

:)

How many versions of Vista is MS planning, nihil?

We looking at the Home/Pro model again? Or something even more varied?

Hi there brokencrow ,

Last I heard there were going to be 6 plus a couple to comply with European anti-trust regulations.

I am guessing here:

1. Dumbed down version for low spec machines
2. Home vanilla flavour
3. Super home
4. SOHO business
5. Corporste
6. Corporate server

Or something along those lines?

Here is a link to see if your current box can be upgraded to Vista..

Getting Ready

And this link is information on the beta..
Vista Beta2