The Windows Genuine Advantage Validation Tool enables you
to verify that your copy of Microsoft Windows is genuine.
The tool validates your Windows installation by periodically checking
the Windows Product Identification and Product Activation status.

Signature
Carey Frisch
Microsoft MVP
Windows - Shell/User
Microsoft Community Newsgroups
news://msnews.microsoft.com/
-------------------------------------------------------------------------------------------
| After visiting Windows Update and downloading a new version of Windows
| Genuine Advantage, all of a sudden WGA program keeps wanting internet
[quoted text clipped - 14 lines]
| Joe
| XP Pro SP 2 - IE7 Beta 2 - WMP 11 Beta
Joe727 - 24 May 2006 21:44 GMT
I understand what it does and it's fine by me. However, checking everytime
I reboot is more than periodically, don't you think?
Joe
> The Windows Genuine Advantage Validation Tool enables you
> to verify that your copy of Microsoft Windows is genuine.
[quoted text clipped - 19 lines]
> | Joe
> | XP Pro SP 2 - IE7 Beta 2 - WMP 11 Beta
Bert Hyman - 27 May 2006 21:08 GMT
In news:edDpvh2fGHA.764@TK2MSFTNGP03.phx.gbl "Carey Frisch [MVP]"
<cnfrisch@nospamgmail.com> wrote:
> The tool validates your Windows installation by periodically checking
> the Windows Product Identification and Product Activation status.
1. Why would it need to do it "periodically"? Will the status of a
verfied system somehow change from boot to boot?
2. Why does it try to phone home every time I boot my system? What's it
sending back to Microsoft?

Signature
Bert Hyman St. Paul, MN bert@iphouse.com
Jeff - 27 May 2006 21:43 GMT
Ah,
A very touchy subject for MS!
They try to legitimize their own use of "Spyware" by saying that customer's
asked for this"service". I assume you are speaking of KB905474.
This little program exhibits MS own Definition of "Spyware". And to
prove that fact; I would refer you to MS own anti-spyware site
http://www.microsoft.com/athome/security/spyware/software/msft/analysis.mspx
for further review.
KB905474 exhibits many of the characteristics that MS itself says is
"Spyware"
Not the least of which are:
1)Initiates an outbound connection (modem, Internet, etc.) without user
consent
2)Fails to provide Help information for uninstalling the program
3)Fails to use standard install/uninstall features, such as Add/Remove
Programs
4)Uses deceptive prompts to entice users to download or install software.
#4 Specifically being that MS bundles this little program in with "High
Priority" updates;
and it's name is deceptively similiar to Windows Genuine Advantage
Validation tool;which in itself does not initiate an outbound
connection;although still unable to be removed(easily)
The only "high prority" to this little program is to MS bank accounts. Some
MVP's in here; I believe;work for MS itself;the way they spout MS rhetoric.
You don't need this program at all.
I could go on and on-already have actually;check out this forum from MS:
http://forums.microsoft.com/genuine/default.aspx?siteid=25
They get around the issue of user-consent very deceptively;by bundling this
with "high priority" updates.
And many people assume that since it's "high priority" they just
automatically download it. BINGO-user consent!! Let Carey rant about
this-however; the simple fact is-it is spyware!!!
Jeff
>> The tool validates your Windows installation by periodically checking
>> the Windows Product Identification and Product Activation status.
[quoted text clipped - 4 lines]
> 2. Why does it try to phone home every time I boot my system? What's it
> sending back to Microsoft?
Carey Frisch [MVP] - 31 May 2006 03:15 GMT
When you boot your computer, a check is performed to see if
it has been properly activated and the Product Key is indeed
a genuine Product Key and not one reported stolen. Stolen
Product Keys are added daily to the WGA service and are
primarily Volume License Products Keys sold only to
corporations and reported stolen.

Signature
Carey Frisch
Microsoft MVP
Windows - Shell/User
Microsoft Community Newsgroups
news://msnews.microsoft.com/
-------------------------------------------------------------------------------------------
| > The tool validates your Windows installation by periodically checking
| > the Windows Product Identification and Product Activation status.
[quoted text clipped - 4 lines]
| 2. Why does it try to phone home every time I boot my system? What's it
| sending back to Microsoft?
Bert Hyman - 31 May 2006 14:34 GMT
In news:##AtZgFhGHA.4656@TK2MSFTNGP04.phx.gbl "Carey Frisch [MVP]"
<cnfrisch@nospamgmail.com> wrote:
> When you boot your computer, a check is performed to see if
> it has been properly activated and the Product Key is indeed
> a genuine Product Key and not one reported stolen.
Then what was the purpose of "Windows Genuine Advantage Validation Tool
(KB892130)" which I installed back in early March?
Why do I now also have "Windows Genuine Advantage Notification
(KB905474)"?
And again, why does this "tool" have to be permanently installed on my
system, run every time I boot and attempt to connect to a Microsoft
system?

Signature
Bert Hyman St. Paul, MN bert@iphouse.com
> After visiting Windows Update and downloading a new version of Windows
> Genuine Advantage, all of a sudden WGA program keeps wanting internet
> access.
> ... I don't find it in msconfig, nor in the 'run' part of the
> registry.
msconfig won't show all locations of startup items. It shows the Run
keys in the registry, those in the Start menu, and maybe those in Task
Scheduler (configured to run on Windows startup, available in Windows XP
but not, say, in Windows 2000). You might want to use AutoRun from
SysInternals to see what all items will be loaded on startup and on
login.
Microsoft still wants to hide some startup stuff, especially items that
non-expert users probably shouldn't touch.
> Question 1 - how do I disable WGAtray.exe?
Read
http://www.mydigitallife.info/2006/04/26/disable-and-remove-windows-genuine-adva
ntage-notifications-nag-screen/.
Personally, I use DiamondCS ProcessGuard to regulate what can load into
memory, and I have it block wgatray.exe. It attempts to load twice on
Windows startup (as noted when I prompted to allow rather than just
block it). The ActiveX control used by the Windows Update site doesn't
use it so you can still authenticate at that time to get updates.
> Question 2 - why does it keep needing internet access?
That is why many have referred to the new "feature" as spyware.
Microsoft is yanking info about you. Of course, the assumption (true or
false) is that what they yank is benign and never specifically
identifies you (other than by your IP address). Using the WinLogon
event is a trick also known to malware authors, so I suspect it won't be
too long until a usurper virus comes along that replaces wgatray.exe
with its own evil version.

Signature
__________________________________________________
Post replies to the newsgroup. Share with others.
For e-mail: Remove "NIX" and add "#VN" to Subject.
__________________________________________________
Joe727 - 25 May 2006 00:56 GMT
>> After visiting Windows Update and downloading a new version of Windows
>> Genuine Advantage, all of a sudden WGA program keeps wanting internet
[quoted text clipped - 28 lines]
> to malware authors, so I suspect it won't be too long until a usurper
> virus comes along that replaces wgatray.exe with its own evil version.
Thanks for the info.
It somewhat concerns me that absolutely no information was given about this
update needing what I perceive to be constant internet access before Windows
Update installed it. I have no problem with Microsoft verifying my OSs,
heck, I paid for them - Retail Versions. But, this program seems to be
hidden, which is what caused my concern.
I also agree with your assessment of the future for wgatray.exe. No doubt
it will become a huge problem because of hackers. Why does Microsoft do
this to its paying customers?
Joe