DaveClark said:
Hi,
Thanks for the post. I had tried the previous version 1.9.9.1
and it wouldn't work, exactly the same result as the latest
1.9.4.0 from SupremoPhantom. It comes back with the following:-
Extracting LegitCheckControl.dll
Extracting WgaTray.exe
CANNOT CREATE WGATRAY.EXE
Extracting WgaLogon.dll
CANNOT CREATE WGALOGON.DLL
Extracting WGASetup.exe
I closed all browsing windows and programs as instructed.
Do you think trying it in Safe Mode would work.
I still need help and an answer to my previous post re "time left etc"
I suggest that you remove your hard drive and connect it as a secondary
or slave drive on another XP system.
That will allow you to
a) scan the drive for malware, trojans, viruses
b) access certain files and delete them, replace them with
alternate versions, or alter their permissions
I don't have a lot of experience in this, as I've not yet been stuck
with a system that's failed the WGA check.
You'll have to do some legwork on your own, really the only way is to
move your hard drive to another machine where you can access the files
and experiment with it.
The files that you'll be messing with are:
legitcheckcontrol.dll
wgatray.exe
wgalogon.dll
There are two basic strategies for dealing with those files:
1) replace them with hacked or cracked versions you find on the net.
Note that a second copy of them will probably exist somewhere
else, like dllcache directory, so when doing a file search
be sure to enable all search options (system and hidden folders,
etc)
2) modify their permissions (specifically the run or execute
permissions) so that they can't function.
With regard to (2), here are the details:
----------------------------
Set READ permissions only (remove execute) for the wgatray.exe and
wgalogon.dll
Browse to %systemroot%\system32 (ie c:\windows\system32). If you've
slaved your drive to another system, then your problem drive will most
likely be D: so go to d:\windows\system32.
Right mouse click on wgatray.exe, select properties. Select the
security tab. Disable simple file sharing. Click the Advanced button.
Remove the check-mark in the "inherit" box. Put a check-mark in the
"Copy ..." box. Modify each user (including SYSTEM) to have READ
permissions only (List Folder/Read Data, Read Attributes, Read Exteneded
Attributes, and Read Permissions check boxes). You want to remove the
check in the "Execute" box.
Perform the same steps as above for wgalogon.dll.
If you search the internet using terms like WGA and WGATRAY.EXE or
WGALOGON.DLL you'll find other instructions, like these:
-----------------
These are the steps in more details:
1) First backup your system to ensure you can get back to the system in
its current configuration.
2) Open the process list in task manager: ALT+CTRL+DEL, Task Manager,
Processes, sort the list by Image name (click on the column header) to
locate WGATRAY.EXE. Select this process and right click select “End
Process” and confirm.
3) Click Start, Search, Files and Folder enter WGATRAY.EXE as the file
you want to delete. Find the file and delete it. Empty the recycle bin.
If you have system restore on it may restore the file, turn off system
restore in Control Panel, System if required.
4) Check that the WGATRAY.EXE program is deleted and not running, just
to make sure you have removed it successfully!
5) Run Regedit (Start, Run, Regedit)
6) Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows
NT\CurrentVersion\WinlogonNotify. Delete all references to WGATRAY.EXE.
Be careful only to remove the sections for WGATRAY.EXE
After this you will still see the nag screen before you logon. Even if
you have auto login set up the nag screen will appear. This is because
the Windows Login process is calling the WGALogin DLL. This DLL also
start up the WGATRAY.EXE when boot. To stop this remove execute
permission to the WGALOGIN.DLL file. With execute permission denied; the
nag software will not start.
Before you can rescind execute permission you need to turn off Simple
File Sharing. To turn Simple File Sharing on or off in Windows XP
Professional, follow these steps:
1) Double-click My Computer on the desktop.
2) On the Tools menu, click Folder Options.
3) Click the View tab, and then select the Use Simple File Sharing
(Recommended) check box to turn on Simple File Sharing. (Clear this
check box to turn off this feature.)
Now we can rescind execute permission: Right click the file WGALOGIN.DLL
in your Windows System32 folder in Windows Explorer and open the
Security Tab. Press “Advanced”, clear the Inherit checkbox, Click the
“Copy” button, then Press OK. Select each listed user/group and remove
the "Traverse & Execute" permission for the use/group. Finally Press OK
to apply the permission changes and close the file properties dialog.
Restart the machine.
You can now turn "Use simple file sharing" back on, and system restore
if required.
The text message for the file permission varies in different versions of
Windows even for the same language. There are various release of
Windows, Home, Professional, and several release of each all slightly
different: Your milage may vary!
