When Windows Genuine Advantage Becomes Genuine Disadvantage

Andy Patrizio learned the hard way that Windows Genuine Advantage can be a disadvantage in disguise and all without any fault of his own. Such cases apparently flies in the face of Microsoft assertion that only a handful of genuine false positives have been identified. Let’s take a look.

Alex from Microsoft asserted - “Of the hundreds of millions of WGA validations to date, only a handful of actual false positives have been seen”. In light of his statement let’s analyse Andy’s case.

Some obnoxious spyware called TrustIn Bar managed to get on my computer, although my antivirus program, NOD32 nailed it immediately.

I went through the removal process, but just to be careful, I poked around the registry to make sure all traces of the spyware were gone.

Huge mistake. On reboot, my computer informed me that my copy of Windows was “not Genuine.” This was news to me since I have the shiny reflective disc from Microsoft, and XP had been running on my computer for several months.

Apparently, WGA has no sense of historical context, like the fact this machine has been running Windows XP for several months. How does a Windows installation run fine for months before suddenly becoming “not Genuine”?

Most likely reason I would think would be that the signature which Windows Genuine Advantage keeps to ensure the copy is genuine has been changed / removed or unknowingly tampered with. This probably happened while he was poking around the registry. That’s as much as I can say without more details. But there is something not right with my above analysis. Can you spot it?

Firstly Andy, from his post, appears to be somewhat conversant with Windows registry to be messing around with it in the first place and not unknowingly deleting anything that smells like WGA. But then it is all speculation and I would have left it at that unless…

Too many people have been reported in the media to be bitten with Microsoft Windows Genuine (Dis) Advantage. Take Paul Thurott for example - “A copy of Windows XP Media Center Edition 2005, installed in a virtual machine, came up with various WGA alerts after I installed a bunch of updates from Windows Update. Screenshots of this machine can be found below.”

Here is another example. and yet another.

Windows Genuine Advantage was sending data daily to Microsoft servers untill everyone and their cousin protested. Now it sends data once in two weeks. Lawsuits were filed seeking class-action status.

BTW: Here’s how you can remove Windows Genuine Advantage Notification Tool.

WGA is necessary for Microsoft to curb piracy. I support their intent but not their method of execution. The reports of significant false positives makes me wonder about the quality of the software.

Overall I think Windows Genuine Advantage program has suffered from lots of bad vibe / karma / press, similar to Sony rootkit fiasco last year. Microsoft’s reponse so far has been in the lines of - it’s a feature not a bug.