How to Remove Windows Genuine Advantage Notifications

Windows Genuine Advantage (WGA) notifications occur when your computer hasn't passed the validation test. The validation test can be failed because you installed a pirated non-genuine copy of XP, or because you have changed your XP product key to a software-generated key, or sometimes it just happens for no reason at all. Here's how to get rid of the annoying notifications.

 
Method 1: TASK MANGER

1. Run as an administrator with no other user accounts running.
2. Launch Windows Task Manager (Processes). Leave it open.
3. Navigate to to C:\Windows\System32, and find WgaTray.exe.
4. Right-click on WgaTray.exe, and select Delete. Leave the deletion confirmation box open.
5. Go back to Windows Task Manager and click Wgatray.exe.
6. Click End Process. When you are prompted for a confirmation to terminate the process, align the “End Process” confirmation box with the previous “Delete File” confirmation box, or at least have them close together. Do this because you'll need to do both actions quickly — at least within 2 or 3 seconds.
7. Click Yes in both boxes, quickly. Click on Yes on the Task Manager prompt (to “end the process”) and then quickly press Yes on the deletion confirmation (to delete the actual file). You’ll need to repeat this if you miss it.
8. Launch the Registry Editor. Click Start, then Run, and enter regedit.
9. Browse to the following location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
10. Delete the folder WgaLogon and all its contents.
11. Reboot Windows XP.
12. Check your work. As a precaution, after you have followed the above instructions:
    • Go to Control Panel > Security Center > Automatic Update Settings.
    • Select the third option, “Notify me but don’t automatically download or install them."
    • Click OK.
    • The next time the “Windows Updates” icon appears in the system tray, click on the icon and it will display a list of available updates. Windows won’t automatically download and install them anymore.
    • If “Windows Genuine Advantage Notification Tool” is there, uncheck it and press enter to download everything else (if you want to). You can right-click to “hide updates” that you don’t want.
    • Select “Don’t notify me about these updates again”, so that they will be ignored every time updates are downloaded.
    • Just remember, from now on, make sure to check the list of downloads so that you don’t install any new versions of this “tool”.

Method 2: COMMAND DELETE

1. Try system restore first. If you have only just installed Windows Genuine Advantage notifications, simply using the system restore function will remove the program. Then refuse to accept the WGA update next time Windows updates. Otherwise, proceed as detailed below.
2. Open a Command Prompt window. Click on Start, then Run. Type CMD and press OK.
3. Change Directory into the System32 Folder. Type "cd \windows\system32" (without quotation marks).
4. Open Notepad window. Type the following lines:
   
   taskkill -IM wgatray.exe
   
   del wgatray.exe
   
   del wgalogon.old
5. Highlight and copy the three lines above to the Clipboard.
6. Paste the contents of the Clipboard to Command Prompt. This should kill the wgatray.exe process from the Taskbar and immediately delete both files wgatray.exe and wgalogon.dll.

Method 3: EXECUTING A BATCH SCRIPT

1. Right-click on your desktop. Choose New, then Text Document.
   • Enter the name as "remove.bat" without the quotes.
   • A message should appear saying that you are changing a file type. Click Yes. If the message does not appear, and the file icon is a picture of a piece of paper, then you need to enable "show file extensions for known file types" in the Windows Explorer Tools ->Folder Options dialog.
2. Right-click on remove.bat and select Edit. Notepad will open.
3. Paste the following lines into Notepad, then save and exit:
   
   taskkill -IM wgatray.exe
   
   del wgatray.exe
   
   del wgalogon.old
4. Double-click on the remove.bat icon. A command prompt window should briefly appear, then close automatically.

Method 4: SYSTEM TOOLS

1. Open System32 by either of the following methods:
   • Click Start, then Run. Type "system32" (without quotes), and click OK.
   • Find system32 manually by clicking Start, My Computer, (C:) (or whatever your drive letter is), WINDOWS, then system32.
2. Hide extensions. In system32, go to Tools, then Folder options. Click on the tab, View, and uncheck "Hide extensions for known file types" if it is not already.
3. Check to make sure the window that comes up has a full screen of various files. The files are in alphabetical order, which makes it easier to locate the specific file.
4. Find WgaLogon.dll. Rename it "WgaLogon.dll.bak" (without quotes).
5. Create an empty copy of WgaLogon.dll.
   • Right click on a blank space in system32 and select New, then Text Document.
   • Leave the text document empty and label it "WgaLogon.dll" (without quotes). Press Enter (on your keyboard).
   • You may get a warning from the above step that says, "If you change a file name extension, the file may become unusable. Are you sure you want to change it?" Click Yes on this warning.
6. Be ready to complete the next two steps very quickly.
   • Find WgaTray.exe in system32 and delete it.
   • You will then have 5 seconds to find WgaTray.exe in the Task Manager.
   • Note that if you remove the files mentioned above while you are in Safe Mode, the next step is unnecessary.
7. Immediately open Task Manager. You can do this three different ways:
   • Press Ctrl, Shift, and Esc simultaneously.
   • Press Ctrl, Alt, and Delete simultaneously.
   • Right click the Taskbar and select Task Manager.
8. Click on the process tab and select WgaTray.exe. Click on End Process.
   • Note that if you take longer, do not panic! All that will happen is that WgaTray.exe will keep reappearing in the processes list (i.e. you won't be able to delete it as required). To remove the notifications after this, return to system32. You will find two files:WgaLogon.dll.bak (the one you renamed) and an Application Extension (0KB) called WgaLogon.dll. Delete the Application Extension, rename WgaLogon.dll.bak to WgaLogon.dll and repeat the process at a greater speed, from deleting WgaTray.exe from system32.
9. Restart your computer when finished. All the notification messages should be gone.

Method 5: RENAMING

1. Open a Command window. Click on Start, then Run. Type CMD and click OK.
2. Open Notepad. Click Start, then Run, and type NOTEPAD. Click OK.
3. Type or copy the following lines into the Notepad window:
   
   CD %systemroot%\system32
   
   rename wgatray.exe wgatray.exe.bak
   
   rename wgalogon.old wgalogon.old.bak
   
   rename LegitCheckControl.dll LegitCheckControl.dll.bak
   
   taskkill /F /T /IM wgatray.exe
   
   del wgatray.exe.bak
   
   del wgalogon.old.bak
   
   del LegitCheckControl.old.bak
4. Leave a blank line. Make sure there is a blank line at the end of the text document, right after the last line of text.
5. Select all the text (Ctrl-A) and copy to the clipboard (Ctrl-C).
6. Paste the clipboard into the CMD window. Right click and select Paste, or Press Ctrl-V.
   • This should kill the wgatray.exe process and delete the files it uses
   
   
   TIPS
   
   • You can also rename WgaTray.exe to WgaTray.exe.bak if you can't remove WgaTray.exe from your Taskbar. Press Ctrl+Shift+Escape to do so.
   • You will not be able to use Automatic Updates anymore; instead, you have to manually update them. In External Links, there is a program that will allow you to update any system, regardless of if it is genuine or not.
   • You may need to Find Hidden Files and Folders in Windows to get to System32 manually.
   • This process will only get rid of the notifications, and will not validate your copy of XP. It will remove the timer at the beginning of your XP log on, the white notice on the log on screen, and the annoying yellow star that appears in the bottom right corner of the screen.
   • If you have problems changing files in the system32 directory, you will have to turn off System Restore. Go to "Start" -> "Control Panel" -> "System" -> "System Restore" and check the "Turn off system restore" check box.
   • If you are not using a genuine version you will still receive critical updates.
   • The failed validation installs three types of notifications on your computer: one on the log in screen, one log in timer, and one balloon. It also stops updates from Microsoft and disables your ability to install IE7 and Windows Media Player 11. This solution can get rid of all three notifications, even though you will still not be able to update through Windows Update. You will not be able to download things from Microsoft that requires a valid license either.
   • If task manager processes are moving, click the title of the "image name" row to freeze them.
   • In case WgaTray.exe cannot be deleted, you need to do the following steps: go to Task Manager, click on WgaTray.exe then End task. In the screen that pops up do not click Yes yet. Go to System32 and delete WgaTray.exe with SHIFT+DELETE. Do not click yes on the pop-up screen where you are asked if you really want to delete. Now arrange the two pop-ups very close. Very fast (within 1 second) click yes first on the first pop-up, from Task Manager and then click yes in the pop-up from delete. WgaTray.exe is gone. If it doesn't work (you receive an error), try again, faster. It should work at least for WindowsXP.
   • This is not required for systems older than Windows 2000, as older versions of Windows do not have WGA installed. This list includes Windows 3.1, 95, 98, NT 3.51, and NT4. (WGA now installs for Windows 2000 searching for the most commonly used pirated keys.)
   • If you don't have a genuine version of Windows, it's better to get it because you will be eligible get non-critical updates, IE7/8, and Media Player 11.
   
   WARNINGS
   
   • If you modify the wrong file, you may crash your computer. This can be resolved with a reinstall in the worst case scenario, but if you are new to computers make sure you have a method of reinstalling without loosing your data before you attempt this. A disk image of your system partition and keeping your data on a separate partition is the ideal way of achieving this because of the speed of restoring an image. You can find instructions on drive imaging and reinstalls on here.
   • Do not edit anything but what is told in system32, or it could cause system start up failure.