WgaLogon.dll

grubbymitts · 26-04-2006, 21:30

This morning (26th April) my PC flashed up the little update shield in the tray. It said updating - 10% and then disappeared. Hmm, methinks, so I went to the Windows update page and it appears that Microsoft were sending two out of course updates. One was the Windows Genuine Advantage tool and the other was a security update.

So I downloaded them both. Now, I know that this XP is legit as the machine is a Compaq Presario that I bought from PC World last August with XP Home SP2 on it.

I check Hijackthis as I always do everyday just before I turn the PC off and notice this little entry added:

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

Hey up, what's that? I checked online and CastleCops says it is a legit file: Windows Genuine Advantage Logon or something. Everything else on the google search just pulls up loads of Hijackthis posts, but this site:

http://forum.ccleaner.com/lofiversio...php/t4050.html

has an interesting reference on one of the replies to the original poster:

Code:

Wgalogon.dll is showing in your log in the 020 area, this is a genuine Microsoft file (Windows Genuine Advantage)
 but as far as I know it should only appear if you have an illegal or pirated copy of windows, With you having SP2 
installed I'm really not sure why that is showing, its not a threat so nothing to be worried about but you could contact 
MS if you notice any problems and ask why its present in the log.

Blow me if the mighty MS think I'm a doity seafaring buccaneer!

Anybody else share some light? Paul, perhaps?
I have emailed MS, but still waiting for their reply.

Paul K · 27-04-2006, 06:21

Might be that Hijackthis hasn't updated it's files since MS updated WGA recently. It is a legit file though so you might as well ignore the warning for now until Hijackthis updates itself.

grubbymitts · 27-04-2006, 06:31

Well, I ain't got the warning from MS - so WgaLogon must now be an integral part of the legit OS now, and not just something that was put on your machine if it was a dodgy copy.

AndyManchesta · 30-05-2006, 21:44

Hi There

When that quote was made, it was very very uncommon to see WGALogon present in a log and only used in one or two countries but its now been added to all systems as a Anti Piracy measure to make sure the OS is genuine. It's Really nothing to be concerned about

ntl customer · 31-05-2006, 01:13

I would disable it, regardless of whether you have a legit copy or not. It's a drain and consumes resources un-necessarily and even if you have a legit copy, why do you need Microsoft to watch over you all the time like big brother?

You don't have a representative from Dabs coming round to check everytime you print something from your printer to check that it's not been pinched, so why have it on Windows?

---------- Post added at 01:13 ---------- Previous post was at 00:14 ----------

It's a bit tricky to disable and Microsoft have went out of their way to make an "ordinary" user disable it easily, but if you have the right tools and a bit of know-how, it's possible to get rid of it for good. I won't go into methods or how to's here, but it is possible.

grubbymitts · 31-05-2006, 08:33

WGA was updated again today, I noticed. There were reports that some genuine installs of windows were reporting as fakes, so it looks like they fixed it and sent it out on an out of course update. It has very few drains on the system I find. The one that is annoying is the verclsid.exe that checks every file that is capable of being dragged and dropped. This was a security update a couple of months back and it can take up a few resources.

ADd · 06-06-2006, 14:29

Part of WGA, and is legit - however the latest WGAN does phone home everytime you boot up pc.

I've stopped it connecting with my firewall, but when you isit M$ update you will be checked manually by WGA anyway if you choose non critical updates

Note: once WGA is installed in your system, through updates you cannot remove it!!

budwieser · 11-06-2006, 19:03

Quote:

Originally Posted by ADd

Part of WGA, and is legit - however the latest WGAN does phone home everytime you boot up pc.

I've stopped it connecting with my firewall, but when you isit M$ update you will be checked manually by WGA anyway if you choose non critical updates

Note: once WGA is installed in your system, through updates you cannot remove it!!

<<<<<< Oh yes you can.

allanprg · 11-06-2006, 19:18

I had the WGAn on my pc from auto updates. Have since done a system restore and this removed it. Now I have auto updates on notify me first before install and download.