Download From Microsoft Without a WGA Check 195
Anonymous Coward writes, "When you want to download a file from Microsoft, a WGA (Windows Genuine Advantage) check is performed. Microsoft installs a small piece of software on your computer that contacts the Microsoft server and checks the validity of your installed Windows software. If the test fails you will not be able to download the file(s). The following method gives you the ability to download every file from Microsoft without a WGA check."
Correct me if I'm wrong... (Score:5, Insightful)
Re: (Score:3, Insightful)
Re:Correct me if I'm wrong... (Score:5, Informative)
Re:Correct me if I'm wrong... (Score:5, Insightful)
If a company pro-actively pushes code to my machine and effectively forces me to run it, that's releasing a "final version", by any sensible definition of the term.
Now, after the furore when people discovered the dialling-home behaviour MS might have disabled that "feature" in a later version, but that doesn't make the preceeding one a "beta", except in very bad efforts at spin-control or post-facto apologetics.
And I think the point is that with MS pulling shit like this every other month, people are getting increasingly itchy about running any MS apps or utils they don't absolutely have to.
Re: (Score:3, Insightful)
Re:Correct me if I'm wrong... (Score:4, Insightful)
I think it's pretty much taken as read that "updates" should have been tested and approved before release. Either that, or the button should have said "Download all updates and any other shoddy half-finished beta-release crap Microsoft would like to risk fucking up your machine with and wait for my OK before installing them".
The thing is, unless you want to waste hours pissing about trying to get around it you need to have WGA installed to get Windows Updates (well, until this story was posted, anyway).
So, I gave my consent to allowing MS to install "essential updates" to my machine which, given Windows' execrable security record, is pretty much a no-brainer. I have a genuine copy of Windows XP, so although I don't like being treated like a pirate without reason, I also didn't mind running WGA too much.
YMMV, but again my time is valuable - you might have time to investigate every single Windows patch available before oking it, but frankly with the amount of crap wrong with Windows you'd have to be at it nearly full-time to keep up.
MS then used this (perfectly-reasonable) permission to turn WGA into spyware, and somehow it's my fault?
Remember: they didn't exactly shout from the rooftops before slipping this nasty little dialling-home functionality in, did they?
I mean, sure, you've got a point - I was clearly stupid not to decompile every single Windows Update patch and inspect it by hand before installing each and every one one-at-a-time, rebooting and monitoring my outbound network traffic in-between just in case I'd missed any little surprises.
Oh, what a fool I've been.
The point is, either MS were deliberately spying on me (in which case they deserve punishment) or they stupidly pushed non-production-ready software into my machine in the guise of production-ready software, and didn't own up to it until someone else very publically called them on it... in which case they should be punished. What was your point again?
Re: (Score:2)
Judging by your
Re: (Score:2)
While it's a good way to avoid any nasty little surprises that are discovered quickly, you've got a big tradeoff between how long you delay patching and how long it takes for someone to find a problem with a Windows patch. I can't remember how long it took for the WGA dialling-home story to break, but I vaguely rmember it being more than 48 hours.
It also doesn't (IMO) absolve Microsoft from their wrongdoing. Sure it's a good w
Re: (Score:2)
And on that point I whole heartedly agree with you! I am in no way trying to relieve MS of any wrongdoings. Dogs will always bite, I'm just trying to explain how I get bit less without having to put Spot down. It isn't fail-proof, but it helps
Re: (Score:2)
Obviously this isn't proof - any software running as part of the OS can do what it likes (including turning on and off third-party firewall rules) but it's a pretty good indication.
Re: (Score:3, Informative)
Re: (Score:2, Informative)
Or you can take the code generated from the Windows 2000 or below (best with 98SE, which M$ doesn't care about anymore) and just type it on your Windows XP machine. This
Re:Correct me if I'm wrong... (Score:5, Informative)
Then, go to WinDiz at windowsupdate.62nds.com using a non-IE browser. It's faster, more secure, doesn't TRY to make you install the latest DRM upgrade, just the critical patches.
The Only system I have that I let go to windows update is my Media Center laptop; it has to be running all the latest DRM/Spyware to work properly, so I just go with the flow and Isolate it on my home network.
Re:Correct me if I'm wrong... (Score:5, Informative)
Microsoft wrote some sort of hack into Windows so that requests for Microsoft websites (including update.microsoft.com and microsoft.com) cannot be blocked or redirected by malware or viruses.
Try it and see for yourself: put two lines in the HOSTS file, '127.0.0.1 google.com' and '127.0.0.1 microsoft.com' (without the quotes). For the uninitiated, the HOSTS file is located in \Windows\system32\drivers\etc, and you'll need Administrator priveleges to edit it. Now open up your favourite web browser and try to open google.com. You'll find that Google is unreachable and returns an error. Now try microsoft.com and watch as the page merrily loads.
Maybe you'll need to rethink your tinfoil hat solution for avoiding Automatic Updates?
Re: (Score:3, Informative)
don't forget to modify your dnsapi.dll and dnsrslvr.dll files, as well. the sneaky bastiches hard-coded the ip's. your hosts file isn't the first place that windoze looks when resolving a DNS/ip issue; it's the last [locally].
cheers.
Microsoft provides ways to disable WU. (Score:2)
How to turn off the Windows Update feature in Windows XP [microsoft.com]
You receive one or more error messages when the system administrator disables Windows Update or Microsoft Update [microsoft.com]
Re:Correct me if I'm wrong... (Score:4, Informative)
Re:Correct me if I'm wrong... (Score:5, Funny)
Even better, when you're submitting a story to slashdot as AC, it might be best to omit linking directly to your email address.
Just a thought.
Re: (Score:2)
Re:Correct me if I'm wrong... (Score:5, Informative)
I did the same thing, went to a test machine with an old blocked VLK and tried it, no dice. Then I realized... Hey, wait a minute. This looks like it's just a shortcut to inputting your product ID by using a hash... I wonder what would happen if I just replaced the hash with one from a valid system?
Not having a valid windows system handy I was willing to run a somewhat questionable executable on, where could I get a valid hash? Oh hey, look at that. Right there in the article it says "(example &Hash=6VJPCR9)". I appended that to the URL, and bingo. "Genuine Microsoft Software".
Re:Correct me if I'm wrong... (Score:5, Interesting)
That sentence alone is enough to get me riled up. Granted, I'm one of the people who stepped gracefully off the Microsoft Bus as soon as 'Product Validation' became a reality. (I even run Windows 2000 and the first version of Office 2000, which are the two last versions on their respective lines to not have the 'phone home' features)
It sorta chills me to think of being afraid to run particular binaries on a machine that I own and am legitimate owner of, because a 'phone home' feature will nark on me.
My copies of Windows 2000 and Office 2000 are the full retail-box versions (about the most expensive way possible to buy Microsoft's products). I used to buy a lot of their stuff. Not any longer. And I'm not alone.
Re: (Score:2, Insightful)
Re: (Score:2)
The real pain-in-the-ass though is that wonderful message '...an update has been installed that required a reboot...' - that really hurts when you left the office with your PC password locked and running a ssh session doing something unspeakbly long on a Linux server.
Good job the auto reboot can be disabled.
Re: (Score:3, Informative)
Re: (Score:3, Informative)
What would be really nice is if someone would integrate screen into an ssh daemon, so it just worked without having to start screen before doing something long-winded.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I totally agree with your sentiment. In fact, I'm keeping 2K around for exactly the reasons you've stated. But I do have doubts as to whether or not the narc'ing will land me in any real trouble. It might prevent me from running something, but I wouldn't expect the Feds to come knocking on my door. Not only would that be expensive for
Re:Correct me if I'm wrong... (Score:4, Interesting)
But you're in a very small room. Most people don't know or care about stuff like this. It measures somewhere between a traffic fine for accidentally running a red light and being late for a video rental.
And how many people do you represent? Do you buy for a corporation? Large group? Somehow, I doubt it.
I'm an OSS kinda guy (I write this on my Fedora Core system, using Mozilla) and love it, and have even made sure that our software works on Windows, Mac, and Linux - but none of our customers have *EVER* used our Linux software. A small (but meaningful) percentage of our users are on Macs.
Truth is, much as we who are interested in this stuff might like otherwise, this stuff just doesn't matter to most people - and to those whom it does, Microsoft really is cheaper.
Ever try to support desktop software? Yes, it's getting worse on Windows, but it's still not too bad, compared to supporting some XYZ linux flavor:
Q. What Operating System are you using?
A. Linux
Q. Ok, what UI are you using?
A. What?
Q. I mean, what Window Manager?
A. What's that?
Q. When you click on the start button, what do you see?
A. There is no "Start" button...
Q. Is there a button where you click on to run a program?
A. Yeah.
Q. When you click on it, what does it say?
A. Enter Command
Q. That's it, "Enter Command"?
A. Yes.
Q. So how do you do stuff?
A. What kind of stuff?
Q. You know, look at a website.
A. Oh, a website! I use Firefox!
Q. Good, how do you find FireFox?
A. It's on my desktop!
Q. So are you using Gnome or KDE?
A. I don't know what you're talking about.
Q. (deep sigh)
A. So, you're looking at a screen, right?
Q. Yes.
A. And there's a task bar on it, right?
Q. No.
See where this is going? Linux is not for end users. It probably could be - but it just isn't there now. Ubuntu just might be getting there. Macintosh OSX is there. But for end users, only through some very controlled interface, and in some limited capacity.
Now, I was talking with my father-in-law the other day, and he indicated that he would *never* use Linux. I laughed, and told me that he did, every day. And not only that, but he raved to me about it!
With a look of surprise, he asked me how/where - and I pointed to his Dish DVR. (which is Linux-based, all the way down to an ext2/3 filesystem)
Re: (Score:2)
Re: (Score:2)
If a user doesn't know what distro they're using, then they wouldn't know what version of Windows they were using either.
Re: (Score:2)
The GP post is a complete strawman argument; any company who offered support for 'any' Linux distro deserves what it gets. It's like offering support for 'any' Windows distro.
Re: (Score:2)
Re: (Score:2)
If a user doesn't know what distro they're using, then they wouldn't know what version of Windows they were using either.
But, on either Windows or Macintosh, it's EASY to tell them how to find out what flavor they're running. That is not true for *nix. And so long as this is the case, the "Year of the Linux Desktop" will never happen.
There's no such consistency when using Linux. Are they running KDE 2/3/x? Are they running Gnome 1.x/2.x? Stuff moves around constantly - there's the "normal" Gnome, the "RedH
Re: (Score:2)
You've already got it wrong on the first line. If you ask my wife what Operating System is installed on my laptop, she'll answer without hesitation "ooboontoo". She didn't realize Ubuntu was actually Linux until I told her- after it had already been on the laptop for almost 6 months. She knew all that time what Li
Re:Freezing the upgrade path, migrating, and dongl (Score:2)
Re:Correct me if I'm wrong... (Score:5, Informative)
So what the hell is the point of this?
Re: (Score:2)
Re: (Score:2, Informative)
Re: (Score:3, Insightful)
No
Re:Correct me if I'm wrong... (Score:5, Insightful)
you're wrong (Score:2, Informative)
If you had read the Engadget article [engadget.com], or even looked at the comments [slashdot.org], you would have realized that Engadget did provide a link.
If anything, I think it was editorial laziness rather than ethics that resulted in that article not having a link.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Then I download whatever patches or service packs I need in Opera,
so it's pretty much the same as the article shows.
Re: (Score:2)
It also lets you use Firefox instead of IE to grab your updates, which is reason enough to prefer it.
One thing (Score:3, Interesting)
Re: (Score:2)
IT'S A TRAP (Score:3, Funny)
I got it! This was a plant by management at Microsoft to see how many of their staff come up to them saying that they read "somewhere" about a WGA hole!
Re:IT'S A TRAP (Score:4, Funny)
Re: (Score:2)
Free delivery, naturally. By air mail.
Re: (Score:2)
2)
3) Profit?
WTF? (Score:3, Informative)
Re: (Score:2, Redundant)
Isn't this illegal??? (Score:2, Funny)
We must get homeland security involved.
Re: (Score:2)
Re: (Score:2)
Hmm... (Score:5, Funny)
Re:Hmm... (Score:5, Funny)
I don't think you understand the momentousness of this occassion.
HE'S THE GUY The anonymous coward. How many times have we been irritated with his postings? How often has he trolled? Now we finally know who he is! I foresee the greatest email bombing to ever hit the net in final retaliation for his long years of tormenting us all.
Re: (Score:2)
Wait, so did this guy post as AC but accidentally put his email address in? Or is he this [slashdot.org] Anonymous Coward?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
No WGA check on... (Score:2, Funny)
Re: (Score:2)
basically (Score:3, Interesting)
The code changes regularly, at which time you need mgadiag.exe to find the new code.
the real patch here (Score:2, Funny)
Mirror for the lazy (Score:5, Informative)
http://mirrordot.org/stories/3627c5be2ac21048d6da
Generalized way to find the hashes (Score:5, Interesting)
The Article (Score:4, Informative)
Monday, September 4th, 2006 | Translate to: German flag Spanish flag French flag Italian flag Portuguese flag Dutch flag Greek flag Japanese flag South Korean flag Russian flag Chinese flag
When you want to download a file from Microsoft a WGA (windows genuine advantage) check is performed. Microsoft installs a small piece of software on your computer that contacts the Microsoft server and checks for validity. If the test fails you will not be able to download the file(s). The following method gives you the ability to download every file from Microsoft without a WGA check.
All you need is the tool mgadiag.exe and the download url of the file that you want to download. Mgadiag.exe is the Microsoft Genuine Advantage Diagnostic Tool. Start this tool and check the value of the "Download Center Code", this should be seven chars consisting of upper case letters and numbers. Remember that code and open the website of the file that you want to download.
A download page looks similar to this one for Internet Explorer 7. All you need to do is append the following value to the url and you will be able to download the file without a WGA check.
&Hash="download center code"
Replace the "download center code" with the code that you looked up in the mgadiag.exe tool. This code changes frequently, make sure you have the correct code before starting the downloads.
To sum it up for the lazy ones:
1. download mgadiag.exe
2. start mgadiag.exe and look at the download center code
3. visit a download page at microsoft.com
4. append &Hash="download center code" to the url (example &Hash=6VJPCR9), no quotation marks needed
5. Hit enter
Microsoft is probably going to fix this soon, it is working nevertheless at the moment.
Update: I created two images to show you the difference that the &hash= entry makes:
My trick (Score:2)
My trick is to download stuff via a Windows 2000 install. I've only done it once just the other day, but it was from a W2K installed from one of those install CDs that had a setup file changed to bypass the CD key. (for which everybody knows the "default" key anyhow, so this was really just to save me time when installing)
Since I know that someday Microsoft will probably decide to take all the W2K patches offline, my plan is to download a copy of the installers for every patch that was auto-installed.
Crossover (Score:2)
this is nothing (Score:4, Informative)
it's no different than running the manual verification using the 'alternate tool' (i.e. the method, still available, that firefox users had to use before microsoft released a netscape/firefox plugin version of the activex checker). http://go.microsoft.com/fwlink/?LinkId=50344 [microsoft.com] (genuinecheck.exe at microsoft.com)
the only thing this will bypass is the installation of the verification activex (or plugin)... so you're still being subject to the 'body cavity search' -- the only difference is that you get to choose when you drop your drawers...
Basically for patching a pirated copy of Windows? (Score:2, Insightful)
1. someone owns a valid Windows license and
2. they're pretty organized and didn't misplace their key and
3. they believe that Microsoft does not collect private information using WGA
then why would circumventing WGA be of use to them? In that situation, is patching a pirated copy of Windows the only realistic use for this trick? Could somebody chime in and suggest *a
A couple of options (Score:4, Informative)
Don't trust somebody other than Microsoft themselves? (I can even write that with a straight face
Go to: Microsoft Downloads [microsoft.com] and Search in the Windows sub-section. Search for "iso-9660". Be amazed. Problem with this is these downloads are huge (not that I mind on a 10Mbit synchronous pipe
Me, myself, and I? I prefer to click on the Apple and choose "Software Update..." (or softwareupdate -ia from the command line). Of course on the servers a good 'ol fashioned "yum update" does the trick. But hey, that's just me. Microsoft is making this WAY TOO HARD -- and I've begrudgingly paid for each and every one of my Windows installs (personal and/or corporate).
An Alternative to Windows Update (Score:3, Informative)
Re: (Score:2, Insightful)
Re: (Score:2, Insightful)
Re: (Score:2)
muBlinder.. the best way to get around WGA (Score:3, Informative)
Car Analogy (Score:3, Interesting)
I think that the above hypothetical scenario is a simple analogy of what I like to call "The Windows Problem". Nobody likes WGA. Nobody likes the endless parade of patches and hotfixes that require a reboot as often as not. Nobody likes having to be ever vigilant against security threats. People are starting to see that Windows is very flawed. Since we as a society have spent the majority of our IT budget for the last 20 years on making this one OS the (often) only platform for our IT solutions, how do we change course now?
There are those who believe that once people hear the Good News about Linux they will throw off their Microsoft shackles and march hand-in-hand into the FOSS promised land. OK, maybe I overstated that a little, but you get the point and you know the type. Ubuntu is ridiculously easy to install, but my mother couldn't do it. She uses XP because that's what Dell installed on her computer. Even though she sees Windows as the only reasonable alternative, she still bitches about it. "Normal" people had a hard enough time getting Windows to do what they want it to do, and they'll be damned if they are going to learn it all over again.
Unless everyone else switches first.
Re: (Score:2)
Force all schools to use linux.
WGA even for "security" updates? (Score:2, Insightful)
Probably not. I can imagine hundreds of illegal copies of Windows already taken over and turned into spam bots, etc. and thanks to WGA, there is no way to fix them. Can WGA keep these machines off the Internet, keep them from harming others? No.
In time, networking protocols evolve, systems change, etc. so these wide-open networked machines
Re: (Score:3, Informative)
WTF (Score:3, Interesting)
All that being said, I've written this post on my triple-booting MBP. And just for the record: after having dealt for many years with all of them, I have to admit that I hate Windows, OSX, and Linux with passion (ok, Linux less so simply due to its philosophical supremacy), despite the fact that (or should I perhaps say because?) I use all three on a more-or-less daily basis...
How responsible (Score:4, Insightful)
I'm waiting for "How to download from (pay)iTunes without paying for it" and "Circumvent Payment in Valve's Steam"
Works with WINE... (Score:2, Interesting)
Re:That was fast! (Score:4, Funny)
Maybe they should ghack into some other servers and steal some bandwidth! Pfffft.
Re:Why the fuck.. (Score:4, Informative)
Re: (Score:2)
I think someone has been scarfing up way too much porn on the side.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Microsoft has gone too far with this bullshit. Stop treating paying customers like criminals. All you folks are doing is alienating your legitimate customer base while not deterring the professional "pirates" in the slightest.
For good reason too (Score:2)
The worst part is that I didn't even download WGA, it did it all by itself. I didn't have automatic updates on, but then one day it was on. The ne
Re:Why the fuck.. (Score:5, Insightful)
As I mentioned in a post in a different article, I've had a painfully annoying run in with Window Activate while in the middle of a computer upgrade.
The short description, XP decided it needed to Activate (could NOT log in without activating it), but I hadn't finished installing drivers; forcing me to phone up their support instead of doing it online.
Then, because I had not yet installed the rest of the hardware (which; without the drivers installed were causing the machine to reboot, or bluescreen before windows even started). the Windows Activation bitched at me again when I was done. At least this time it gave me a 3 day window before it would deactivate; this gave me an opportunity to install the rest of the drivers, etc.
This second time it forced me to call Microsoft again, even though the network connection was now working fine, because the machine had changed too much, and been activated too many times.
Then it lead me to believe I could just use the automated method (the voice recognition is actually pretty good), but after reading a billion digits to the computer it decided I wasn't allowed to do it that way and passed me off to an operator.
And you think I want to trust WGA if I need a hot-fix to add security patches, etc?
The only people not having problems with Windows XP Activation and WGA are the damn pirates.
Re:Why the fuck.. (Score:5, Interesting)
I feel your pain. I provide all our company's in house tech support. If a machine goes down and needs a hard drive replaced, I don't fudge around calling up Microsoft when the WPA thing starts bitching. I have a utility that patches an operating system file, and bam, no more WPA or WGA bullshit. If they want to accuse me of being a pirate, they can come on in and look at the product key hologram stickers on every box I do this to. Its not that I'm pirating it, I just don't have time to jump through all their hoops. Alot of my users do all their work on the computer, and if its down for more than 2 hours or so I start to get flak.
Re: (Score:2)
Re:Why the fuck.. (Score:4, Insightful)
Incorrect. I, personally, have Windows machines, but I'm not foolish enough to let machines running Windows to have close connection to the Internet. So if I wanted to download updates I would want to do it from this NetBSD machine, which is what I customarily use for online things (and which is routed to the Internet).
My Windows machines are authentic, and I have all the 'paperwork' and media to prove it. I'm just not gonna hang them out on the net.
And it makes perfect sense that people who want to apply all the patches to secure a Windows system are going to want to get those updates first on an already secured system. Am I supposed to connect my machine with a freshly installed Day Zero copy of Windows 2000 (I pre-registered to pre-order Windows 2000 before it came out, so I have first release media with all the exploits, etc.) online to download security patches? Do I seem like I'm nuts?
Re: (Score:3, Insightful)
Re: (Score:2, Insightful)
They're making work for themselves, basically, and charging honest people a hell of a lot of money to stay honest.
Good luck to them. I've finally collected the last pieces of the puzzle for Linux at home, and will be removing the last Windows machine (wife's PC) off of my network in a matter of weeks.
No more fucking MS bullshit. Adios.