News

A security analyst has released a tool that lets users remove Windows Genuine Advantage Notification, part of Microsoft's controversial campaign against software counterfeiting.

The tool, called RemoveWGA, was released this week by Guillaume Kaddouch, a French developer who also makes a firewall utility called Firewall Leak Tester. RemoveWGA is a response to Microsoft's revelation earlier this month that the Windows Genuine Advantage Notification program frequently contacts Microsoft, according to Kaddouch.

"That, along the fact that Microsoft used deceptive ways to make you install this tool... makes me call (WGA Notification) spyware," Kaddouch said in a note accompanying the release of RemoveWGA.

Windows Genuine Advantage includes two main parts: WGA Validation and WGA Notification. Validation checks that an instance of Windows XP is properly licensed, and is required for some Windows updates. If the copy doesn't check out, Notification repeatedly reminds the user to upgrade to a properly licensed version of Windows.

Microsoft maintains that users only install the programs by choice, but once installed, neither is designed to be removable.

As Microsoft admitted this month, Notification also checks back with Microsoft once a day even if the licensing check is successful, something the company hadn't previously made public. Microsoft said the procedure is necessary in case something goes wrong with the program and it needs to be disabled, but has said it will modify Notification to check back only once every two weeks. It said the failure to make public the phone-home behavior was an "oversight."

"Once the WGA Notification tool has checked your OS and has confirmed you had a legit copy, there is no decent point or reason to check it again and again every boot," Kaddouch wrote.

Kaddouch told Techworld he developed the tool based on proof-of-concept work-arounds that have recently been released by security researchers. "All of the necessary information was already available in some security forums on the net, I've just had to compile them in one automatic program," he said. "You can easily disable the WGA notification manually, there are different ways."

He noted that the procedure poses a risk for corporate networks, and that Microsoft slipped it onto many users' computers without their knowledge -- the company classified it as a "critical" update, causing many to install it without knowing what it was.

For the even more paranoid, RemoveWGA can also be set to run a periodic check in the background, notifying the user if it finds WGA Notification has been silently installed, Kaddouch said.

Microsoft did not respond to requests for comment.

Users have been industrious about picking holes in WGA, beginning a day after the system went into effect last August.

WGA will be embedded within Windows Vista, Microsoft has said.