/* Microsoft Windows Genuine Advantage Notification Tool UNINSTALLER (c)2006 by Markus Birth <mbirth@webwriters.de> */ TrayTip WGAN Uninstaller, (c)2006 by Markus Birth <mbirth@webwriters.de>, 20, 1 ctr = 1 PFRO := "" steps = 0 logt := "" Log(bla) { global logt logt := logt . bla . "`n" Tooltip %bla% } /* MoveDelFile() moves a file to C:\delmeZZZ.$$$ where ZZZ is a number starting from 1 for the first file. It then adds these files to the PendingFileRenameOperations registry key so that they get deleted upon the next reboot. */ MoveDelFile(file) { global ctr, PFRO, steps, logt IfExist %file% { Log("Moving " . file . " ...") FileMove %file%, C:\delme%ctr%.$$$ If ErrorLevel { Log("ERROR moving " . file . " to C:\delme" . ctr . ".$$$ !!") MsgBox %logt% ExitApp } else { Log("Success.") } Log("Marking file for deletion ...") PFRO := PFRO . "\??\C:\delme" . ctr . ".$$$`n" . Chr(0) . "`n" ctr++ steps++ } else { Log("Skipping " . file . " ... nonexistent!") } } DelRegKey(root, sub) { global steps, logt keycount = 0 Loop %root%, %sub%, 1, 1 { keycount++ } If (keycount > 0) { Log("Deleting " . root . "\" . sub . " ...") RegDelete %root%, %sub%, If ErrorLevel { Log("ERROR deleting " . root . "\" . sub . " !!") MsgBox %logt% ExitApp } else { Log("Success.") steps++ } } else { Log("Skipping deleting " . root . "\" . sub . " ... nonexistent!") return } } MoveDelFile(WINDIR . "\system32\WGALogon.dll") MoveDelFile(WINDIR . "\system32\WGATray.exe") MoveDelFile(WINDIR . "\system32\dllcache\WGALogon.dll") MoveDelFile(WINDIR . "\system32\dllcache\WGATray.exe") Log("Checking registry for PFRO's ...") RegRead PFROtest, HKLM, SYSTEM\CurrentControlSet\Control\Session Manager, PendingFileRenameOperations StringLen PFROlen, PFROtest StringLen PFROl, PFRO If (PFROlen > 0 and PFROl > 0) { Log("Pending File Rename Operations found ... skipping!") MsgBox There are pending file rename operations. After reboot, find and delete all files 'delme*.$$$' in C:\ . } else if (PFROl > 0) { Log("Writing file removal registry entries ...") RegWrite REG_MULTI_SZ, HKLM, SYSTEM\CurrentControlSet\Control\Session Manager, PendingFileRenameOperations, %PFRO% steps++ } Process Exist, WGATray.exe If ErrorLevel { Log("Killing running WGATray.exe ...") steps++ Process Close, %ErrorLevel% If ErrorLevel { Log("Success.") } else { Log("ERROR WGATray.exe still running!!") MsgBox %logt% ExitApp } } DelRegKey("HKLM", "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon") DelRegKey("HKLM", "SOFTWARE\Microsoft\Updates\WgaNotify") DelRegKey("HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WgaNotify") Log("Resetting WGA code to zero ...") RegWrite REG_DWORD, HKCU, Software\Microsoft\Windows Genuine Advantage, code, 0 If (steps > 0) { Log(steps . " steps done.") MsgBox 68, WGA Notification removed, Microsoft Windows Genuine Advantage Notification Tool removed. Now is a good time to reboot - shall I do so now?`n`n(If you plan to reboot, SAVE your work NOW!)`n`nAnd leave your hands off KB905474 in the future!`n(You should set Automatic Updates to 'Notify me but don't...' and deselect this update when it's reappearing. Then choose not to get reminded of it anymore.) IfMsgBox Yes { MsgBox %logt% Shutdown 6 ExitApp } MsgBox %logt% } else { Log("Nothing done.") MsgBox 64, WGA Notification Remover, No operations were performed. Seems your system is still clean.`n`n%logt% }