AntiWGA hosts patch

Discussion in 'Windows 7' started by biceman, Aug 3, 2009.

  1. biceman

    biceman MDL Novice

    Jul 29, 2009
    21
    0
    0
    #1 biceman, Aug 3, 2009
    Last edited: Sep 1, 2009
    Check this antiwga Hosts file patcher...
    It works like SirSilentBob said:
    Update: AntiWGA 1.2
    blocks
    mpa.one.microsoft.com
    sls.microsoft.com
    genuine.microsoft.com​
    and optional
    sa.windows.com
    se.windows.com
    wustat.windows.com
    wutrack.windows.com
    catalog.microsoft.com
    ie.search.msn.com​
     

    Attached Files:

    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. haXis

    haXis MDL Novice

    Jul 31, 2009
    2
    0
    0
    Please tell me, what lines will be created?
     
  3. lancelotXP

    lancelotXP MDL Novice

    Jul 19, 2009
    1
    0
    0
    That's all
     
  4. SirSilentBob

    SirSilentBob MDL Senior Member

    Jun 5, 2009
    276
    21
    10
    It looks like it simply keeps Windows from being able to talk to the Genuine Advantage servers, so you can use that blocked SLP key without M$ having a record/evidence of you doing such. That way you can make use of your oem SLIC hack, and can simply change your key later.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. Dimsum

    Dimsum MDL Novice

    Jul 29, 2009
    31
    0
    0
    I understand that the "mpa.one.." is the WGA server, but what is the SLS one?
     
  6. jkh334

    jkh334 MDL Junior Member

    Jul 31, 2009
    53
    0
    0
    Ive seen where some people block these as well. What are these other sites used for?

    127.0.0.1 genuine.microsoft.com
    127.0.0.1 mpa.one.microsoft.com
    127.0.0.1 wustat.windows.com
    127.0.0.1 sa.windows.com
    127.0.0.1 ie.search.msn.com
    127.0.0.1 se.windows.com
    127.0.0.1 wutrack.windows.com
     
  7. Sporkman

    Sporkman MDL Member

    Jul 13, 2009
    101
    1
    10
    hmmmmmm ...
     
  8. biceman

    biceman MDL Novice

    Jul 29, 2009
    21
    0
    0
    #8 biceman, Aug 3, 2009
    Last edited: Aug 3, 2009
    (OP)
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  9. bono1

    bono1 MDL Novice

    Apr 1, 2008
    46
    1
    0
    never mind...
     
  10. admin2000

    admin2000 MDL Novice

    Aug 1, 2009
    23
    0
    0
    can you add this?

    127.0.0.1 genuine.microsoft.com
    127.0.0.1 mpa.one.microsoft.com
    127.0.0.1 wustat.windows.com
    127.0.0.1 sa.windows.com
    127.0.0.1 ie.search.msn.com
    127.0.0.1 se.windows.com
    127.0.0.1 wutrack.windows.com:[/
     
  11. beardy

    beardy MDL Novice

    Feb 25, 2008
    16
    0
    0
    Thank you.:)
     
  12. sora

    sora MDL Novice

    Aug 3, 2009
    7
    0
    0
    I would not trust Window's own hosts file to block MS's servers. I've heard people putting in sites in the hosts file to be blocked and still have IE being able to open those sites.

    Put the blocks in your router if you have one, helps if you have more than one pc in the house as well not to edit each hosts file.

    Also open your services.msc and disable Windows Update, Windows Security Center, Error Reporting, and Windows Defender.

    Disabling them the regular way doesn't really turn them completely off.
     
  13. SirSilentBob

    SirSilentBob MDL Senior Member

    Jun 5, 2009
    276
    21
    10
    #13 SirSilentBob, Aug 3, 2009
    Last edited: Aug 3, 2009

    I have experienced that as well. However, each time that has happened, the sites were blocked after a reboot. For some reason on some systems, the sites are blocked the instant the hosts file is saved after changes, others need a reboot. Also, don't forget, if the IP of the site is cached in the DNS cache, windows will not attempt to look up the ip, since at that time it does not need to, and therefore the hosts file will not be searched prior to the DNS service connecting to the DNS server for a lookup, since no actual DNS request was made. Also, if the site was recently visited, it can be cached in the web browser's cache as well. Maybe biceman can add one of those "Changes will not take effect until after reboot. Reboot now?" prompts to his tool to give people the option to re-boot right on the spot....
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  14. sora

    sora MDL Novice

    Aug 3, 2009
    7
    0
    0
    interesting. I have to clarify that this happened in Vista, while 7 is probably similar it may be different. I only switched to 7 this weekend.

    Whatever level of caution you take is up to you. It's obvious that using updates could cause a WGA check and kill your key. What I've always wondered though is whether there is some other unknown "call home" that 7 *may* have that lets MS simply send some signal when you go on the net and deactivate you. This hosts/router thing should block that in any case.
     
  15. Dimsum

    Dimsum MDL Novice

    Jul 29, 2009
    31
    0
    0
    well there is no point in blocking every MS server. lets just block those that affect WGA. Would be annoying if a server got blocked that handled a different none WGA part of windows.
     
  16. HSChronic

    HSChronic MDL Expert

    Aug 25, 2007
    1,213
    57
    60
    Microsoft FUD for the win. You guys are talking this whole blacklisted key thing way too seriously. Right now there are 0 updates for Windows 7. Yes there were some leaked hotfixes but until MS puts them up on WU they don't matter.

    You probably won't see updates come out until the end of this month. If people are so worried about the blacklisted key uninstall it. I am not a big fan of the whole "don't update windows" thing, if they blacklist your key then uninstall it and rearm. Don't compromise the security of your system because of FUD.
     
  17. Bagheera

    Bagheera MDL Member

    Jul 21, 2009
    146
    0
    10
    yeah probably run netstat and wireshark when updating without activation (30 days).. Maybe we will get a better view of ports/hosts...

    first grabbing a unpatched/unslic'ed box in mine home!!.. lol

    will asking mine wife ;), i will do tomorrow or next days.. hehehe

    Or isn't activation/key with first attempt to update checked... ? I don't know for sure normally i have bought mine windows.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  18. minoverta

    minoverta MDL Member

    Jun 17, 2009
    169
    7
    10
    Do i only have to block 127.0.0.1 mpa.one.microsoft.com and 127.0.0.1 sls.microsoft.com, modifying my hosts file, from being able to talk to the Genuine Advantage servers????
     
  19. Bagheera

    Bagheera MDL Member

    Jul 21, 2009
    146
    0
    10
    #19 Bagheera, Aug 3, 2009
    Last edited: Aug 3, 2009
    if you ping to sls.microsoft.com you will receive a return van loopback tcp/ip (after altering hosts file) 127.x.x.x

    But did you do a ping to sls.microsft.com also even when you have assigned 127.x.x.x to the "right" sls.microsoft name?

    when i ping (i had a typo) sls.microsft.com then i will get returns... How come? interresting.... anyone else same outcome?
    i think its the right microsoft ip...

    okay found out with tracert..... hitnx-domain.opendns.com

    'pffttt
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  20. Bobs626

    Bobs626 MDL Junior Member

    Jan 30, 2008
    80
    1
    0
    :rolleyes:I dont think they are going to block anything untill they get past the release date....the wga website dont even know what windows 7 is yet...IMO
    http://forums.mydigitallife.net/picture.php?albumid=16&pictureid=45