Workshop: Testing to bypass the new Microsoft Office 2007 OGA Update

Microsoft just released a new OGA Update for the Genuine Advantage program for Windows XP and Windows Vista. Windows 7 is not affected so far. But it seems, that it will come after the official release at the 22nd of October 2009. It was also reported, that legit copies are affected. 

Please note: The following instructions are only for that case, that the OGA update was installed! You don´t need to install it, just decline the EULA and hide the update after canceling the setup when running Windows Update.

The Update installs a notification service, that can´t be uninstalled manually. To prevent your legit copy to become "notificated" and bypass the installation of the Update, add following lines to your "hosts" file.

The file is located here:

C:\Windows\System32\Drivers\etc

Make a backup of the original file!

Open the "hosts" file with an editor and add the following lines:

127.0.0.1 mpa.one.microsoft.com
127.0.0.1 sls.microsoft.com

Save the "hosts" file and reboot your computer.

Any updates or changes on the OGA Update for Windows 7 will follow as soon the Update arrives for the new OS.

Update 27/08/2009 (from MDL):

After installing Office Genuine Advantage (OGA) Notifications (KB949810) from Windows Update, OGA Validation will perform genuine test on installed Microsoft Office XP, Office 2003, Office 2007 and Office 2010 software. If Office product is validated as not genuine, “This copy of Microsoft Office is not genuine” notification message will be displayed on notification area (system tray), at splash screen during Office program (i.e. Word, Excel, PowerPoint, Outlook) startup, and at Office’s toolbar or ribbon with extra “Get Genuine Office” tab or element.

KB949810 OGA Notifications update is designed so that end-user cannot uninstall or removed the update using “Add and Remove Programs” or “Program and Features” in the Control-Panel, in a bid to encourage end-users to buy genuine Microsoft products. But, if you’re a legit Office users, and the OGA validation has returned false-positive result, use the one of the following hacks to disable and remove Microsoft Office not genuine notification messages displayed by OGA Notifications.
 

Note: Hack below simply remove and disable OGA Notifications so that no notification message about Office not genuine is not displayed, and works on most versions of OGA Notifications. It doesn’t crack or patch OGA Validation component, OGACheckControl.dll, which does the validation process to determine if the Office product is genuine or not.

Hack 1: Disable OGAAddin.dll from Loading with Office Applications

 OGAAddin.dll (and OGAVerify.exe) is a few files that been installed by OGA Notifications. OGAAddin.dll allowed OGA Notifications to install as an add-in to applications in Office productivity suites to display not genuine reminder message to illegitimate and illegal copy of Office. By stopping the OGAAddin load behavior and preventing OGAAddin.dll from loading, the Office Genuine Advantage Notifications message can be suppressed.

1. Run Registry Editor (RegEdit.exe).
2. Press Ctrl-F to open search box, and search for OGAAddin.connect registry key.
3. In the right pane, right click on Load Behavior and select Modify.
4. Change the value data from 3 to 0.
5. Repeat for each and every OGAAddin.connect found.

With this hack, Windows still treat OGA as installed, and will not prompt user to install again.

Hack 2: Disable and Remove OGAAddin from within Office Applications

1. Run one of the Office app such as Word, Excel, PowerPoint, Outlook, Publisher and etc as administrator. Note: Open Windows Explorer, go to %SystemDrive%\Program Files\Microsoft Office\Office12 (may be different depends on version of Office installed and x64 OS uses Program Files (x86) folder), and right click on Office app executable, e.g. winword.exe, excel.exe, powerpnt.exe and etc to run as administrator.
2. Go to Options (at the bottom of menu triggered by Office button) -> Add-Ins.
3. Select COM Add-ins under Manage drop menu list, and click Go.
   
4. Disable or remoev the OGAAdmin.
5. Repeat above steps for each and every Office applications installed.

Hack 3: Delete and Remove (Uninstall) Office Genuine Advantage Notifications Components

Although Microsoft does not allow OGA Notifications to be uninstall, but that does not mean that individual file components of OGA Notifications cannot be deleted, removed or uninstalled manually.

To disable OGA Notifications and uninstall KB949810, close and exit from all Office applications (including Outlook, Word, Excel, PowerPoint, OneNote, Publisher, Visio and etc.), and search for the following files in %SystemDrive%\Wndows\System32 folder and %SystemDrive%\Windows\SysWow64 folder (for 64-bit OS x64 only).

OGAVerify.exe
OGAAddin.dll

Delete the above files. It’s also possible rename the files so that system cannot find them. 

Hack 4: Remove OGAAddin.connect Registry Key in System Registry

 

Pretty much similar to method 1 and 2, but it’s quicker and will complete remove trace of OGAAddin.connect from registry. Unlike hack 1, Windows Update may prompt you to install again.

1. Run Registry Editor (RegEdit.exe).
2. Go to each and every of the following registry keys, and any other which contains OGAAddin.connect registry value sub-key:
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Excel\Addins
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Powerpoint\Addins
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins
   
3. Delete the OGAAddin.connect registry value. 

Hack 5: Properly Uninstall KB949810 OGA Notification via OGANotifier.msi

Easy to uninstall. Just follow these steps:

1. Go to C:\Windows\SoftwareDistribution\Download\8998da55d52b36c0e98ba016ddd50de0\ folder. Note: The directory may be different, so if not found search for OGANotifier.cab.
2. Extract OGANotifier.cab with WinRAR (or using the Expand command at command line) to get a file named OGANotifier.msi.
3. Right click on OGANotifier.msi, and select Uninstall.
4. Remember to block the update from been installed again in WU.

With any one of the hacks above, no more Office Genuine Advantage notification message will be displayed and showed on system, regardless of genuine status of the Office software, unless of course, end-user chooses to reinstall KB949810.

Portions of this manual by The Official Windows 7 Repository from MDL!