"Windows mail could not be started. error 80041161

muymalestado · 03 Feb 2014

Sorry, I misread the #4 attach part of that tutorial. I hope the intact CBS folder is attached here.

In running MS Fixit I used Microsoft Fix it Solution Center: troubleshooting software issues as the access URL.

I selected Fix problems that programs cannot be installed or uninstalled as the specific Fixit to use. When that opened I clicked the RUN NOW button. I selected to auto-install & run the Fixit. That saved an exe on the HDD and ran it.

Running the exe it scanned the HDD and presented the option to Fix 'Install' or 'Uninstall' problems I selected Install. It displayed a list of potential problems to install - listed from Adobe to Windows in alpha order.

In that list nine Windows WLxxxxx components were listed at the first pass. Selecting one It asked to Fix by Installing or Uninstalling. I selected Uninstall.

I then rebooted and repeated the above where the list now contained one fewer WLxxxxx components. The uninstall was chosen for the next WLxxxxx, followed by a reboot.

This was repeated intill all WLxxxxx were removed. Control Panel 'Add/Remove Programs' showed no Wlxxxxx was present.

The MSI Installer was still present in the MS Fixit list. Since Install had been mentioned I wondered about it, but left it.

The MBAM logfile is also attached - showing some PUP threats, which have now been deleted.
Attachment 304718

MBAM-log-2014-02-03 (19-34-42).txt

Thank you for all your efforts to date.

Text from the MGA diagnostic, Windows panel, should be below.

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
Windows Product ID: 00359-OEM-8992687-00006
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {01CB3DF7-6E92-4449-AF15-FC997FF38F23}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130828-1532
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{01CB3DF7-6E92-4449-AF15-FC997FF38F23}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-3393501722-2089750287-4101134159</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire 5745DG</Model></SYSTEM><BIOS><Manufacturer>INSYDE</Manufacturer><Version>V1.00</Version><SMBIOSVersion major="2" minor="6"/><Date>20100730000000.000000+000</Date></BIOS><HWID>10FD3B07018400FC</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800006-02-1033-7600.0000-2492010
Installation ID: 000653050693640631726485186794846413904502649382174476
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: 7QJB7
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 03/02/2014 15:22:23
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 12:1:2013 10:41
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:

HWID Data-->
HWID Hash Current: LAAAAAEAAQABAAEAAAABAAAAAgABAAEA6GG+xURiABK4Yu7dEBuIHIKcXF0=
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC ACRSYS ACRPRDCT
FACP ACRSYS ACRPRDCT
HPET ACRSYS ACRPRDCT
BOOT ACRSYS ACRPRDCT
MCFG ACRSYS ACRPRDCT
WDAT ACRSYS ACRPRDCT
ASF! ACRSYS ACRPRDCT
SLIC ACRSYS ACRPRDCT
ASPT ACRSYS ACRPRDCT
SSDT PmRef CpuPm

Aside from the key the COA tag contains these:
Windows 7 Home Premium OA
Acer Group CO.7P201.001
If those codes do not indicate it, this is a 64 bit version, on auto update.

NoelDP · 03 Feb 2014

AS far as I can see, the installation is at least Genuine.

WHY did you not delete ALL found infections when you ran MBAM?

Code:

Registry Keys Detected: 3
HKCR\Typelib\{DCABB943-792E-44C4-9029-ECBEE6265AF9} (PUP.Optional.OutBrowse) -> No action taken.
HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534} (PUP.Optional.OutBrowse) -> No action taken.
HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C} (PUP.Optional.OptimzerPro.A) -> No action taken.
Registry Values Detected: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Optimizer Pro (PUP.Optional.OptimizerPro) -> Data: C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe -> No action taken.
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 10
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30B4H88J\OfferBrokerage_14057[1].exe (PUP.Optional.InstallIQ) -> No action taken.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6BL7D6E6\spstub[2].exe (PUP.Optional.Conduit.A) -> No action taken.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9BWVT0YF\SearchProtectGeneric[1].exe (PUP.Optional.Conduit.A) -> No action taken.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9BWVT0YF\Shopop_Setup[1].exe (PUP.Optional.SmartBar) -> No action taken.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9BWVT0YF\SPSetup[1].exe (PUP.Optional.Conduit.A) -> No action taken.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MJQ25XUU\59983.Bubble_Dock.BBD023.no[1].exe (PUP.Optional.BubbleDock.A) -> No action taken.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MJQ25XUU\BubbleDockInstaller[1].exe (PUP.Optional.BubbleDock.A) -> No action taken.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MJQ25XUU\pricepeep_190001_0102[1].exe (PUP.Optional.PricePeep.A) -> No action taken.
C:\Users\pfo\AppData\Local\Temp\nstEAEF.exe (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Users\pfo\AppData\Roaming\VOPackage\Setup.exe (PUP.Optional.InstallCore) -> No action taken.

As far as your CBS.log goes...

Code:

 Line 62371: 2014-01-31 17:19:39, Info                  CSI    00000325 [SR] Repairing 4 components
 Line 62372: 2014-01-31 17:19:39, Info                  CSI    00000326 [SR] Beginning Verify and Repair transaction
 Line 62375: 2014-01-31 17:19:39, Info                  CSI    00000328 [SR] Cannot repair member file [l:14{7}]"fde.dll" of Microsoft-Windows-fde, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 62378: 2014-01-31 17:19:39, Info                  CSI    0000032a [SR] Cannot repair member file [l:22{11}]"fdeploy.dll" of Microsoft-Windows-fdeploy, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 62381: 2014-01-31 17:19:39, Info                  CSI    0000032c [SR] Cannot repair member file [l:20{10}]"gptext.dll" of Microsoft-Windows-GroupPolicy-Gptext, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 62384: 2014-01-31 17:19:39, Info                  CSI    0000032e [SR] Cannot repair member file [l:20{10}]"gpedit.dll" of Microsoft-Windows-GroupPolicy-Admin-Gpedit, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

This indicates that there is a hack in place to bypass gpedit restrictions in lower editions of Windows.

I have to say that I am not really liking what I see - and so will withdraw from the thread with the advice that you need to examine your use of hacks and other software to get around builtin restrictions - other have to pay for these freedoms, and so should you.

muymalestado · 03 Feb 2014

Thanks NoelDP

As for the MBAM threats left behind - I don't see them when looking through MBAM screens. The log makes it seem as though the threats were deleted: as below -

Files Detected: 10
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MJQ25XUU\59983.Bubble_Dock.BBD023.no[1].exe (PUP.Optional.BubbleDock.A) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MJQ25XUU\BubbleDockInstaller[1].exe (PUP.Optional.BubbleDock.A) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9BWVT0YF\SPSetup[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6BL7D6E6\spstub[2].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9BWVT0YF\SearchProtectGeneric[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Roaming\VOPackage\Setup.exe (PUP.Optional.InstallCore) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30B4H88J\OfferBrokerage_14057[1].exe (PUP.Optional.InstallIQ) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MJQ25XUU\pricepeep_190001_0102[1].exe (PUP.Optional.PricePeep.A) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Temp\nstEAEF.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9BWVT0YF\Shopop_Setup[1].exe (PUP.Optional.SmartBar) -> Quarantined and deleted successfully.

(end)

I'll be doing another scan to see what shows up, MBAM and Avast (both Pro).

The CBS log and hacks -
I don't know enough to hack. I have not ever tried. If there are hacks, or such problems, I cannot explain from where they came.

In the CBS log is it the "hash mismatched" that indicates an illegal hack? Or does that indicate 'other software' which is illegal?

I note on sevenforums mention of illegal installation of gptext.dll which is one of the hash mismatch lines you have identified. Looking esewhere on sevenforums I see Win7 Home Premium has no rights to make use of gpedit functions. I certainly have not tried to use group policy, ever, in any version of Windows, back to version 3 or 3.5.

I suppose I should be asking whether gpedit files can be removed and the best - most legal - way to do that, and is there a chance that if I did remove these files would that be a step closer to getting WLmail installed and working.

Again thanks for looking in.

Slartybart · 03 Feb 2014

Good news - the OS is legit
Bad news - group policy has been compromised.

Let me think on this for a bit. I want to look at the malware to see if it played tricks with your system.

While I'm thinking/searching, please fill in your System Specs (see How to - System Specs).

Thanks

Bill
.

muymalestado · 04 Feb 2014

Thanks Slartybart. The system spec has been done.

Slartybart · 04 Feb 2014

I'm still looking at the malware, but a thought came to me to ask about any other recent issues on the machine.

To have Group Policy (GP) compromised would require either

a very good piece of malware or
some very bad advice given to "solve" an issue on the machine.

Do you recall looking on other forums for a solution before coming to SevenForums? If that is the case, do you recall where you were and what was suggested?

All information regarding how GP might have been compromised will help get to a solution for the Thread issue. It could be something obvious (I was on XYZ forum and someone suggested....) or it might be makware (I'm looking at that angle).

Until GP is straightend out, I'm not confident that anything else you do will fix the install issue - and that's why you started the thread.

This might take going over something we already tocuhed upon, until all of the information req'd is provided. That's ok, I can ask for a log 10 times until I get what I'm looking to see (I'd rather not ask 10 times, so I'll try to be as clear as possible when I reuest information). So far, there's only been a few communication errors.

I'll keep plugging away on the malware research and let you know if there's anything else that needs to be done in that area. Probably will suggest a few additional scans - Conduit is a tough bug.

Let me know if you think of any possbile cause re: GP.

Thanks,

Bill
.

Slartybart · 04 Feb 2014

I should have looked a little closer at the log.

Most of the threats were in Temporary Internet Files\Content.IE5, were Potentially Unwanted Programs (PUP) and all have been quarrantined.

Can you tell me anything about SPsetup, spstub, VOPackage [and related Installcore], and nstEAEF?

Threats no in IE temp location - notation only:
C:\Users\pfo\AppData\Roaming\VOPackage\Setup.exe (PUP.Optional.InstallCore) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Temp\nstEAEF.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

I'll do more looking, but if you know about the pgms, please fill me in - thanks

Bill
.

muymalestado · 04 Feb 2014

Thank you Slartybart.

I looked through MBAM after the last full scan, did another full scan, saw the threats you mention above and had them removed - obviously I had missed removing some. Avast and MBAM return no threats on full scans now.

It is hard now to recall just what went on and why to cause the original problem but I was confused about setting up and using WL identities and WLM got lost doing that as a result of advice to uninstall WLM then reinstall it with a new identity. It never re-installed and here we are.

I looked 'elsewhere', namely the Microsoft community, to see if any answers about re-installing WLmail would be forthcoming - I lost the will to live over there and without hitting a single key I returned here to sevenforums.

..... Can you tell me anything about SPsetup, spstub, VOPackage [and related Installcore], and nstEAEF? ......

Short answer - No! Should I recognise these?

Slartybart · 04 Feb 2014

ok thanks for the background.

Those other files are in IE temp - which tells me that you might have downloaded somw of them on purpose. If you don't recognize them then it's probable that they came down from a visit to a malicious web site.
I'm not sure, so I ask.

I'd like you to download and run two things in this order. Restart after each one runs
Oldtimer-TFC: this cleans out a lot of temp locations and temp files; places malware might hide.
AdwCleaner: this is another malware scanner; I'll give you two sets of instructions 1) scan and 2) clean

Restart your machine in case there are any system operations pending

Click here to download Old Timer-TFC
>> save the application to your Desktop.

TFC will close ALL open programs including your browser!
Save any unsaved work.

Right click, run as administrator TFC

Click the Start button to begin the cleaning process and let it run uninterrupted to completion.

If TFC prompts you to reboot, do so immediately.

If TFC does NOT prompt you, then reboot your machine immediately after TFC has completed.

AdwCleaner is a two step process. Scan then Clean

Step 1: Download and Scan

Click here to download AdwCleaner (author: Xplode)
>> save the application to your Desktop.

Double click on AdwCleaner.exe on your Desktop to run the scanner.
Right-click and select Run As Administrator[/URL].
AdwCleaner is a standalone executable, there is no install.
Click on the Scan button.
>> AdwCleaner begins scanning your system. It might take some time to complete, be patient
When the scan has finished, click on the Report button
>> the AdwCleaner log: AdwCleaner[R#].txt is opened in your default Text editor.
[R#] gets incremented every time you run AdwCleaner - the highest number is the most recent.
Look through the log for any recognizable entries - don't worry about other details in the log.
i.e. I use Textpad on my system and AdwCleaner flags it as a possilbe threat because I configured Textpad to replace Notepad. AdwCleaner says "Hey, that's not quite right - you should take a look a this - did you make this change"
Paste the entire AdwCleaner log in your next post.
AdwCleaner logs are located in the C:\AdwCleaner folder if you need to reference them again.

muymalestado · 05 Feb 2014

Thanks

I ran TFC three times, rebooting before first and after each subsequent run. 2nd & 3rd runs were small & quick. 3rd deleted 17kb only.

I did not clean out the lists of entries in the various TFC panels.

The log is below.

Hope it is interesting

***** [ TFC LOG ] *****

# AdwCleaner v3.018 - Report created 05/02/2014 at 21:25:52
# Updated 28/01/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : pfo - FURIOUSFRED
# Running from : C:\Users\pfo\Downloads\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll
File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.xpt
File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll
File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.xpt
File Found : C:\Users\pfo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\jZip.lnk
Folder Found C:\Program Files (x86)\Common Files\Software Update Utility
Folder Found C:\Program Files (x86)\jZip
Folder Found C:\Program Files (x86)\Nosibay
Folder Found C:\Program Files (x86)\Winamp Toolbar
Folder Found C:\ProgramData\boost_interprocess
Folder Found C:\ProgramData\Partner
Folder Found C:\ProgramData\Winamp Toolbar
Folder Found C:\Users\pfo\AppData\Local\jZip
Folder Found C:\Users\pfo\AppData\Local\OpenCandy
Folder Found C:\Users\pfo\AppData\Local\Winamp Toolbar
Folder Found C:\Users\pfo\AppData\LocalLow\jziptoolbar
Folder Found C:\Users\pfo\AppData\Roaming\Nosibay

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\APN PIP
Key Found : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Found : HKCU\Software\jZip
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1E48C56F-08CD-43AA-A6EF-C1EC891551AB}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1E48C56F-08CD-43AA-A6EF-C1EC891551AB}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{41C4AA37-1DDD-4345-B8DC-734E4B38414D}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\jZip
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Winamp Toolbar
Key Found : HKCU\Software\Nosibay
Key Found : HKCU\Software\smartbar
Key Found : HKCU\Software\Winamp Toolbar
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : [x64] HKCU\Software\APN PIP
Key Found : [x64] HKCU\Software\jZip
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
Key Found : [x64] HKCU\Software\Nosibay
Key Found : [x64] HKCU\Software\smartbar
Key Found : [x64] HKCU\Software\Winamp Toolbar
Key Found : [x64] HKCU\Software\YahooPartnerToolbar
Key Found : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Key Found : HKLM\SOFTWARE\Classes\AppID\{B27D9527-3762-4D71-963D-FB7A94FDD678}
Key Found : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
Key Found : HKLM\SOFTWARE\Classes\AppID\winamptbServer.exe
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1E48C56F-08CD-43AA-A6EF-C1EC891551AB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{57BCA5FA-5DBB-45A2-B558-1755C3F6253B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{6EF4E91D-DDD5-4478-BCA7-DA04435934C0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{841FD004-57A2-4B49-BBDB-5897394619DB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B38D6EDE-390B-4620-8365-29E16459EBDA}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E1164984-B567-47BD-A7FF-240C2594404A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F20F11FD-203E-45A9-B7BB-AFC1B4FEA7A6}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FE178B09-C8AA-4734-804D-1849BCCA0C29}
Key Found : HKLM\SOFTWARE\Classes\dnUpdate
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1
Key Found : HKLM\SOFTWARE\Classes\Interface\{0F54B66A-21CF-4548-AE59-A6B83EE6676F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{51A971CA-D36E-4D13-A799-2CF0A491D04D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{56FBEA9F-EF93-4318-B75F-A96FC7C7BD7B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66DD22B9-6521-4B05-97DB-0EBC00B1DA5D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{78B3C85E-44FF-4DC8-B3AD-156F39DC75E5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{841FD004-57A2-4B49-BBDB-5897394619DB}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E1164984-B567-47BD-A7FF-240C2594404A}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E19FDA06-5BDF-43C2-B794-BCD8A4C2051F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FAB076F5-E4DD-4EA4-AFEE-F18BF972B057}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{507591C2-2F4E-46A7-92D6-E6CFF82E5F26}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{538CD77C-BFDD-49B0-9562-77419CAB89D1}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Key Found : HKLM\SOFTWARE\Classes\WinampTb.AOLTBSearch
Key Found : HKLM\SOFTWARE\Classes\WinampTb.AOLTBSearch.1
Key Found : HKLM\SOFTWARE\Classes\WinampTb.AOLToolBand
Key Found : HKLM\SOFTWARE\Classes\WinampTb.AOLToolBand.1
Key Found : HKLM\SOFTWARE\Classes\WinampTb.Downloader
Key Found : HKLM\SOFTWARE\Classes\WinampTb.Downloader.1
Key Found : HKLM\SOFTWARE\Classes\WinampTb.ToolbarInfo
Key Found : HKLM\SOFTWARE\Classes\WinampTb.ToolbarInfo.1
Key Found : HKLM\SOFTWARE\Classes\WinampTb.ToolbarParams
Key Found : HKLM\SOFTWARE\Classes\WinampTb.ToolbarParams.1
Key Found : HKLM\SOFTWARE\Classes\WinampTbServer.AolToolbarHelper
Key Found : HKLM\SOFTWARE\Classes\WinampTbServer.AolToolbarHelper.1
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla
Key Found : HKLM\Software\jZip
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E48C56F-08CD-43AA-A6EF-C1EC891551AB}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3614D305-2DBB-4991-9297-750DD60FFC73}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A8C2644D-BF72-4A89-A88C-D85F565F2F46}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E48C56F-08CD-43AA-A6EF-C1EC891551AB}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41C4AA37-1DDD-4345-B8DC-734E4B38414D}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Winamp Toolbar
Key Found : HKLM\Software\PIP
Key Found : HKLM\Software\PrimoPDF\OpenCandy
Key Found : HKLM\Software\Winamp Toolbar
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{0F54B66A-21CF-4548-AE59-A6B83EE6676F}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{51A971CA-D36E-4D13-A799-2CF0A491D04D}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{56FBEA9F-EF93-4318-B75F-A96FC7C7BD7B}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{66DD22B9-6521-4B05-97DB-0EBC00B1DA5D}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{78B3C85E-44FF-4DC8-B3AD-156F39DC75E5}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{841FD004-57A2-4B49-BBDB-5897394619DB}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{E1164984-B567-47BD-A7FF-240C2594404A}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{E19FDA06-5BDF-43C2-B794-BCD8A4C2051F}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{FAB076F5-E4DD-4EA4-AFEE-F18BF972B057}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41C4AA37-1DDD-4345-B8DC-734E4B38414D}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}]
Value Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428

-\\ Mozilla Firefox v22.0 (en-US)

[ File : C:\Users\pfo\AppData\Roaming\Mozilla\Firefox\Profiles\v679wako.default-1391462979186\prefs.js ]

*************************

AdwCleaner[R0].txt - [11805 octets] - [05/02/2014 21:25:52]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [11866 octets] ##########