"Windows mail could not be started. error 80041161

[muymalestado]

Just completed MS Fixit session(s). With Windows, Avast, and router Firewalls running + AV.

MS Fixit was started up. It saves a stub on the HDD which downloads a relevant executable with each selected component to be Fixed.

There are loads of Fixable components - as the major category I choose 'Top', whatever that means, I guess it means 'popular'.

I then choose 'All Windows'.

I then choose 'Fix programs that cannot be installed or uninstalled.'

These may have been inappropriate choices, don't know.

Nine WL components were listed and these were 'Fixed' by MS Fixit in each case by choosing the 'installing' as the problem option then choosing 'Uninstall' as the what to do about it option. In each case 'Issues were found and fixed'. A reboot followed each run through MS Fixit. Each time MS Fixit was run the list of WL components shrank by the one just uninstalled.

Your further instructions ...

[sfc /scannow - Option #1
Then after the last reboot above scannow was run in CMD, run as admin. The sfcdetails.txt file is attached.
]


[sfc /verifyonly - option #2
Was run as Admin and the CBS log was appended with its data.
]

[findstr - option #3
successfully produced the expected sfcdetails.txt on the Desktop.
]


[supplementary
I noted in MS Fixit that when selecting the WL component(s) to deal with that 'Windows Installer MSI' was the component immediately above the 9 listed WL components - I wonder if I should run MS Fixit over this Installer MSI and try to uninstall that as well? This would leave the computer without the MSI Installer - I guess, so I have not done it, not yet.

If so, where will I get a re-install fileset for the Installer?
]

Quite a marathon.

 

[Slartybart]

I'll take a look at the sfcdetails file.

You could have skipped sfc /verifyonly - sorry if I wasn't clear about which steps to run. It doesn't hurt, it's the report only option of SFC.

re: MS Fixit. I trust them, they're built by MS to easily solve issues. If you're ever curious about what one does, there's usually a "Let me fixit myself" secton below the one button fix. You only have ro push the MS Fixit button, you don't have to fix it yourslef (that's for geeks like me who want to know what that button actually does - I read it and then push the MS Fixit button).

I'll try to duplicate the MS Fixit list you worked off of, but I might come back and ask you to post links to the specific fixits.

Let me see what I can find out about your [supplementary question/comment. Hold off on that until I read a little. Ms wouldn't make a Fixit that would leave you without an installer. So there's no worry there.

In the meantime, could you follow this tutorial: http://www.sevenforums.com/windows-...4840-windows-update-posting-instructions.html
:ar: Steps 1 and 4 only - you've already executed SFC and posted the error codes way back, so all I'm really asking for is otuput from the System Update Readiness Tool (SURT).

Marathon?
It's only been 2 weeks and 41 posts. I've been in some threads that span a few months and 100s of posts. Some of it the nature of time (timezones or other considerations) and some of it is the complexity of the issue. This is nothing .

Bill
.

 

[Slartybart]

I'd like you to do a quick malware scan on your system just to let me know if anythng might be lurking.

Download Malwarebytes Anti-Malware Free (click here to download, select the free version)
"Save as" the install package to your Desktop
Double click the mbam-setup file on your desktop to install and run Malwarebytes (Mbam)

Answer YES to all authorization prompts and then follow the Mbam setup prompts.
Do not make any changes to default settings.
When the install is finished, verify that only the following two options have checkmarks,
change to match if necessary.
[[FONT=Webdings, serif]a[/FONT]] Update Malwarebytes’ Anti-Malware
[a] Launch Malwarebytes’ Anti-Malware

Make sure that there is NOT a checkmark next to:
[ ] Enable free trial of Malwarebytes Anti-Malware PRO

Then click the Finish button.

Allow Mbam to update, then
Select Perform Quick Scan from the options on the Scanner tab, then
Click the Scan button.

After the scan is complete
Click on Show Results
A window displaying any detected malware is shown
Select all malware (make sure all objects are ticked [a]), then
Click on Remove Selected

The Mbam report file pops up in your text editor when Mbam has completed the removal process.

:ar: Select all of the text in the report (Ctrl+A) and paste the text in a new post on this thread.

   Note

If MBAM encounters a file that is difficult to remove, you are asked to restart the computer.
The restart is REQUIRED to allow Mbam to complete the removal of the malware.
Failure to restart, if prompted, means that the malware is still present on your machine.

:info: You want to restart in Normal mode, not in Safe mode.

 

[Slartybart]

After you scan your machine for malware, I'd like to make sure that no changes were made by any malware that affects your base Windows opertaons.

Please follow this tutorial: http://www.sevenforums.com/windows-...ne-activation-issue-posting-instructions.html

Step 7 is very important, the report contains information that might help resolve the issue, or it might point to something else.
Step 8 - SKIP step 8, do NOT create a new thread.

I'm still reading, that will give you time to catch up on my previous Mbam post and this one.

Bill
.

 

[Slartybart]

I had a little difficulty recreating your MS Fixit steps. I got different results whn I followed your steps. But.... I think I got to the same place.

If this is the MS Fixit you mention in your [supplementary info in your post# 41
and you have not run that MS Fixit, please run it now. If it is not the same, please run it now anyway.

---

Here's the link: Fix problems that programs cannot be installed or uninstalled

Bill
.

 

[muymalestado]

@44

I found the SURT page, ran the tool, found the CBS.log lines below 15:19:23:
"2014-01-31 15:19:23, Info CBS Starting TrustedInstaller initialization"
and cut those into a new file which is attached.

Thanks for now.

 

[muymalestado]

I had a little difficulty recreating your MS Fixit steps. I got different results whn I followed your steps. But.... I think I got to the same place.

If this is the MS Fixit you mention in your [supplementary info in your post# 41
and you have not run that MS Fixit, please run it now. If it is not the same, please run it now anyway.....

This looks like the same Fixit I used, it has the same title as what I used. I got to Uninstall in subsequent screens where a list from Adobe to x,y,z showed 9 WLxxxxx entries which I processed one by one with Uninstall. Each showed Issues Found & Fixed. And the Windows MSI Installer is there - is it there because there are Fixable Issues? I did not uninstall it as where would I find it again to re-install?

 

[Slartybart]

@44

I found the SURT page, ran the tool, found the CBS.log lines below 15:19:23:
"2014-01-31 15:19:23, Info CBS Starting TrustedInstaller initialization"
and cut those into a new file which is attached.

Thanks for now.

Oops, the attached text file is the same as your post.

Go back to the tutorial and follow only step 4, the folder already contains the files needed. You don't have to SFC or SURT again.

- zip the entire CBS folder which has persitant logs, SFC logs, and SURT logs. It's easier and if anyone need to look at the entire log, it's there.

Thanks

Bill
.

 

[Slartybart]

This looks like the same Fixit I used, it has the same title as what I used. I got to Uninstall in subsequent screens where a list from Adobe to x,y,z showed 9 WLxxxxx entries which I processed one by one with Uninstall. Each showed Issues Found & Fixed. And the Windows MSI Installer is there - is it there because there are Fixable Issues? I did not uninstall it as where would I find it again to re-install?

Ok, thanks. I'm not familiar with all MS Fixits, most run silently doing whatever the fix requires.

Do I understand correctly that this MS Fixit did what it needed and it also prompted you with an uninstall window?

You uninstalled WL stuff (9 items) one at a time - is this still in the MS Fixit or that completed it's work and then you went to Control Panel - Pgm & Feats to uninstall? I think you're telling me that you're still in the MS Fixit uninstalling these things.

So now you see the Windows MSI and you have a question - a very good question.
The only answer I can honestly give you is that MS Fixits know what they have to do. They're Microsoft offerings so I'm sure the fixits are vetted well. I've never seen a place where you can uninstall MSI, is there a fix option or only uninstall?

Could you post one or more screen shot(s) so I can see what you see? I'm probably going to say let the MS Fixit do it's job. The error is related to the general installer as far as I can tell. But let me see what the sceen(s) says. Some fixits give you more information online, this isn't one of them (at least I couldn't find it)

Thanks,

Bill
.

As I said, I'm not that familiar with all fixits.

 

[NoelDP]

I have to say at this point that all I'm seeing is evasion and avoidance.


The scan results are missing critical values, and the remainder are useless.

Please post the UNEDITED results of an MGADiag scan.


Please follow this tutorial EXACTLY and post an MGADiag report - then we may be able to see what the problem is.

http://www.sevenforums.com/windows-updates-activation/234159-windows-genuine-activation-issue-posting-instructions.html

Ignore errors produced when clicking on the Copy button - they simply mean that the tool could not create the backup files for some reason. The data is still copied to the clipboard for pasting to your response.

Please also state the Version and Edition of Windows quoted on your COA sticker (if you have one) on the case of your machine (or inside the battery compartment), but do NOT quote the Key on the sticker!
http://www.microsoft.com/en-us/howtotell/Hardware.aspx

 

[muymalestado]

Sorry, I misread the #4 attach part of that tutorial. I hope the intact CBS folder is attached here.

In running MS Fixit I used Microsoft Fix it Solution Center: troubleshooting software issues as the access URL.

I selected Fix problems that programs cannot be installed or uninstalled as the specific Fixit to use. When that opened I clicked the RUN NOW button. I selected to auto-install & run the Fixit. That saved an exe on the HDD and ran it.

Running the exe it scanned the HDD and presented the option to Fix 'Install' or 'Uninstall' problems I selected Install. It displayed a list of potential problems to install - listed from Adobe to Windows in alpha order.

In that list nine Windows WLxxxxx components were listed at the first pass. Selecting one It asked to Fix by Installing or Uninstalling. I selected Uninstall.

I then rebooted and repeated the above where the list now contained one fewer WLxxxxx components. The uninstall was chosen for the next WLxxxxx, followed by a reboot.

This was repeated intill all WLxxxxx were removed. Control Panel 'Add/Remove Programs' showed no Wlxxxxx was present.

The MSI Installer was still present in the MS Fixit list. Since Install had been mentioned I wondered about it, but left it.

The MBAM logfile is also attached - showing some PUP threats, which have now been deleted.
View attachment 304718

View attachment MBAM-log-2014-02-03 (19-34-42).txt

Thank you for all your efforts to date.



Text from the MGA diagnostic, Windows panel, should be below.

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-WJ2H8-R6B6D-7QJB7
Windows Product Key Hash: ckKNc+BBPDWmo1LUlOkraNjlQ34=
Windows Product ID: 00359-OEM-8992687-00006
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010300.1.0.003
ID: {01CB3DF7-6E92-4449-AF15-FC997FF38F23}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Home Premium
Architecture: 0x00000009
Build lab: 7601.win7sp1_gdr.130828-1532
TTS Error:
Validation Diagnostic:
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{01CB3DF7-6E92-4449-AF15-FC997FF38F23}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010300.1.0.003</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-7QJB7</PKey><PID>00359-OEM-8992687-00006</PID><PIDType>2</PIDType><SID>S-1-5-21-3393501722-2089750287-4101134159</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire 5745DG</Model></SYSTEM><BIOS><Manufacturer>INSYDE</Manufacturer><Version>V1.00</Version><SMBIOSVersion major="2" minor="6"/><Date>20100730000000.000000+000</Date></BIOS><HWID>10FD3B07018400FC</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>
Spsys.log Content: 0x80070002
Licensing Data-->
Software licensing service version: 6.1.7601.17514
Name: Windows(R) 7, HomePremium edition
Description: Windows Operating System - Windows(R) 7, OEM_SLP channel
Activation ID: d2c04e90-c3dd-4260-b0f3-f845f5d27d64
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 00359-00178-926-800006-02-1033-7600.0000-2492010
Installation ID: 000653050693640631726485186794846413904502649382174476
Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
Partial Product Key: 7QJB7
License Status: Licensed
Remaining Windows rearm count: 3
Trusted time: 03/02/2014 15:22:23
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x00000000
HealthStatus: 0x0000000000000000
Event Time Stamp: 12:1:2013 10:41
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:

HWID Data-->
HWID Hash Current: LAAAAAEAAQABAAEAAAABAAAAAgABAAEA6GG+xURiABK4Yu7dEBuIHIKcXF0=
OEM Activation 1.0 Data-->
N/A
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC ACRSYS ACRPRDCT
FACP ACRSYS ACRPRDCT
HPET ACRSYS ACRPRDCT
BOOT ACRSYS ACRPRDCT
MCFG ACRSYS ACRPRDCT
WDAT ACRSYS ACRPRDCT
ASF! ACRSYS ACRPRDCT
SLIC ACRSYS ACRPRDCT
ASPT ACRSYS ACRPRDCT
SSDT PmRef CpuPm



Aside from the key the COA tag contains these:
Windows 7 Home Premium OA
Acer Group CO.7P201.001
If those codes do not indicate it, this is a 64 bit version, on auto update.

 

[NoelDP]

AS far as I can see, the installation is at least Genuine.

WHY did you not delete ALL found infections when you ran MBAM?

Registry Keys Detected: 3
HKCR\Typelib\{DCABB943-792E-44C4-9029-ECBEE6265AF9} (PUP.Optional.OutBrowse) -> No action taken.
HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534} (PUP.Optional.OutBrowse) -> No action taken.
HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C} (PUP.Optional.OptimzerPro.A) -> No action taken.
Registry Values Detected: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Optimizer Pro (PUP.Optional.OptimizerPro) -> Data: C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe -> No action taken.
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 10
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30B4H88J\OfferBrokerage_14057[1].exe (PUP.Optional.InstallIQ) -> No action taken.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6BL7D6E6\spstub[2].exe (PUP.Optional.Conduit.A) -> No action taken.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9BWVT0YF\SearchProtectGeneric[1].exe (PUP.Optional.Conduit.A) -> No action taken.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9BWVT0YF\Shopop_Setup[1].exe (PUP.Optional.SmartBar) -> No action taken.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9BWVT0YF\SPSetup[1].exe (PUP.Optional.Conduit.A) -> No action taken.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MJQ25XUU\59983.Bubble_Dock.BBD023.no[1].exe (PUP.Optional.BubbleDock.A) -> No action taken.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MJQ25XUU\BubbleDockInstaller[1].exe (PUP.Optional.BubbleDock.A) -> No action taken.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MJQ25XUU\pricepeep_190001_0102[1].exe (PUP.Optional.PricePeep.A) -> No action taken.
C:\Users\pfo\AppData\Local\Temp\nstEAEF.exe (PUP.Optional.SearchProtect.A) -> No action taken.
C:\Users\pfo\AppData\Roaming\VOPackage\Setup.exe (PUP.Optional.InstallCore) -> No action taken.

As far as your CBS.log goes...

 Line 62371: 2014-01-31 17:19:39, Info                  CSI    00000325 [SR] Repairing 4 components
 Line 62372: 2014-01-31 17:19:39, Info                  CSI    00000326 [SR] Beginning Verify and Repair transaction
 Line 62375: 2014-01-31 17:19:39, Info                  CSI    00000328 [SR] Cannot repair member file [l:14{7}]"fde.dll" of Microsoft-Windows-fde, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 62378: 2014-01-31 17:19:39, Info                  CSI    0000032a [SR] Cannot repair member file [l:22{11}]"fdeploy.dll" of Microsoft-Windows-fdeploy, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 62381: 2014-01-31 17:19:39, Info                  CSI    0000032c [SR] Cannot repair member file [l:20{10}]"gptext.dll" of Microsoft-Windows-GroupPolicy-Gptext, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
 Line 62384: 2014-01-31 17:19:39, Info                  CSI    0000032e [SR] Cannot repair member file [l:20{10}]"gpedit.dll" of Microsoft-Windows-GroupPolicy-Admin-Gpedit, Version = 6.1.7600.16385, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch

This indicates that there is a hack in place to bypass gpedit restrictions in lower editions of Windows.

I have to say that I am not really liking what I see - and so will withdraw from the thread with the advice that you need to examine your use of hacks and other software to get around builtin restrictions - other have to pay for these freedoms, and so should you.

 

[muymalestado]

Thanks NoelDP

As for the MBAM threats left behind - I don't see them when looking through MBAM screens. The log makes it seem as though the threats were deleted: as below -


Files Detected: 10
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MJQ25XUU\59983.Bubble_Dock.BBD023.no[1].exe (PUP.Optional.BubbleDock.A) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MJQ25XUU\BubbleDockInstaller[1].exe (PUP.Optional.BubbleDock.A) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9BWVT0YF\SPSetup[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6BL7D6E6\spstub[2].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9BWVT0YF\SearchProtectGeneric[1].exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Roaming\VOPackage\Setup.exe (PUP.Optional.InstallCore) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30B4H88J\OfferBrokerage_14057[1].exe (PUP.Optional.InstallIQ) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MJQ25XUU\pricepeep_190001_0102[1].exe (PUP.Optional.PricePeep.A) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Temp\nstEAEF.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9BWVT0YF\Shopop_Setup[1].exe (PUP.Optional.SmartBar) -> Quarantined and deleted successfully.

(end)

I'll be doing another scan to see what shows up, MBAM and Avast (both Pro).


The CBS log and hacks -
I don't know enough to hack. I have not ever tried. If there are hacks, or such problems, I cannot explain from where they came.

In the CBS log is it the "hash mismatched" that indicates an illegal hack? Or does that indicate 'other software' which is illegal?

I note on sevenforums mention of illegal installation of gptext.dll which is one of the hash mismatch lines you have identified. Looking esewhere on sevenforums I see Win7 Home Premium has no rights to make use of gpedit functions. I certainly have not tried to use group policy, ever, in any version of Windows, back to version 3 or 3.5.

I suppose I should be asking whether gpedit files can be removed and the best - most legal - way to do that, and is there a chance that if I did remove these files would that be a step closer to getting WLmail installed and working.

Again thanks for looking in.

 

[Slartybart]

Good news - the OS is legit
Bad news - group policy has been compromised.

Let me think on this for a bit. I want to look at the malware to see if it played tricks with your system.

While I'm thinking/searching, please fill in your System Specs (see How to - System Specs).

Thanks

Bill
.

 

[muymalestado]

Thanks Slartybart. The system spec has been done.

 

[Slartybart]

I'm still looking at the malware, but a thought came to me to ask about any other recent issues on the machine.

To have Group Policy (GP) compromised would require either

• a very good piece of malware or
• some very bad advice given to "solve" an issue on the machine.

Do you recall looking on other forums for a solution before coming to SevenForums? If that is the case, do you recall where you were and what was suggested?

All information regarding how GP might have been compromised will help get to a solution for the Thread issue. It could be something obvious (I was on XYZ forum and someone suggested....) or it might be makware (I'm looking at that angle).

Until GP is straightend out, I'm not confident that anything else you do will fix the install issue - and that's why you started the thread.

This might take going over something we already tocuhed upon, until all of the information req'd is provided. That's ok, I can ask for a log 10 times until I get what I'm looking to see (I'd rather not ask 10 times, so I'll try to be as clear as possible when I reuest information). So far, there's only been a few communication errors.

I'll keep plugging away on the malware research and let you know if there's anything else that needs to be done in that area. Probably will suggest a few additional scans - Conduit is a tough bug.

Let me know if you think of any possbile cause re: GP.

Thanks,

Bill
.

 

[Slartybart]

I should have looked a little closer at the log.

Most of the threats were in Temporary Internet Files\Content.IE5, were Potentially Unwanted Programs (PUP) and all have been quarrantined.

Can you tell me anything about SPsetup, spstub, VOPackage [and related Installcore], and nstEAEF?

Threats no in IE temp location - notation only:
C:\Users\pfo\AppData\Roaming\VOPackage\Setup.exe (PUP.Optional.InstallCore) -> Quarantined and deleted successfully.
C:\Users\pfo\AppData\Local\Temp\nstEAEF.exe (PUP.Optional.SearchProtect.A) -> Quarantined and deleted successfully.

I'll do more looking, but if you know about the pgms, please fill me in - thanks

Bill
.

 

[muymalestado]

Thank you Slartybart.

I looked through MBAM after the last full scan, did another full scan, saw the threats you mention above and had them removed - obviously I had missed removing some. Avast and MBAM return no threats on full scans now.

It is hard now to recall just what went on and why to cause the original problem but I was confused about setting up and using WL identities and WLM got lost doing that as a result of advice to uninstall WLM then reinstall it with a new identity. It never re-installed and here we are.

I looked 'elsewhere', namely the Microsoft community, to see if any answers about re-installing WLmail would be forthcoming - I lost the will to live over there and without hitting a single key I returned here to sevenforums.

..... Can you tell me anything about SPsetup, spstub, VOPackage [and related Installcore], and nstEAEF? ......

Short answer - No! Should I recognise these?

 

[Slartybart]

ok thanks for the background.

Those other files are in IE temp - which tells me that you might have downloaded somw of them on purpose. If you don't recognize them then it's probable that they came down from a visit to a malicious web site.
I'm not sure, so I ask.

I'd like you to download and run two things in this order. Restart after each one runs
Oldtimer-TFC: this cleans out a lot of temp locations and temp files; places malware might hide.
AdwCleaner: this is another malware scanner; I'll give you two sets of instructions 1) scan and 2) clean

---

Restart your machine in case there are any system operations pending

Click here to download Old Timer-TFC
>> save the application to your Desktop.
:note:TFC will close ALL open programs including your browser!
Save any unsaved work.

Right click, run as administrator TFC

Click the Start button to begin the cleaning process and let it run uninterrupted to completion.

:busted: If TFC prompts you to reboot, do so immediately.
:busted: If TFC does NOT prompt you, then reboot your machine immediately after TFC has completed.

---

AdwCleaner is a two step process. Scan then Clean

Step 1: Download and Scan

Click here to download AdwCleaner (author: Xplode)
>> save the application to your Desktop.

• Double click on AdwCleaner.exe on your Desktop to run the scanner.
  Right-click and select Run As Administrator[/URL].
  :info: AdwCleaner is a standalone executable, there is no install.
  
• Click on the Scan button.
  >> AdwCleaner begins scanning your system. It might take some time to complete, be patient
  
• When the scan has finished, click on the Report button
  >> the AdwCleaner log: AdwCleaner[R#].txt is opened in your default Text editor.
  :info: [R#] gets incremented every time you run AdwCleaner - the highest number is the most recent.
  
• Look through the log for any recognizable entries - don't worry about other details in the log.
  i.e. I use Textpad on my system and AdwCleaner flags it as a possilbe threat because I configured Textpad to replace Notepad. AdwCleaner says "Hey, that's not quite right - you should take a look a this - did you make this change"
  
• Paste the entire AdwCleaner log in your next post.
  :info: AdwCleaner logs are located in the C:\AdwCleaner folder if you need to reference them again.

 

[muymalestado]

Thanks

I ran TFC three times, rebooting before first and after each subsequent run. 2nd & 3rd runs were small & quick. 3rd deleted 17kb only.

I did not clean out the lists of entries in the various TFC panels.

The log is below.

Hope it is interesting


***** [ TFC LOG ] *****

# AdwCleaner v3.018 - Report created 05/02/2014 at 21:25:52
# Updated 28/01/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : pfo - FURIOUSFRED
# Running from : C:\Users\pfo\Downloads\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll
File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.xpt
File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll
File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.xpt
File Found : C:\Users\pfo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\jZip.lnk
Folder Found C:\Program Files (x86)\Common Files\Software Update Utility
Folder Found C:\Program Files (x86)\jZip
Folder Found C:\Program Files (x86)\Nosibay
Folder Found C:\Program Files (x86)\Winamp Toolbar
Folder Found C:\ProgramData\boost_interprocess
Folder Found C:\ProgramData\Partner
Folder Found C:\ProgramData\Winamp Toolbar
Folder Found C:\Users\pfo\AppData\Local\jZip
Folder Found C:\Users\pfo\AppData\Local\OpenCandy
Folder Found C:\Users\pfo\AppData\Local\Winamp Toolbar
Folder Found C:\Users\pfo\AppData\LocalLow\jziptoolbar
Folder Found C:\Users\pfo\AppData\Roaming\Nosibay

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\APN PIP
Key Found : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Found : HKCU\Software\jZip
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1E48C56F-08CD-43AA-A6EF-C1EC891551AB}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1E48C56F-08CD-43AA-A6EF-C1EC891551AB}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{41C4AA37-1DDD-4345-B8DC-734E4B38414D}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\jZip
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Winamp Toolbar
Key Found : HKCU\Software\Nosibay
Key Found : HKCU\Software\smartbar
Key Found : HKCU\Software\Winamp Toolbar
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : [x64] HKCU\Software\APN PIP
Key Found : [x64] HKCU\Software\jZip
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
Key Found : [x64] HKCU\Software\Nosibay
Key Found : [x64] HKCU\Software\smartbar
Key Found : [x64] HKCU\Software\Winamp Toolbar
Key Found : [x64] HKCU\Software\YahooPartnerToolbar
Key Found : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Key Found : HKLM\SOFTWARE\Classes\AppID\{B27D9527-3762-4D71-963D-FB7A94FDD678}
Key Found : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
Key Found : HKLM\SOFTWARE\Classes\AppID\winamptbServer.exe
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1E48C56F-08CD-43AA-A6EF-C1EC891551AB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{57BCA5FA-5DBB-45A2-B558-1755C3F6253B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{6EF4E91D-DDD5-4478-BCA7-DA04435934C0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{841FD004-57A2-4B49-BBDB-5897394619DB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B38D6EDE-390B-4620-8365-29E16459EBDA}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E1164984-B567-47BD-A7FF-240C2594404A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F20F11FD-203E-45A9-B7BB-AFC1B4FEA7A6}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FE178B09-C8AA-4734-804D-1849BCCA0C29}
Key Found : HKLM\SOFTWARE\Classes\dnUpdate
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1
Key Found : HKLM\SOFTWARE\Classes\Interface\{0F54B66A-21CF-4548-AE59-A6B83EE6676F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{51A971CA-D36E-4D13-A799-2CF0A491D04D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{56FBEA9F-EF93-4318-B75F-A96FC7C7BD7B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66DD22B9-6521-4B05-97DB-0EBC00B1DA5D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{78B3C85E-44FF-4DC8-B3AD-156F39DC75E5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{841FD004-57A2-4B49-BBDB-5897394619DB}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E1164984-B567-47BD-A7FF-240C2594404A}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E19FDA06-5BDF-43C2-B794-BCD8A4C2051F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FAB076F5-E4DD-4EA4-AFEE-F18BF972B057}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{507591C2-2F4E-46A7-92D6-E6CFF82E5F26}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{538CD77C-BFDD-49B0-9562-77419CAB89D1}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Key Found : HKLM\SOFTWARE\Classes\WinampTb.AOLTBSearch
Key Found : HKLM\SOFTWARE\Classes\WinampTb.AOLTBSearch.1
Key Found : HKLM\SOFTWARE\Classes\WinampTb.AOLToolBand
Key Found : HKLM\SOFTWARE\Classes\WinampTb.AOLToolBand.1
Key Found : HKLM\SOFTWARE\Classes\WinampTb.Downloader
Key Found : HKLM\SOFTWARE\Classes\WinampTb.Downloader.1
Key Found : HKLM\SOFTWARE\Classes\WinampTb.ToolbarInfo
Key Found : HKLM\SOFTWARE\Classes\WinampTb.ToolbarInfo.1
Key Found : HKLM\SOFTWARE\Classes\WinampTb.ToolbarParams
Key Found : HKLM\SOFTWARE\Classes\WinampTb.ToolbarParams.1
Key Found : HKLM\SOFTWARE\Classes\WinampTbServer.AolToolbarHelper
Key Found : HKLM\SOFTWARE\Classes\WinampTbServer.AolToolbarHelper.1
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla
Key Found : HKLM\Software\jZip
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1E48C56F-08CD-43AA-A6EF-C1EC891551AB}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3614D305-2DBB-4991-9297-750DD60FFC73}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A8C2644D-BF72-4A89-A88C-D85F565F2F46}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E48C56F-08CD-43AA-A6EF-C1EC891551AB}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41C4AA37-1DDD-4345-B8DC-734E4B38414D}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Winamp Toolbar
Key Found : HKLM\Software\PIP
Key Found : HKLM\Software\PrimoPDF\OpenCandy
Key Found : HKLM\Software\Winamp Toolbar
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{0F54B66A-21CF-4548-AE59-A6B83EE6676F}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{51A971CA-D36E-4D13-A799-2CF0A491D04D}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{56FBEA9F-EF93-4318-B75F-A96FC7C7BD7B}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{66DD22B9-6521-4B05-97DB-0EBC00B1DA5D}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{78B3C85E-44FF-4DC8-B3AD-156F39DC75E5}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{841FD004-57A2-4B49-BBDB-5897394619DB}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{E1164984-B567-47BD-A7FF-240C2594404A}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{E19FDA06-5BDF-43C2-B794-BCD8A4C2051F}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{FAB076F5-E4DD-4EA4-AFEE-F18BF972B057}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41C4AA37-1DDD-4345-B8DC-734E4B38414D}
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}]
Value Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v22.0 (en-US)

[ File : C:\Users\pfo\AppData\Roaming\Mozilla\Firefox\Profiles\v679wako.default-1391462979186\prefs.js ]


*************************

AdwCleaner[R0].txt - [11805 octets] - [05/02/2014 21:25:52]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [11866 octets] ##########