MD5: 1f0e8d1c641ca409dae4cbb11b20d218
SHA1: 29381c3e8173cc1ff7ee1d5e802e470a7866e130
SHA256: 06b1927c2cf0ebcd108547ee4787aa75126cf1793b648c9dd6850879e35e4b84
SSDeep: 196608:XSAkiq15qZQ4LavbqP09F0RIrfQocO0mZXV5m6oe:XSXILavbo0fDJlE6f
Size: 9505280 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: no certificate found
Created at: 2016-06-27 21:31:45
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):

JyHFymELmTHP3B54.exe:680
files.dat:256

The Trojan injects its code into the following process(es):

%original file name%.exe:512
%original file name%.exe:2020

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process JyHFymELmTHP3B54.exe:680 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\files\setup16.exe (20649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\files\files.dat (4162 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\files\files.dat (0 bytes)

The process %original file name%.exe:512 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\1u76t2JDBzP7HPl2\OUEnXizjzFrE.exe (71155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\JyHFymELmTHP3B54.exe (64096 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\0r5wXh5HG20Cfo43 (8 bytes)

The process %original file name%.exe:2020 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Application Data\Imminent\Logs\01-08-2016 (374 bytes)

The process files.dat:256 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\files\x64\cleanospp.exe (19 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\files\Configure.xml (366 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\files\x64\msvcr100.dll (9120 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\files\Uninstall.xml (59 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\files\x86\cleanospp.exe (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\files\x86\msvcr100.dll (8468 bytes)

Registry activity

The process JyHFymELmTHP3B54.exe:680 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 08 92 47 28 CF 74 B6 DD 74 25 D9 0F 7B 3E A6"

The process %original file name%.exe:512 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B5 C7 27 C3 AC D2 73 79 98 6F 5D 20 C5 38 2F 31"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Documents and Settings%\%current user%\Local Settings\Temp]
"JyHFymELmTHP3B54.exe" = "JyHFymELmTHP3B54"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Personal" = "%Documents and Settings%\%current user%\My Documents"

The Trojan adds the reference to itself to be executed when a user logs on:

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell" = "%Documents and Settings%\%current user%\Application Data\1u76t2JDBzP7HPl2\OUEnXizjzFrE.exe,explorer.exe"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process %original file name%.exe:2020 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CD 20 A5 4D A9 68 CF 17 93 B8 CE EB CE 98 76 33"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process files.dat:256 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "21 11 A5 BB B1 34 2C FE A5 95 98 46 41 B4 7B A6"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The Trojan connects to the servers at the folowing location(s):

.code

`.text

`.rdata

@.data

.rsrc

@.modplug

f9.tD

=CMSG

=CMSGu

<.PATT

t)SSh

j.Xf9D$

Yj.Zj\

uuSSSh

.PQUS

.PQRW

|$49\$8}

operand of unlimited repeat could match the empty string

POSIX named classes are supported only within a class

erroffset passed as NULL

POSIX collating elements are not supported

this version of PCRE is compiled without UTF support

PCRE does not support \L, \l, \N{name}, \U, or \u

support for \P, \p, and \X has not been compiled

this version of PCRE is not compiled with Unicode property support

\N is not supported in a class

Error text not found (please report)

   jump error in pcre match: label %d non-existent

ws2_32.dll

F0F001X

WAV Header Info: NbChannels %d, BitsPerSamples: %d, NbBlockAlign %d

WAV Header Info: SamplePerSec %d, nAvgBytesPerSec: %d, WavSize %d

1.6.19

COMCTL32.DLL

uxtheme.dll

dwmapi.dll

%d:%d:%d:%d

r@Kernel32.dll

InitOnceExecuteOnce

inflate 1.2.8 Copyright 1995-2013 Mark Adler

1.2.8

%d&&'

libpng version 1.6.19 - November 12, 2015 Copyright (c) 1998-2015 Glenn Randers-Pehrson Copyright (c) 1996-1997 Andreas Dilger Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.

libpng version 1.6.19 - November 12, 2015

unsupported zlib version

123456789

libpng does not support gamma background rgb_to_gray

Only compression windows <= 32k supported by PNG

Only compression windows >= 256 supported by PNG

Only compression method 8 is supported by PNG

PNG_TRANSFORM_STRIP_FILLER: BEFORE AFTER not supported

keyword truncated

keyword "@1": bad character '0x@2'

00003333

bad keyword

Too many color components: %d, max %d

Unsupported color conversion request

Bogus DAC index %d

Bogus DAC value 0x%x

Bogus DHT index %d

Bogus DQT index %d

Empty JPEG image (DNL not supported)

Maximum supported image dimension is %u pixels

Cannot transcode due to multiple use of quantization table %d

Arithmetic table 0xx was not defined

Backing store not supported

Huffman table 0xx was not defined

Quantization table 0xx was not defined

Not a JPEG file: starts with 0xx 0xx

Insufficient memory (case %d)

Cannot quantize more than %d color components

Cannot quantize to fewer than %d colors

Cannot quantize to more than %d colors

Unsupported JPEG process: SOF type 0xx

Failed to create temporary file %s

Unsupported marker type 0xx

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Unknown APP0 marker (not JFIF), length %u

Unknown APP14 marker (not Adobe), length %u

Define Arithmetic Table 0xx: 0xx

Define Huffman Table 0xx

Define Quantization Table %d precision %d

Define Restart Interval %u

Freed EMS handle %u

Obtained EMS handle %u

= = = = = = = =

JFIF APP0 marker: version %d.d, density %dx%d %d

Warning: thumbnail image size does not match data length %u

JFIF extension marker: type 0xx, length %u

with %d x %d thumbnail image

Miscellaneous marker 0xx, length %u

Unexpected marker 0xx

%4u %4u %4u %4u %4u %4u %4u %4u

Quantizing to %d = %d*%d*%d colors

Quantizing to %d colors

Selected %d colors for quantization

At marker 0xx, recovery action %d

RST%d

Smoothing not supported with nonstandard sampling ratios

Start Of Frame 0xx: width=%u, height=%u, components=%d

Component %d: %dhx%dv q=%d

Start Of Scan: %d components

Component %d: dc=%d ac=%d

Ss=%d, Se=%d, Ah=%d, Al=%d

Closed temporary file %s

Opened temporary file %s

JFIF extension marker: JPEG-compressed thumbnail image, length %u

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: RGB thumbnail image, length %u

Unrecognized component IDs %d %d %d, assuming YCbCr

Freed XMS handle %u

Obtained XMS handle %u

Unknown Adobe color transform code %d

Inconsistent progression sequence for component %d coefficient %d

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Warning: unknown JFIF revision number %d.d

Corrupt JPEG data: found marker 0xx instead of RST%d

Bogus message code %d

Invalid component ID %d in SOS

DCT scaled block size %dx%d not supported

Component index %d: mismatching sampling ratio %d:%d, %d:%d, %c

Wrong JPEG library version: library is %d, caller expects %d

Invalid memory pool code %d

Unsupported JPEG data precision %d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Invalid progressive parameters at scan script entry %d

Invalid scan script at entry %d

Improper call to JPEG library in state %d

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

Buffer passed to JPEG library is too small

%ld%c

deflate 1.2.8 Copyright 1995-2013 Jean-loup Gailly and Mark Adler

p8!iu@KG.RH)hu

.BA_t)

'6F%F

.text

.sxdata

<x.uW

OLEAUT32.dll

USER32.dll

MSVCRT.dll

KERNEL32.dll

-p{Password}: set Password

Data Error in encrypted file. Wrong password?

CRC Failed in encrypted file. Wrong password?

Unsupported Method

Can not open encrypted archive. Wrong password?

Enter password (will not be echoed):

St.iC

wB.Ec,

}Xw"0.WZ

7-Uj}

n Q%u

9G%XN

Mq%dzw

dE.Jlc

QiZI.zD|

IM%Cy

E%F'%

.QX:=y

n0s.ST/k

UM.dr

MA8%U

5%UfW

P.xYVxD

%s"EK

-%.ii

#%D={

y .wd

0Q.Mqh

eL.uB

CX2%S

.F%Ub

pi.wMkh:

K~C.Ys

9.KLj>y

.-,%d

y>U-U[%U

y.afM

(.jxef

*%Sti

dTcp{

L>hl%Ut^

I_fUUÝ

%cy*U

%u:`Q

.hlgw9*Uv

%FXX>

|.Uuh

PO6(%D

a.tW/

<%xW#X

-4}[i

%fGLw

/.gHT

;Þm

Q%xfA

eÊ\

E@.Sv

nCG.wl

Cf.UG9

VRN.Ke

$#.Af

G;k%U

.vsCB

\e.nG

 LEs

K.fjmQR

,u%x:|).

)r=.TGs

>~.Zr

@.reloc

SSSSh

YSSSh

wSSSh

SSSSSSSSh

} j.Xf9

j.Xf9D_

|>j.Yf9

j.Yf9

~xj.Xf9D_

j.Xf9

j.Zf9TK

j%Xf9Dq

u.hH)\

Tt.jh^;

j.Yf;

_tcPVj@

.PjRW

uùA

bond.SerializableExceptionBase

bond.Void

bond.GUID

bond.Variant

bond.Metadata

bond.TypeDef

bond.FieldDef

bond.StructDef

bond.SchemaDef

GroupKey

{8736922d-E8B2-47eb-8564-23E77E728CF3}

wzAddressSMTP

wzHashKey

wzSMTPAddress

wzKey

wzSMTPAddressCache

wzUniqueKey

operationType

Microsoft_Windows_XAML

WINDOWS_UI_XAML_ETW_PROVIDER

{531A35AB-63CE-4BCF-AA98-F88C7A89E455}

ViewportWidth

ViewportHeight

GraphicsDriverSupportType

{02FD33DF-F746-4A10-93A0-2BC6273BC8E4}

ViewportId

CompositorViewportId

ReportedQPC

ReportedVBlank

HttpResponse

KeyIsType

AcceleratorKeys

guidProviderAcceleratorKeys

{d6dd4818-7123-4abb-ad96-b044c1387b49}

{645183D9-4036-4921-BEC2-F7BBF32129AB}

TelemetryBond.RuleResult

TelemetryBond.OfficeAppVersion

TelemetryBond.WindowsVersion

WindowsVersion

TelemetryBond.UploadMetadata

TelemetryBond.RuleResultPayload

windowsVersion

Mso::Telemetry::Rule::TriggerAndReportResults

Ansi string is not supported.

Mso::Telemetry::RuleManager::ReportHighImpactRules

Mso::Telemetry::TelemetryManager::InitTelemetry::<lambda_574d09e683070c1bb34e38b4824a46d2>::operator ()

Mso::Telemetry::TelemetryManager::ShutdownTelemetry::<lambda_74b5100e6935049d0c96d1600eeafb35>::operator ()

@()$^.* ?[]|\-{},:=!

Invalid arguments in math operation

Comments are not supported here

Mso::Telemetry::ReportMissingField

Mso::Telemetry::SimpleMathRule::DoOperation

Mso::Telemetry::UnaryOperator::HashValue

Mso::Telemetry::TelemetryTransport::SubmitPayload

Mso::Telemetry::TelemetryTransport::SubmitRuleResult

%$%,%4%<%

S%T%U%V%W%X%Y%Z%[%\%]%^%_%`%a%

b%c%d%e%f%g%h%i%j%k%l%

Kernel32.dll

_FastMutexEvent

%d%dM

MSOHTMED.EXE.x86

MSOXEV.DLL.x86

century.ttf

IEAWSDC.DLL.x86

MSPROOF6.DLL

MSSPELL.DLL

msqry32.exe

RICHED20.DLL_0001

SAEXT.DLL_0001

INTLDATE.DLL_0001

winproj.exe

Lync.exe

excel.exe

outlook.exe

powerpnt.exe

mspub.exe

FPCUTL.DLL_SPD

winword.exe

OneNote.exe

wwlib.dll

OSPPC.DLL.x86

GKEXCEL.DLL

GKPOWERPOINT.DLL

GKWORD.DLL

CSI.DLL.x86

stintl.dll

LOBIPROX.DLL

WEBSB.DLL

OMICAUTINTL.DLL_1033

LyncMUI.lyncdesktopres

TELLMERUNTIME.DLL

WebDiscussFiles

MSO.DLL

MSOINTL.DLL

AccessHelpFilesIntl_1033

VBE7.DLL

AccessHelpFiles

PSS10R.CHM

PSS10O.CHM

VBLR6.CHM

MSOHEV.DLL

MSOXEV.DLL

CENTURY.TTF

MSCONV97.DLL

PROTTPLN.DOC

PROTTPLN.XLS

PROTTPLN.PPT

PROTTPLV.DOC

PROTTPLV.XLS

PROTTPLV.PPT

CLVIEW.EXE

CLVWINTL.DLL

IEAWSDC.DLL

MSOSTYLE.DLL

MSLID.DLL

msproof7.dll

msspell7.dll

MSQRY32.EXE

OFFICE.ODF

PRTF9.DLL

PTXT9.DLL

RICHED20.DLL

SAEXT.DLL

INTLDATE.DLL

WINPROJ.EXE

MSACCESS.EXE

lync.exe

EXCEL.EXE

SPDESIGN.EXE

OUTLOOK.EXE

POWERPNT.EXE

MSPUB.EXE

FPCUTL.DLL

WINWORD.EXE

VISIO.EXE

VPREVIEW.EXE

THEMES.INF

NAVBARS.INI

ONINTL.DLL

ENVELOPR.DLL

STSLIST.DLL

ALRTINTL.DLL

SEQCHK10.DLL

LSTVIEWS.INI

RSWOP.ICM

ONENOTE.EXE

MSO.ACL

BOLDSTRI.INF

OSETUP.DLL

ACEINTL.DLL

MSO0127.ACL

CT_ROOTS.XML

MSYUBIN7.DLL

MSTAG.TLB

ACCOLKI.DLL

MSSTKO32.DLL

MSOEURO.DLL

xlsrvintl.dll

WDBRKCHT.DLL

MSGR3SC.DLL

WWLIB.DLL

SETUP.CHM

Blog.dotx

EXP_PDF.DLL

EXP_XPS.DLL

MSO40UIRES.DLL

MSO99LRES.DLL

MSORES.DLL

MSPTLS.DLL

OSPPC.DLL

OSPPCEXT.DLL

LICLUA.EXE

pidgenx.dll

pkeyconfig-office.xrm-ms

MSOSYNC.EXE

GKExcel.dll

GKPowerPoint.dll

GKWord.dll

MSOUC.EXE

Csi.dll

STINTL.DLL

MAPIR.DLL

OMSINTL.DLL

MOR6INT.DLL

PUBWZINT.DLL

FLTLDR.EXE

BCSProxy32.dll

WWINTL.DLL

XLINTL32.DLL

XLSLICER.DLL

GRINTL32.DLL

OUTLLIBR.DLL

InternationalSupportFiles_JPN

OUTLWVW.DLL

PPINTL.DLL

VISINTL.DLL

SGRES.DLL

VISBRRES.DLL

PUB6INTL.DLL

OSF.DLL

OSFSHARED.DLL

OSFUI.DLL

WEBSANDBOX.DLL

OSFINTL.DLL

VBUI6.CHM

VBE7INTL.DLL

VBEUI.DLL

VBEUIINTL.DLL

VBEUIRES.DLL

MSBARCODE.DLL

msotelemetry.dll

BRANDING.XML

OLMAPI32.DLL

SOCIALCONNECTOR.DLL

msotelemetryintl.dll

IFDPINTL.DLL

OMICAUTINTL.DLL

MSOIDCLIL.DLL

ADAL.DLL

FIRSTRUN.EXE

WXPNSE.DLL

lyncDesktopResources.dll

TellMeRuntime.dll

MsoExportPdf

TellMeWord.nrr

MsoExportXps

TellMeExcel.nrr

TellMePowerPoint.nrr

TellMeVisio.nrr

TellMeOneNote.nrr

TellMeOutlook.nrr

TellMeOutlookAddr.nrr

TellMeOutlookAppt.nrr

TellMeOutlookMail.nrr

TellMeOutlookMailRead.nrr

TellMeOutlookMeetingReqRead.nrr

TellMeOutlookMeetingReqSend.nrr

TellMeOutlookTask.nrr

TellMeAccess.nrr

PROTOCOLHANDLERINTL.DLL

msointl30.dll

TellMeProject.nrr

MSSRINTL.DLL

Microsoft.Office.PolicyTips.dll

MSO.DLL.x86

MSSOAP30.DLL

GROOVE.EXE

mstr2tsc.dll

PG_INDEX.XML

msaccess.exe

OSPPSVC.EXE.x86

OSPPSVC.EXE.x64

PKEYCONFIG.COMPANION.DLL.CLIENT

OSPPOBJS.DLL.x86

OSPPOBJS.DLL.x64

LOBICLNT.DLL

mso16.x86.dll

vbe.dll_7.1

HrGetExecutingScenario

IMM32.dll

SHELL32.dll

VERSION.dll

SHLWAPI.dll

WININET.dll

CRYPT32.dll

Secur32.dll

msi.dll

ncrypt.dll

InvalidCDKey

InvalidOperation

NoSupportedCulture

SQLAlreadyConnected

SQLFailedToAllocateHandle

SQLFailedToConnect

SQLFailedToExecuteStatement

SQLFailedToRetrieveData

SQLFailedToSetAttribute

InvalidServiceOperation

WinHttpOpenFailed

WinHttpCloseFailed

WinHttpConnectFailed

WinHttpOpenRequestFailed

WinHttpSendRequestFailed

WinHttpReceiveResponseFailed

WinHttpNoData

WinHttpReadDataFailed

WinHttpDataTruncated

OHttpReadTruncated

WinHttpQueryHeadersFailed

WinHttpStatusDenied

WinHttpSetCredentialsFailed

WinHttpSetProxyOptionFailed

FailedToObtainFileURL

WinHttpSetOptionFailed

WinHttpQueryAuthSchemesFailed

AuthSchemeNotSupported

OperationCancelled

WinRTWLIDOperationFailed

WinHttpQueryDataAvailableFailed

MsoHttpNetworkError

MsoHttpServerReachabilityError

MsoHttpNotFoundError

PipelineInsufficientDiskSpace

PipelineErrorConnectToSource

PipelineInsufficientWritePermission

FileTransportError

HttpTransportError

CachedHttpTransportError

BitsTransportError

Normaliz.dll

WINHTTP.dll

invalid map<K, T> key

Comctl32.dll

XmlLite.dll

POWRPROF.dll

urlmon.dll

address family not supported

broken pipe

function not supported

inappropriate io control operation

not supported

operation canceled

operation in progress

operation not permitted

operation not supported

operation would block

protocol not supported

operator

operator ""

MaxPolicyElementKey

pExecutionResource

?#%X.y

%S#[k

UxTheme.dll

credui.dll

osppc.dll

osppcext.dll

InvokeMainViaCRT

ExitMainViaCRT

Microsoft.Office.TelemetryEngine

Microsoft.Office.SessionIdProvider

Microsoft.CRTProvider

F:\Office\Target\x86\ship\click2run\en-us\AdminBootstrapper.pdb

.text$di

.text$mn

.text$x

.text$yd

.idata$5

.CRT$XCA

.CRT$XCAA

.CRT$XCC

.CRT$XCL

.CRT$XCU

.CRT$XCZ

.CRT$XIA

.CRT$XIAA

.CRT$XIAC

.CRT$XIC

.CRT$XIZ

.CRT$XLA

.CRT$XLZ

.CRT$XPA

.CRT$XPB

.CRT$XPX

.CRT$XPXA

.CRT$XPZ

.CRT$XTA

.CRT$XTZ

.rdata

.rdata$T

.rdata$r

.rdata$sxdata

.rdata$zETW0

.rdata$zETW1

.rdata$zETW2

.rdata$zETW9

.rdata$zzzdbg

.rtc$IAA

.rtc$IZZ

.rtc$TAA

.rtc$TZZ

.xdata$x

.didat$2

.didat$3

.didat$4

.didat$6

.didat$7

.idata$2

.idata$3

.idata$4

.idata$6

.data

.data$r

.didat$5

.tls$

.tls$ZZZ

.rsrc$01

.rsrc$02

ShellExecuteExW

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

SetWindowsHookExW

UnhookWindowsHookEx

CertFreeCertificateContext

WinHttpReadData

WinHttpQueryDataAvailable

WinHttpCloseHandle

WinHttpWriteData

WinHttpQueryOption

WinHttpSetOption

WinHttpAddRequestHeaders

WinHttpSendRequest

WinHttpSetCredentials

WinHttpQueryAuthSchemes

WinHttpReceiveResponse

WinHttpQueryHeaders

WinHttpSetStatusCallback

WinHttpConnect

WinHttpSetTimeouts

WinHttpOpenRequest

WinHttpGetDefaultProxyConfiguration

WinHttpGetProxyForUrl

WinHttpGetIEProxyConfigForCurrentUser

WinHttpOpen

ShellExecuteW

WinHttpCrackUrl

InternetCrackUrlW

CertVerifyCertificateChainPolicy

SLGetPKeyInformation

SLGetInstalledProductKeyIds

RegCloseKey

RegCreateKeyExW

RegDeleteKeyW

RegEnumKeyExW

RegQueryInfoKeyW

RegOpenKeyExW

RegNotifyChangeKeyValue

ADVAPI32.dll

GetProcessHeap

GetCPInfoExW

CreateIoCompletionPort

ole32.dll

WS2_32.dll

GDI32.dll

gdiplus.dll

GetCPInfo

Cabinet.dll

WINTRUST.dll

SETUPAPI.dll

IPHLPAPI.DLL

.?AVORegistryKey@@

.PAUIPowerManager@PowerManager@Mso@@

.PAUIThreadpool@Threadpool@Mso@@

.?AU?$default_delete@VGZipEncodingHandler@Http@Mso@@@std@@

.P6G?AV?$TCntPtr@VIRequest@Http@Mso@@@Mso@@AAVRequestBroker@Http@1@@Z

.PAUIServerReachability@ServerReachability@Mso@@

.PAUIOfficeWebServiceApi@OfficeWebServiceApi@Mso@@

.?AVUrlOrPathSettingValidator@C2R@@

.?AV?$_Ref_count@VORegistryKey@@@std@@

.?AVTransportRetry@@

.?AVSourceFailoverTransportRetry@@

.?AV?$_Ref_count@VHttpTransport@C2R@@@std@@

.?AV?$_Ref_count@VBitsTransport@C2R@@@std@@

.?AV?$_Ref_count@VFileTransport@C2R@@@std@@

.?AV?$_Ref_count@VSourceFailoverTransportRetry@@@std@@

.?AVTransport@@

.?AV?$enable_shared_from_this@VTransport@@@std@@

.?AVFileTransport@C2R@@

.?AVHttpLoadRangeAsyncResult@C2R@@

.?AVHttpTransport@C2R@@

.?AV?$_Ref_count@VHttpLoadRangeAsyncResult@C2R@@@std@@

.?AVBitsTransport@C2R@@

.?AV?$_Ref_count@VOHttpTransport@C2R@@@std@@

.?AVOHttpTransport@C2R@@

.?AV?$_Func_base@_NPBVORegistryKey@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAKAAV23@@std@@

.?AV?$_Func_impl@V<lambda_c7622a0c79ea572db0c5e55f05dc9731>@@V?$allocator@H@std@@_NPBVORegistryKey@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@AAKAAV53@@std@@

.?AU_Crt_new_delete@std@@

.?AVstl_critical_section_concrt@details@Concurrency@@

.?AVstl_condition_variable_concrt@details@Concurrency@@

.?AVunsupported_os@Concurrency@@

.?AVinvalid_scheduler_policy_key@Concurrency@@

.?AVinvalid_oversubscribe_operation@Concurrency@@

.?AVinvalid_operation@Concurrency@@

.?AUITopologyExecutionResource@Concurrency@@

.?AVExecutionResource@details@Concurrency@@

.?AUIExecutionResource@Concurrency@@

.?AUIExecutionContext@Concurrency@@

.?AV?$_Func_impl@V<lambda_8fe4d44a5b4b8e1048c664da62c080b7>@@V?$allocator@H@std@@_NPBVORegistryKey@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@AAKAAV53@@std@@

.qC*0

U.Ta*

_7.qO

AÏ/

Z%C>Ch

h8z.nl

!iTXtXML:com.adobe.xmp

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:D8058835E1E211E39806C5D5F67A863B" xmpMM:DocumentID="xmp.did:D8058836E1E211E39806C5D5F67A863B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D8058833E1E211E39806C5D5F67A863B" stRef:documentID="xmp.did:D8058834E1E211E39806C5D5F67A863B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>n

@y.rU

aL.cX

<,`<&%]\

;C~?K%C

;.ul\

9KÎ

&0.FU~

Mp.IB

.nX2bN`

j.WEDV

%.u(^7

.gp$_.rl

%cPZ,

X|.qh

MJ%dI

%U#N6M\

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:A0BCA05BE12D11E3BC18FEA99E1DA578" xmpMM:DocumentID="xmp.did:A0BCA05CE12D11E3BC18FEA99E1DA578"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A0BCA059E12D11E3BC18FEA99E1DA578" stRef:documentID="xmp.did:A0BCA05AE12D11E3BC18FEA99E1DA578"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>%

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:B34A5F90E1E711E39F46AF289DCCEB78" xmpMM:DocumentID="xmp.did:B34A5F91E1E711E39F46AF289DCCEB78"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B34A5F8EE1E711E39F46AF289DCCEB78" stRef:documentID="xmp.did:B34A5F8FE1E711E39F46AF289DCCEB78"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

%Uj](

%U38mJo

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:23A257C5FD8311E384D2D471AF6AB4D4" xmpMM:InstanceID="xmp.iid:23A257C4FD8311E384D2D471AF6AB4D4" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B34A5F90E1E711E39F46AF289DCCEB78" stRef:documentID="xmp.did:B34A5F91E1E711E39F46AF289DCCEB78"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>u

9%C_NN

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.154911, 2013/10/29-11:47:16 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:C87D1CE4E12D11E393F99EDC3E000F53" xmpMM:DocumentID="xmp.did:C87D1CE5E12D11E393F99EDC3E000F53"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C87D1CE2E12D11E393F99EDC3E000F53" stRef:documentID="xmp.did:C87D1CE3E12D11E393F99EDC3E000F53"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

<assemblyIdentity processorArchitecture="*" type="win32" name="Firefly" version="16.0.0.0" />

<assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.1.0" publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

<!--The ID below indicates application support for Windows 7 -->

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

<!--This Id value indicates the application supports Windows 8 functionality-->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

<!-- This Id value indicates the application supports Windows 8.1 functionality-->

<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>

<!-- This Id value indicates the application supports Windows 10 functionality-->

<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>

8%8.878@8

0%0X0

="=,=3=:=

> >$>(>,>0>4>>>

6#6'6 6/666

9!9%9)9-919<9

11

8 98:&;4;:;@;

:%;.;4;:;

5!53595?5

3$434,5\6

2-2C2}2

3H4D4g4o4

6l6x6

5"5 5=5`5|5

>&>9>@>}>

:(:1:?:{:

7)7@7[7~7

)070<0}0

2,2~2

8„8C8R8a8p8

: :$:(:,:0:4:8:<:

7 7$7(7,7

1034383<3

2$3,303<3

1$3(3,303

8 8$8(8,8084888<8@8

9 9$9(9,9094989<9

< <$<(<,<0<4<

7 7$7(7|:

6 8$8(8,80848

3$4(4,40444

9 9(90989@9

0 0$0(0,0004080

5 5(50585@5

1,181@1`1

4(444<4\4

6$6,686\6|6

0,080@0`0

3(343<3\3

0,0004080|1

ChXXp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X

<hXXp://VVV.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0

*31595 04079350-16fa-4c60-b6bf-9d2b1cd059840

EhXXp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z

>hXXp://VVV.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0

$Microsoft Root Certificate Authority0

?hXXp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T

8hXXp://VVV.microsoft.com/pki/certs/MicrosoftRootCert.crt0

$Microsoft Root Certificate Authority

.tq[m

hXXp://office.microsoft.com 0

s.mwZ

*31642 49e8c3f3-2359-47f6-a3be-6c8c4751c4b60

ChXXp://VVV.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a

EhXXp://VVV.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0

)Microsoft Root Certificate Authority 20110

IhXXp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^

BhXXp://VVV.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0

3hXXp://VVV.microsoft.com/pkiops/docs/primarycps.htm0@

)Microsoft Root Certificate Authority 20100

EhXXp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z

>hXXp://VVV.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0

1hXXp://VVV.microsoft.com/PKI/docs/CPS/default.htm0@

EhXXp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z

>hXXp://VVV.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0

`.data

?AuthHandlerSupportAutoLogonBasedOnURL@Http@Mso@@YAXXZ

?OutlookAuthSupportVersion@Authentication@Mso@@YAIXZ

CsiVersionSupportsSecureHttpRedirection

GetProcessWindowStation

portuguese-brazilian

Unicows.dll

Visual C   CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

PSSh(

t.hLuN

vSSSh

XSSSh

xSSSh

FTPjKS

FtPj;S

C.PjRV

t>Ht6Ht.Ht#Ht

t.Ht&Ht

t8Nt.Nt$Nt

j.Xf9D{

~jj.Xf9D{

j.Xf9F

t.j.Xf

3uRj.VQ

EnumWindows

RPCRT4.dll

P:\Target\x86\ship\click2run\en-us\adminbootstrapper.pdb

per.pdb

.?AV<lambda_52D43E82A5F0EE22>@?O@??preauthenticateRequest@CHttpRequestContext_WinHttp@Http@Mso@@UAEXAAVIRequest@34@AAVITokenEnumerator@34@@Z@

.?AV<lambda_162C38B16B11D40>@?BB@??preauthenticateRequest@CHttpRequestContext_WinHttp@Http@Mso@@UAEXAAVIRequest@34@AAVITokenEnumerator@34@@Z@

.?AV<lambda_941CA8726AA3EE7F>@?BN@??preauthenticateRequest@CHttpRequestContext_WinHttp@Http@Mso@@UAEXAAVIRequest@34@AAVITokenEnumerator@34@@Z@

.?AV<lambda_3291A2A164C19B86>@?DO@??preauthenticateRequest@CHttpRequestContext_WinHttp@Http@Mso@@UAEXAAVIRequest@34@AAVITokenEnumerator@34@@Z@

.?AV<lambda_EB8A29BD7DA0B72F>@?EF@??preauthenticateRequest@CHttpRequestContext_WinHttp@Http@Mso@@UAEXAAVIRequest@34@AAVITokenEnumerator@34@@Z@

.?AV<lambda_17C281F65776E03B>@?EN@??preauthenticateRequest@CHttpRequestContext_WinHttp@Http@Mso@@UAEXAAVIRequest@34@AAVITokenEnumerator@34@@Z@

zcÁ

.?AV?$_Ref_count@VORegistryKey@@@tr1@std@@

.?AVOnDemandUninstallWebControl@@

.?AVOnDemandInstallWebControl@@

.?AVOHttp@@

.?AV?$_Impl_base4@_NPBVORegistryKey@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAKAAV23@@tr1@std@@

.?AV?$_Impl_no_alloc4@U?$_Callable_obj@V<lambda_1DDA6BCFC2B97ADD>@?CL@??AreBlockingProductsInstalled@MSIxC2RBlockValidator@@AAE_NXZ@$0A@@tr1@std@@_NPBVORegistryKey@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@AAKAAV53@@tr1@std@@

<assemblyIdentity processorArchitecture="*" type="win32" name="Firefly" version="15.0.0.0" />

<!-- Windows 7 -->

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>

6 6$6(6,6

4 4$4(4,40444

;$;(;,;0;4;

0 0$0(0,0004080<0

4 4$4(4,404

? ?$?(?,?0?4?

7(?,?0?4?8?<?

1 1$1(1,10141

9’9c9s9

? ?$?(?,?0?4?8?<?

8 9@9^9|9

4O4o4

1 1&1:1 2\2

8%9u9

1(141<1\1

4$4,484`4

?,?8?\?|?

6 6$646`6

].Zd&

ETP%D

y6.Ch

*PM.yBQ

.Ja."v

|O1.pz

m.iDx

%fj&!55Q

%x#%X

Qt0f%S^

>n.uF

f-T}h

x6%d:

u.xP)$

)`Q%DK

HvA:d%SOa

^.DdCE

'2`0=`8'

]lø

EW.Lf$

Uudp^

VU.kz

V%ciy

CV%fr

8%u7eOD

BP;B%s

}|q.Yd

fCN_&%F

.eF2n

!u5%c

t* .MX

hSqL

E#%s}

%gC

2147483648

WindowClass_%d

PB_Hotkey

msimg32.dll

&&&&6666????

""""****

2222::::

$$$$\\\\

00006666

####====

6Kernel32.dll

key.key

GetKeyState

EnumChildWindows

USER32.DLL

GDI32.DLL

OLE32.DLL

F.OV]py

%d'l\S

@.bss

.idata

8.up@

mkisofs 2.01-bootcd.ru

.mkisofsrc

W%X%Y%Z%[%

1.1 02/12/01 2002

Z%T%i%f%`%P%l%

%$%a%b%V%U%c%Q%W%]%\%[%

%<%^%_%Z%T%i%f%`%P%l%g%h%d%e%Y%X%R%S%k%j%

Z%T%i%f%`%P%l%}

!"#$%&'()* ,-./

0123456789

MKISOFS ISO 9660/HFS FILESYSTEM BUILDER & CDRECORD CD-R/DVD CREATOR (C) 1993 E.YOUNGDALE (C) 1997 J.PEARSON/J.SCHILLING

boot.catalog

TRANS.TBL

STREAM.IMG;1

Check all imported ISO9660 names from old session

Hide TRANS.TBL from Joliet tree

Rename RR_MOVED to .rr_moved in Rock Ridge tree

No longer supported

Allow more than one dot in filenames (e.g. .tar.gz) (violates ISO9660)

Cannot open '%s'.

Using "%s"

%s:%d: name required

%s:%d: equals sign required after '%.*s'

%s:%d: field name "%s" unknown

Read error on '%s'.

Usage: %s [options] file...

Use %s -help

%s-%c

%s-%s%s

-i option no longer supported.

Illegal iso9660 Level %d, use 1..3 or 4.

Unsupported sector type '%s'.

Option -%c is reserved for future use.

Illegal UCS Level %d, use 1..3.

Illegal Volume Set Size %s

Volume Set Size > 1 not yet supported

%s (%s-%s-%s)

Warning: Disabling Joliet support for DVD-Video.

Warning: ISO-9660 filenames longer than %d may cause buffer overflows in the OS.

read on Linux. On other operating systems you need to call

Unable to open previous session image %s

Unable to open pathname list %s.

THE ROCK RIDGE INTERCHANGE PROTOCOL PROVIDES SUPPORT FOR POSIX FILE SYSTEM SEMANTICS

can't open logfile: %s

re-directing all messages to %s

Unable to find previous session PVD %s

GRAFT:'%s'

GRAFT Point:'%s' in '%s : %s' (%s)

Invalid node - %s

graft_dir: '%s : %s', node: '%s', (scan)

graft_dir: '%s : %s', node: '%s', short_name: '%s'

Total extents scheduled to be written = %d

Implementation botch: %s should start at %u but starts at %u.

Writing: %-40sStart Block %u

Done with: %-40sBlock(s) %d

Implementation botch: FS should end at %u but ends at %u.

%d extents written (%d MB)

FROM: '%s'

ESC: '%s'

Fatal goof, file '%s' already in hash table.

%s000%s%s

NEW name '%s'

Unable to generate unique name for file %s

Using %s for %s%s%s (%s)

Fatal error - RR overflow (reclen %d) for file %s

Unable to sort directory %s

%c %-*s%s

Translation table size mismatch %d %d

./.rr_moved

.rr_moved

**BAD RRVERSION (%d) for %c%c

Scanning %s

Unable to open directory %s

Directories too deep for '%s' (%d) max is %d; ignored - continuing.

Ignoring file %s

Path name %s/%s too long.

Excluded by match: %s

Excluded: %s

Non-existent or inaccessible: %s

File %s is not readable - ignoring

File %s is too large - ignoring

Warning: Directory loop (%s dev: %lx ino: %lu).

Unknown file type (%s) %s - ignoring and continuing.

Unable to stat file %s - ignoring and continuing.

Hidden from HFS tree: %s

Hidden from ISO9660 tree: %s

Hidden ISO9660 attribute: %s

Hidden from Joliet tree: %s

Warning: missing whole name for: '%s'

stat parent->whole_name: '%s' -> %d.

Directories too deep for '%s' (%d) max is %d.

M ] %s

%s_d

cannot fwrite %d*%d

Trying to write %d bytes (not a multiple of 2048).

cannot open '%s'

cannot read from '%s'

%6.2f%% done, estimate finish %s

BError: '%s' and '%s' have the same ISO9660 name '%s'.

Error: '%s' and '%s' have the same Rock Ridge name '%s'.

Cache hit for '%s%s%s'

Fatal goof - could not find dir entry for '%s'

Implementation botch. Video pad for file %s is %d

Either the *.IFO file is bad or you found a mkisofs bug.

The pad was %d for file %s

%s%s%s

%d %d %s

Unexpected directory length %lld expected: %d '%s'

Continuation entry record length mismatch %d expected: %d.

Entry %d not in path tables

Unable to generate sane path tables - too many directories (%d)

Path table lengths do not match %d expected: %d

Total extents scheduled to be written (inc HFS) = %d

Total extents actually written (inc HFS) = %d

(Size of ISO volume = %d, HFS extra = %d)

Predicted = %d, written = %d

Total translation table size: %d

Total rockridge attributes bytes: %d

Total directory bytes: %d

Path table size(bytes): %d

Non zero-length file '%s' assigned zero extent.

find_hash('%s')

Checking name '%s' isorec.name '%s'

'%s' does NOT END OK

Panic: no space, cannot add RR CE entry (%d bytes mising) for %s line %d.

currlen: %d ipnt: %d, recstart: %d

Send bug report to the maintainer.

Negative RR name length residual: %d

XX

Problems with old ISO directory entry for file: '%s'.

Cannot parse Rock Ridge attributes for '%s'.

Warning: Neither Rock Ridge (-R) nor TRANS.TBL (-T)

Read error on old image %s

Previous session has incompatible sector size %d.

Previous session has volume set size %d (must be 1).

Reading old session failed, cannot execute -old-root.

Reading directory %s in old session failed, cannot execute -old-root.

-old-root (sub)directory %s not found in old session.

%%/%c

Joliet path table lengths do not match %d expected: %d

Unexpected joliet directory length %d expected: %d '%s'

Error: %s and %s have the same Joliet name

VIDEO_TS.IFO

Can't open sort file list %s

Can't allocate memory for %s filename

Can't open %s file list %s

Old session has illegal name '%.*s' length %d

New session will use name '%s'

.tar.gz

.ps.gz

Uh oh, I cant find the boot catalog directory '%s'!

Uh oh, I cant find the boot catalog '%s'!

Uh oh, I cant find the boot image '%s' !

Size of boot image is %d sectors ->

Error opening boot image '%s' for read.

Error reading MBR from boot image '%s'.

Warning: boot image '%s' MBR is not a boot sector.

Boot image '%s' has multiple partitions.

Warning: image size does not match geometry (%d)

Boot image '%s' has no partitions.

Error - boot image '%s' has not an allowable size.

Error opening boot image file '%s' for update.

Odd alignment at non-end-of-file in boot image '%s'.

Boot image file '%s' changed underneath us!

Cannot access '%s'.

Partition %d may not have a filename.

Total extents including %s boot = %d

%s: option `%s' is ambiguous

%s: option `--%s' doesn't allow an argument

%s: option `%c%s' doesn't allow an argument

%s: option `%s' requires an argument

%s: unrecognized option `--%s'

%s: unrecognized option `%c%s'

%s: illegal option -- %c

%s: option requires an argument -- %c

ATIP start of lead in: %ld (d:d/d)

ATIP start of lead out: %ld (d:d/d)

.finderinfo/

.resource/

.AppleDouble/

.rsrc/

FINDER.DAT

RESOURCE.FRK/

finder.dat

resource.frk/

.HSancillary

.HSResource/

warning: %s doesn't appear to be a %s file

.finderinfo

.resource

.ADeskTop

.IDeskTop

.rootinfo

.Desktop

.DeskServer

.Label

.AppleDouble

.AppleDesktop

RESOURCE.FRK

FILEID.DAT

resource.frk

fileid.dat

.HSResource

Name: %s

File type: %s

HFS Name: %s

ISO Name: %s

CREATOR: %s

%s%*s%*1s%c%c%c%c%*1s%*1s%c%c%c%c%*1s

error scanning afpfile %s - continuing

%4s%4s

can't HFS format %s

can't HFS mount %s

can't HFS create file %s

can't HFS open %s

can't HFS set attributes %s

can't HFS close file %s

can't HFS create folder %s

HFS scanning %s

Using HFS name: %s for %s

can't locate relocated directory %s

can't find directory location %s

Blessing %s (%s)

Creating %d PReP boot partition(s)

Uh oh, I cant find the boot image "%s"!

PReP boot partition %d is "%s"

unable to stat HFS boot file %s

unable to open HFS boot file %s

unable to read HFS boot file %s

%s is not a HFS boot file

unable to seek HFS boot file %s

unable to read HFS boot block %s

%s does not contain a valid boot block

Creating HFS Label %s %s

Faild to seek VIDEO_TS.IFO

Faild to read VIDEO_TS.IFO

%s/VIDEO_TS/VTS_d_0.IFO

%s/VIDEO_TS/VIDEO_TS.IFO

Faild to open %s

Can't open device '%s'

Can't open VMG info for '%s'.

Can't stat %s

Either VIDEO_TS.IFO or VIDEO_TS.VOB is not of correct size

%s/VIDEO_TS/VIDEO_TS.VOB

calc: Can't stat %s

Either VIDEO_TS.IFO or VIDEO_TS.VOB is not of correct size.

%s/VIDEO_TS/VTS_i_0.IFO

%s/VIDEO_TS/VTS_i_0.IFO appears to be corrupted.

%s/VIDEO_TS/VTS_i_0.VOB

%s/VIDEO_TS/VTS_i_%i.VOB

%s/%s

/VIDEO_TS/VIDEO_TS.IFO

/VIDEO_TS/VTS_i_0.IFO

/VIDEO_TS/VIDEO_TS.BUP

/VIDEO_TS/VTS_i_0.BUP

Could not open %s

cdrecord.ini

unsupported b*-tree node size

Possible Catalog file overflow - please report error

unsupported block size

unsupported partition map signature

unsupported start of partition logical data

String too long: %s

%s: %r

Error %d

%s: %s. %r

../../gcc-3.4.5/gcc/config/i386/w32-shared-ptr.c

msvcrt.dll

.file

crt1.c

crtstuff.c

_graftcp

_errmsg

CRTglob.c

CRTfmode.c

CRT_fp10.c

.idata$7p

.idata$5H

.idata$7t

.idata$5L

.idata$7L

.idata$5$

.idata$6P

.idata$7x

.idata$5P

.idata$7|

.idata$5T

.idata$7d

.idata$5<

.idata$7P

.idata$5(

.idata$6\

.idata$7l

.idata$5D

.idata$7h

.idata$5@

.idata$7\

.idata$54

.idata$6x

.idata$7`

.idata$58

.idata$7X

.idata$50

.idata$6p

.idata$7T

.idata$5,

.idata$6h

.idata$5

.idata$5X

.idata$7

.idata$5p

.idata$4$

.idata$5x

.idata$68

.idata$5h

.idata$6D

.idata$5l

.idata$5`

.idata$5d

.idata$7@

.idata$4|

.idata$7$

.idata$4`

.idata$4D

.idata$6X

.idata$4(

.idata$4T

.idata$6|

.idata$4P

.idata$6t

.idata$70

.idata$4l

.idata$4<

.idata$4@

.idata$6L

.idata$4H

.idata$6d

.idata$74

.idata$4p

.idata$5|

.idata$4L

.idata$6l

.idata$7H

.idata$7D

.idata$7

.idata$4\

.idata$5\

.idata$6$

.idata$48

.idata$6<

.idata$4X

.idata$7(

.idata$4d

.idata$7,

.idata$4h

.idata$44

.idata$64

.idata$4,

.idata$6

.idata$6,

.idata$5t

.idata$4

.idata$40

.idata$6(

.idata$7<

.idata$4x

.idata$78

.idata$4t

.idata$6`

.idata$2(

.idata$60

.ctors

___mingw_CRTStartup

_mainCRTStartup

_WinMainCRTStartup

_match_key

_r_packcatkey

_r_unpackcatkey

_r_packextkey

_r_unpackextkey

_r_comparecatkeys

_r_compareextkeys

_r_makecatkey

_r_makeextkey

_errmsgno

_errmsgstr

sjl_fc_key.2

eh_globals_key.5

__libmsvcrt_a_iname

___crt_xl_start__

___crt_xi_start__

___crt_xi_end__

___crt_xp_start__

___crt_xp_end__

__head_libmsvcrt_a

__CRT_fmode

___crt_xc_end__

___crt_xc_start__

___crt_xt_start__

__CRT_glob

___crt_xt_end__

Thawte Certification1

hXXp://ocsp.thawte.com0

.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0

hXXp://ts-ocsp.ws.symantec.com07

 hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0<

 hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(

2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,

/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D

hXXps://VVV.verisign.com/rpa0

hXXp://ocsp.verisign.com0;

/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0

<VeriSign Class 3 Public Primary Certification Authority - G50

DhXXp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0

hXXps://VVV.verisign.com/cps0*

#hXXp://logo.verisign.com/vslogo.gif04

#hXXp://crl.verisign.com/pca3-g5.crl04

hXXp://ocsp.verisign.com0

hXXp://VVV.vmware.com/0

.xDC H

Z_%XB

.cNGwj

D.YRTq

j.xSb

8.Gyg

.qbr 9%

.VglH

%Dl@{

%2xH6|

64.lQ

\7TCp|6

]4.yU

.FUMP

@.Tl`}uA

?S.Gf

:.Zh@

|%dPS

jS.sf

-%UG.

..wQT

75%uJj

7s.Ri$h

y9.JX?1

sy.QQX

`W.to

.of;-@y

<9u>%F

9ry.yO

%u*5h

KERNEL32.DLL

WSOCK32.dll

ReportEventA

GetWindowsDirectoryW

WINSPOOL.DRV

CreatePipe

PeekNamedPipe

ExitWindowsEx

RegisterHotKey

UnregisterHotKey

keybd_event

RegOpenKeyW

RegCreateKeyW

CryptDeriveKey

CryptDestroyKey

ADVAPI32.DLL

OLEAUT32.DLL

SHFileOperationW

SHELL32.DLL

WSOCK32.DLL

WINMM.DLL

ICMP.DLL

IMAGEHLP.DLL

MSI.DLL

NETAPI32.DLL

SETUPAPI.DLL

URLDownloadToFileW

UrlMkSetSessionOption

URLMON.DLL

USERENV.DLL

DeleteUrlCacheEntryW

InternetOpenUrlW

UnlockUrlCacheEntryFileW

WININET.DLL

version="1.0.0.0"

name="CompanyName.ProductName.YourApp"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel

.----/01/01/01

DSOUND.DLL

RICHED32.DLL

lntdll.dll

%s*.*

Kernel32.DLL

dUser32.DLL

HKEY_CLASSES_ROOT\Installer\Products\00006109C80000000000000000F01FEC

/Office/Data/c2rfireflydata.xml hXXp://officecdn.microsoft.com/pr/

taskkill.exe

\Setup15.exe

\setup15.exe

Coded by: Ratiborus, forum.ru-board.com

files\configure.xml

KMSactivator.vbs //NoLogo /KEY:OFS /FORC

\Uninstall.xml

/stream.x86.x-none.dat hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/

\Configure.xml

mkisofs.exe

Windows 95

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.

Windows 98

advapi32.dll

Advapi32.dll

\wzt.dat

OffScrub_O16msi.vbs /CLIENTALL

lync.EXE

/Office/Data/v64.cab hXXp://officecdn.microsoft.com/pr/

VersionToReport

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProplusRetail - en-us

1.2.5

/fre.cab hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/

HKEY_LOCAL_MACHINE\SOFTWARE\Novell\NetWareWorkstation\CurrentVersion

\x64\cleanospp.exe

HKEY_CLASSES_ROOT\.

has joined the domain

hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/c2rfireflydata.xml hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32_

[0-9]{2}.[0-9]{1}.[0-9]{4}.[0-9]{4}

Not joined to any domain or group

compilers\pbcompiler.exe

user32.dll

/s640.cab hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/

Windows Vista

/stream.x64.x-none.dat hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/

Portuguese

certmgr.exe

OffScrub_O15msi.vbs /CLIENTALL

conv16.dat

\\.\PhysicalDrive

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion

\mkisofs.exe

OffScrubC2R.vbs

\v32.hash

\x86\cleanospp.exe

\s320.cab

NetApi32.dll

Netapi32.dll

netapi32.dll

\Media\Windows Error.wav

\KMSActivator.vbs.aes

Windows 2000

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

\55c92734-d682-4d71-983e-d6ec3f16059f

\55C92734-D682-4D71-983E-D6EC3F16059F

FakeClient.exe

CryptDeriveKey_() failed

/t /f /IM setup15.exe

Version.dll

KMSActivator.VBS //NoLogo

schtasks.exe

\wgetx.exe

Port

Joined to the group:

\OffScrub_O16msi.vbs

Program Files\Microsoft Office\Office16\OSPP.VBS

hXXp://forum.ru-board.com

\OInstall.tmp

Windows Me

Netsh.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.

\files.dat

Joined to the domain:

Ý/%mm/%yy %hh:%ii:%ss

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs

\Office\Data\v32.cab

\stream.x86.x-none.dat

route.exe

\i640.cab

\OffScrubC2R.vbs

HKEY_USERS

/t /f /IM KMSS.exe

shell32.dll

/s640.cab hXXp://officecdn.microsoft.com/pr/

.iso" "

\bin\KMSS.exe

ospp.vbs /rearm

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment

Selected folder contains build different from downloaded. Operation can Not Continue.

\log.txt

kmss.dat

-add wzt.cer -n wzt -s -r localMachine ROOT

set filesystem = CreateObject("scripting.Filesystemobject")

\OInstall.tmp" /Y

-udf -log-file log.txt -volid

conv15.dat

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs\

cscript.exe

HKEY_CLASSES_ROOT\Installer\Products\00006109F80000000100000000F01FEC

\stream.x64.x-none.dat

HKEY_CURRENT_CONFIG

\VersionDescriptor.xml

HKEY_CURRENT_USER

ClientVersionToReport

\kmss.dat

NetUserChangePassword

-Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort

KMSactivator.vbs //NoLogo /KEY:OFS

HKEY_CLASSES_ROOT\

.cab hXXp://officecdn.microsoft.com/pr/

HKEY_CLASSES_ROOT\Applications\

\Office\Data\v32.cab"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\

Unjoined

Set objFolder = objShell.Namespace(filesystem.GetParentFolderName(Wscript.Arguments(0)))

Windows 2003 Server

Set objFolderItem = objFolder.ParseName(filesystem.GetFileName(WScript.Arguments(0)))

492350f6-3a01-4f97-b9c0-c7c6ddf67d60

\0ff1ce15-a989-479d-af46-f275c6370663

\0FF1CE15-A989-479D-AF46-F275C6370663

\KMSactivator.VBS

\KMSActivator.vbs

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform

/t /f /IM wgetx.exe

/i640.cab hXXp://officecdn.microsoft.com/pr/

KMSactivator.vbs //NoLogo /C

Setup16.exe

\kmss.dat.aes

hXXp://goo.gl/eD7s9X

RegDeleteKeyExA

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration

kernel32.dll

files.dat

files\setup16.exe

has joined the group

Windows 2012 Server

KMSactivator.vbs //NoLogo /ADR:

KMSactivator.vbs //NoLogo /CO16

Program Files (x86)\Microsoft Office\Office16\OSPP.VBS

install.rdf

Mpr.dll

/Office/Data/v32.cab hXXp://officecdn.microsoft.com/pr/

hXXps://technet.microsoft.com/en-us/library/mt455210

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform

/s320.cab hXXp://officecdn.microsoft.com/pr/

/fre.cab hXXp://officecdn.microsoft.com/pr/

/download Download.xml

127.0.0.2

255.255.255.255

psapi.dll

\s640.cab

sc.exe

\cmd.exe

HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

\x86\msvcr100.dll

[0-9]{1,}.[0-9]{2}%

/configure d:\MyPath\Configuration.xml

\autorun.inf

Windows NT 3.51

Set objShell = CreateObject("Shell.Application")

replace.bat

\conv16.dat

Windows 2008 Server

Last.js

HKEY_CLASSES_ROOT

/stream.x86.x-none.dat.cobra

7ffbc6bf-bc32-4f92-8982-f9dd17fd3114

\Setup16.exe

\setup16.exe

NetJoinDomain

hXXp://officecdn.microsoft.com/pr/

\OInstall.xml

Windows 7

Windows 8

SelfDelete.bat

/t /f /IM FakeClient.exe

/stream.x64.x-none.dat hXXp://officecdn.microsoft.com/pr/

hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/c2rfireflydata.xml hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v64.cab hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v64_

Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP

\prefs.js

Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=

\OInstall.exe

aes.dat

NetUnjoinDomain

\install.rdf

KMSactivator.vbs //NoLogo /CO

\hash.txt

\OffScrub_O15msi.vbs

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\15.0\ClickToRun\ProductReleaseIDs\Active\

\Media\Windows Notify.wav

\i320.cab

.cab hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/

\wgetx.exe"

Setup15.exe

64256afe-f5d9-4f86-8936-8840a6a4f5be

\x64\msvcr100.dll

\Download.xml

wzt.dat

files\setup15.exe

profiles.ini

/stream.x64.x-none.dat.cobra

If Replace(objVerb.name, "&", "") = "

hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab

/s320.cab hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/

\Sysnative\cmd.exe

Set colVerbs = objFolderItem.Verbs

Windows NT4

0.0.0.0

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla

/stream.x86.x-none.dat hXXp://officecdn.microsoft.com/pr/

/i320.cab hXXp://officecdn.microsoft.com/pr/

A1D255FE-49BB-4A88-ADE8-4EC08D98FBD4

PureBasic.exe\DefaultIcon\

\59A52881-A989-479D-AF46-F275C6370663

Windows 2008 R2 Server

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

-add wzt.cer -n wzt -s -r localMachine TRUSTEDPUBLISHER

HKEY_CLASSES_ROOT\Installer\Products\00006109C80090400000000000F01FEC

0.0.0.0

100.100.0.10

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ProplusRetail - ru-ru

5.21.003

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\

/configure Uninstall.xml

/configure Configure.xml

NetGetJoinInformation

" Then objVerb.DoIt

Windows XP

Ý%mm%yy-%hhh%iim%sss.js

0.0.0.0 IF 1

\aes.dat

hXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/

unable to call IWbemServices::ExecQuery

/Office/Data/v32.cab

/t /f /IM setup16.exe

EXTRAC32.exe

%mm.Ý.%yyyy-%hh.%ii.%ss

\conv15.dat

7z.sfx

7z.sfx.exe

OfficeClickToRun.exe

IntegratedOffice.exe

VersionDescriptor.xml

AttemptGetKey

hXXp://officeredir.microsoft.com/r/rlidOfficeWebHelp?p1=OCSAC2R%s&ver=16&clid=%d&helpid=%"%s-%s-%s%"&app=webview

hXXp://officecdn.microsoft.com

c2r32.dll

hXXp://

root hkey is expected

Failed to create registry key: registry key name "%s" is too long

Failed to create registry key "%s\%s": %d

/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60

/pr/64256afe-f5d9-4f86-8936-8840a6a4f5be

/pr/b8f9b850-328d-4355-9145-c59439a0c4cf

/pr/7ffbc6bf-bc32-4f92-8982-f9dd17fd3114

0xx

, Error:0x%x

CoInitializeEx(0, %d) failed; Appartment type: current=%d,requested=%d. Error code: 0xx.

CoInitializeEx(0, %d) failed. Error code: 0xx.

@C2R.exe

AdminBootstrapper::Main: Installation came back with %d.

OException has occured %s. Exiting bootstrapper.

Exception has occured %s. Exiting bootstrapper.

Windows OS Version not set.

RuleResultPacket reports invalid column.

Null byte pointer passed to PayloadBuilder::GetUTF8String

Invalid type passed to GetUTF8String

ETW_Keywords

Invalid GUID string: %s

OTele.dat

OTeleCritical.dat

OTeleMediumCost.dat

{*} (*) - *

Windows Version not set.

Given FieldType is not supported on Rule Results.

Stream operation failed.

HAX Http Request

Xl Keyboard Input

Word Keyboard Input

Url Liblet

Project XCMD

Assert Reporting

Datapoint Reporting

Visio Text Operations Handler

Csi Web Service Requests

Nexus Transport

OfficeTelemetry_TelemetryTransport

OfficeTelemetry_HTTPTransport

Outllib_Default_Keyword

OneNote.LegacyLog

OneNote.Storage.Cache

OneNote.Optimization

OneNote.Storage.Replication

OneNote.Storage.ObjectSpaceStoreCell

OneNote.Storage.Backup

OneNote.Ocr

OneNote.Canvas.Print

OneNote.Canvas.EmbeddedFiles

OneNote.Storage.Presence

OneNote.System.WindowEvents

OneNote.Capture.LaunchScreenClip

OneNote.System.LaunchViaArguments

OneNote.Canvas.Editors

OneNote.Canvas.Image

OneNote.Canvas.Ink

OneNote.Navigation

OneNote.NotebookManager

OneNote.Capture.ClickNote

OneNote.Capture.QuickNotes

OneNote.Canvas.Audio

OneNote.Canvas.NoteTag

OneNote.Canvas.Math

OneNote.Canvas.Text

OneNote.PageAnalysis

OneNote.Canvas.Undo

OneNote.System.BootDialogs

OneNote.Whiteboard

OneNote.System.Resume

AcceleratorKeys_Default_Keyword

Rpc_Default_Keyword

OutlookAddressWell_Default_Keyword

OutlookGlobal_Default_Keyword

OutlookGlobal_LeakReport

Mapi_OWinHTTP

Mapi_Transport

Mapi_NetworkCallReporter

Outlmime_Default_Keyword

Outlph_Default_Keyword

Rpc_HTTPTransport

Rpc_HTTPClient

HxCalendarAppImmSystemEvents_WindowsBackgroundTask

HxCalendarAppImmSystemEvents_WindowsPushNotification

HxMailXaml_WebView

HxPeopleGlobal_Default_Keyword

Microsoft_Office_Word_KeyboardInput

WebServiceApi

Identity Http Client

HxMailXaml_Default_Keyword

HxSharedServiceApi_HttpSockets

HxSharedServiceApi_HttpSocketResponseLevel

HxSharedServiceApi_WebSockets

OfficeFastModel_Default_Keyword

MsoLegacyDebugSupport

HxSharedServiceApi_HttpRequests

Identity_Default_Keyword

HxCalendarLocalStorage_StorageAccessHelper

HxCalendarLocalStorage_HxsDraftProvider

IdentityShipAssert

WordWebScalingView

Proofing - Spelling not Supported

Calendar_Default_Keyword

Css_Default_Keyword

Emsmdb_Default_Keyword

InetProtocols_Default_Keyword

Mapi_Default_Keyword

Network_Default_Keyword

Ost_Default_Keyword

Pst_Default_Keyword

Pstprx_Default_Keyword

Search_Default_Keyword

Microsoft_Office_Word2_WebScalingView

OneNote.TestAutomation

OneNote.System.LiveTiles

Edp_Default_Keyword

Outllib_WebExt

PPT Keyboard Input

OneNote.Accessibility

OfficeTelemetryTest_Keyword1

OfficeTelemetryTest_Keyword2

OfficeTelemetryTest_Keyword3

OfficeTelemetryTest_Keyword4

OfficeTelemetryTest_Keyword5

SharePointWorkspace_HTTPStatus

OneNote.DemoMode

OneNote.License

OneNote.Storage.EnterpriseDataProtection

OneNote.System.AboveLock

OneNote.System.AppContract

OneNote.Storage

Microsoft Access File operations telemetry

OneNote.First Run

OEP Rich API Pipeline

OneNote.Storage.WindowsPhoneUpgrade

OneNote.Navigation.QuickFiling

OneNote.Ribbon

OneNote.Canvas.IFrame

OneNote.System.Input

CocoaUI.CocoaUIDocumentShell

PCX.ContactCard.Flyout

PCX.ContactCard.Tab

PCX.ContactCard.Button

PCX.ContactCard.Hyperlink

PCX.ContactCard.Edit

PCX.ContactCard.State

Advertisement Campaign Reporting

Keychainaccess

OLEO.trace

http.request

vba.generic

CocoaUI.TaskPane

CocoaUI.TaskPane.iOS

CocoaUI.ThemePreferences

CocoaUI.RibbonButton

OneNote.PagePreviews

OneNote.Experiments

OneNote.Notifications

OneNote.WatchKitExtension

OneNote.Canvas.Render

OneNote.WordNLVUpsell

OneNote.Referrals

OneNote.NotebookManagement

OneNote.SearchManager

OneNote.URLPageCreation

outlook.account.identity

outlook.accounts

outlook.app.navigation

outlook.build

outlook.calendar

outlook.categories

outlook.clutter

outlook.cocoa.appleevent

outlook.cocoa.cdhxhelper

outlook.cocoa.dldetection

outlook.cocoa.domnode

outlook.cocoa.folderlistjump

outlook.cocoa.onlinemeeting

outlook.cocoa.views

outlook.olkcore.dbrecordcache

outlook.database

outlook.database.checkandfix

outlook.database.messagequeue

outlook.database.notifications

outlook.database.spotlight.index

outlook.database.recordvalidation

outlook.dataprovider.changenotification

outlook.dataprovider.fileio

outlook.dataprovider.rebuild

outlook.dataprovider.recovery

outlook.dataprovider.sql

outlook.dataprovider.transaction

outlook.device.metadata

outlook.account.exchange.addaccount.config

outlook.exchange.delegation

outlook.exchange.ews

outlook.exchange.ews.response.codes

outlook.exchange.ews.response.errors

outlook.exchange.oab

outlook.exchange.openotherusersfolder

outlook.exchange.outofoffice

outlook.exchange.syncmap

outlook.export

outlook.fullscreen

outlook.account.imap

outlook.import

outlook.account.ldap

outlook.mail

outlook.mail.antispam

outlook.mail.attachment

outlook.mail.outbox

outlook.misc

outlook.network

outlook.network.connectioncache

outlook.onlinearchive

outlook.performance

outlook.account.pop

outlook.powerplant

outlook.process

outlook.rules

outlook.selection

outlook.spotlight.search

outlook.statetracker

outlook.sync

outlook.tasks

outlook.test

outlook.test.automation

outlook.threading

outlook.toolkit.fileutils

outlook.database.upgrade

outlook.cocoa.events.userinteraction

outlook.uti

outlook.weather

OneNote.Indexer

OneNote.Authentication

OneNote.Canvas.TodoList

OneNote.App

OneNote.AppFeedback

OneNote.AllNotes

OneNote.ShareExtension

OneNote.TodayExtension

Excel Keyboard Shortcut

OneNote.PadMultitasking

OneNote.Canvas.Schema

OneNote.Storage.Fishbowl

OneNote.System.AppLifeCycle

OneNote.Storage.Merge

OneNote.Storage.RealTime

OneNote.Storage.CellStorage

OneNote.Capture.UI

OneNote.ShareCharm

OneNote.Legacy.ShipLog

OneNote.Canvas.Input

OneDrive Client Transport

PCX.PeopleSearch.PickerAutoComplete

PCX.Persona.Photo

Exchange Web Services

PCX.PeopleSearch.Algorithm

Graph Import Desktop UI

PCX.IM.Utils

PCX.MailTip.SuggestedRecipients

PCX.MailTip

UnitTest.Test

Outllib_KeyboardNavigation

_Rules.xml

OTele_ETW_RuleProcessing_ReadMetadataKeywordsFailed

BCall to ITelemetryTransport::SubmitPayload failed.

TryParseConfig failed because at least one of required regkey is empty or 0.

MsoGetRemoteHostNetworkStatusWithUrlType failed

Passthrough

hXXp://msdn.microsoft.com/en-us/library/windows/desktop/ms753129(v=vs.85).aspx

Line=%d Position=%d

Hourly

Error processing Operator type

Error processing UnaryOperator type

Operator

UnaryOperator

Keywords

IHttpResponse

IOTele_ETW_NexusTransport_RuleRetrieveEnd

OTele_ETW_NexusTransport_RuleRetrievedSize

OTele_RulesService_UnknownHttpResponse

Http Status

Http stream should not be empty.

RulesXmlDir key set

The rules xml vector passed to WriteRulesToDisk is empty

%u.%u.%u.%u

OTele_ETW_NexusTransport_PayloadSendStart

OTele_ETW_NexusTransport_PayloadSendEnd

TelemetryTransport::ProcessRuleResultPayload failure.

HttpStatus

Microsoft.Office.RuleResults

Eadvapi32.dll

Keyword/Level pair is not enabled.

Payload%u

%d_%d

OpportunisticProcessingLevelInBytes

d-d-dTd:d:dZ

Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

failed to copy string '%s' to buffer of size %Iu

Failed to copy string '%S' to buffer.

Failure returned attempting to open cached key

KeyPath

Requested key path is too long

Failed to find a cached key anywhere in the chain?

Failed to make progress in the key chain?

Failed to create key with read-only access

Failed to open key with read-only access

OrapiWriteFail: CacheKey in WriteValue

Exception in MsoRegCreateKeyEx

Exception in MsoRegOpenKeyEx2

Exception in MsoRegDeleteKey

AllowConsecutiveSlashesInUrlPathComponent

MsoHttpVerbose

TransportNetworkBackoff

[Windows

Windows NT

WindowsUpdate

Windows Error Reporting

CipherKeyBits

PasswordSpinCount

[WinHttpSecureProtocols

NewKeyOnPwdChange

ykernel32.dll

mso.dll

00000000-0000-0000-0000-000000000000

.corp.microsoft.com

corp.microsoft.com

hXXp://VVV.w3.org/2000/09/xmldsig#

CNG Create Hash Error: 0xx, HashAlg: %s, HMAC Salt: %u bytes

CNG Algorithm Creation Error: 0xx, %S: %s, Flags: %u

3DES TWO KEY

CNG Context Search Error: 0xx, Context: %s, %S: %s

[Kernel32.dll

HPOWRPROF.DLL

Feedback pipe (SQM/CEIP) enabled?

I%S (%#x)

Structured trace failed validation due to duplicate key names.

%s_%d.%d.%d.%d_%s%s

WM_MSOEXECUTECMD

MSWHEEL_ROLLMSG

I%s%s

Mso::Http[%s]: calling WinHttpQueryDataAvailable

Mso::Http[%s]: calling WinHttpReadData

Mso::Http[%s]: ReadComplete with %u bytes read

Mso::Http[%s]: Read is finished

[GZipEncodingHandler] AddHeaderIfSupported

Received PASSPORT auth scheme - ignoring

[HttpUtil] ChooseAuthScheme

[HttpUtil] GetRequestIdFromSettings

[HttpUtil] IsKnownProxyError

SupportedSchemes

WindowsAutoLogonLevel

IHasPassword

IWinHttp handle is null

[HttpWin] CreateAndValidateMsoUrl

Failure due to invalid HTTP URL.

Failure due to invalid absolute URL.

[HttpWin] CHttpRequest_WinHttp

[HttpWin] getResponseHeader

[HttpWin] sendInternal

Sending request for Url.

WinHttpSendRequest failed

WinHttpWriteData failed

WinHttpReceiveResponse failed

Request for Url is sent.

Failed to send WinHttp request.

[HttpWin] statusText

Valid url is expected for pre-auth

Setting AutoLogonLevel on the WinHttp request handle.

[HttpWin] processRequestSettings

[HttpWin] authScheme

WinHttpQueryAuthSchemes returned.

CHttpRequest_WinHttp::authScheme: Logging failure

CHttpRequestContext_WinHttp::initializeContext

CHttpRequestContext_WinHttp::initializeNewRequest

[HttpWin] preauthenticateRequest

WinHttpSetOption failed to set WINHTTP_OPTION_SECURITY_FLAGS

HttpWin set ignore SSL cert warning.

HttpWin Failed to set autologon level

HttpWin failed to set WINHTTP_OPTION_CLIENT_CERT_CONTEXT

Setting certificate.

HttpWin Failed to add LiveId auth header

HttpWin Failed to add Cookie header

HttpWin Failed to add ADAL token

Authenticating with name/password.

IMso::Http::Details::ResourceUsageNetworkMonitorTemplate<class Mso::Http::Details::NetworkUsageProductionBase>::ReportEndOfResponse

Mso::Http::Details::ResourceUsageNetworkMonitorTemplate<class Mso::Http::Details::NetworkUsageProductionBase>::ReportResponseReceived

Invalid/missing entries (i.e. username, password)

User must change some account setting (i.e. password)

The authentication operation was canceled

The identity has not been validated by a successful HTTP request

ADFS retryable config error. This error is retryable by collecting and sending in password

J[HttpWin_Async] open

Http open request.

[HttpWin_Async] getResponseHeader

[HttpWin_Async] sendInternal

[HttpWin_Async] statusText

[HttpWin_Async] processRequestSettings

Setting WINHTTP_OPTION_DISABLE_FEATURE |= WINHTTP_DISABLE_COOKIES on the WinHttp request handle.

[HttpWin_Async] ProcessResponseTimeoutSetting

[HttpWin_Async] authScheme

[HttpWin_Async] abort

CHttpRequest_WinHttp_Async::WinHttpCallbackStatic

HINTERNET passed to WinHttp callback does not match HINTERNET stored on IRequest

[HttpWin_Async] WinHttpCallback

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_WRITE_COMPLETE

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_SENDREQUEST_COMPLETE

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_HEADERS_AVAILABLE

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_DATA_AVAILABLE

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_READ_COMPLETE

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_SECURE_FAILURE

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_REQUEST_ERROR: result: %u; error: %u

Got a ERROR_WINHTTP_RESEND_REQUEST - Resending the request now

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_REQUEST_ERROR with no WINHTTP_ASYNC_RESULT

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_HANDLE_CLOSING

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_CONNECTING_TO_SERVER

Mso::Http[%s]: received WINHTTP_CALLBACK_STATUS_REDIRECT

[CHttpRequest_WinHttp_Async] AdvanceProxy

NotSupported

UnsupportedAuthScheme

ClientCertificateRequired

HttpResult

Received a relative redirect URL and could not appropriately resolve it.

Error: failed to create http request settings.

Trouble with initialization of http context

Mso::Http[%s]: calling WinHttpSendRequest

Mso::Http[%s]: SendRequestHelper::WriteStream: Calling WinHttpWriteData with %u bytes (%u bytes already written)

Mso::Http[%s]: SendRequestHelper::WriteStream: No data to write

Mso::Http[%s]: calling WinHttpReceiveResponse

Error: Failed to send request for Url.

Q%s/16.0 (Windows NT %d.%d; %s 16.0.%d; %s)

Could not create CWinHttpProxyHandler

[CWinHttpHelperBase] InitializeComm

[CWinHttpHelperBase] SetWinHttpSecureProtocols

Error: InitConnection failed in WinHttpConnect.

[CWinHttpHelperBase] InitConnection

[CWinHttpHelperBase] CreateRequest

Error: CreateRequest failed in WinHttpOpenRequest.

Error: CreateRequest failed in WinHttpSetStatusCallback.

[CWinHttpHelperBase] NewProxySetAndShouldRetry

ProxyBypass

Error: Failed in WinHttpOpen with no proxy.

[CWinHttpHelperBase] OpenWinhttpSessionWithoutProxy

[CWinHttpHelperBase] AutomaticProxyConfiguration

InitSession detected proxy, and auto config URL.

Proxies were returned from WinHttpGetProxyForUrl.

InitSession detected proxy option named proxy, and bypass.

[CWinHttpHelperBase] SetNamedProxyServerOption

InitSession detected named proxy, and bypass.

Error: InitSession failed in WinHttpOpen with named proxy.

[CWinHttpHelperBase] InitSession

[CWinHttpProxyHandler] InitProxyList

Failed to split the proxies returned by WinHttpGetProxyForUrl into the proxy list!

The proxy list was cached using the given proxy string from WinHttpGetProxyForUrl.

[CWinHttpProxyHandler] NewProxySetAndShouldRetry

[CWinHttpProxyHandler] FindAndSetcurrentProxy

[CWinHttpProxyHandler] FindAndSetNextProxy

CWinHttpProxyHandler

J[CWinHttpSessionManager] WinHttpOpen

[CWinHttpSessionManager] WinHttpClose

IwsStats.PrivateWorkingSet

wsStats.TotalWorkingSet

wsStats.VirtualSet

wsStats.WorkingSetPeak

URLPOLICY_CREDENTIALS_SILENT_LOGON_OK

URLPOLICY_CREDENTIALS_MUST_PROMPT_USER

URLPOLICY_CREDENTIALS_CONDITIONAL_PROMPT

URLPOLICY_CREDENTIALS_ANONYMOUS_ONLY

URLZONE_LOCAL_MACHINE

URLZONE_INTRANET

URLZONE_TRUSTED

URLZONE_INTERNET

URLZONE_UNTRUSTED

AllowAutoLogon: CredUsePolicy for %s is %s

AllowAutoLogon: %s is in %s

AllowAutoLogon is called for %s

Unexpected failure in Mso::Url::AllowAutoLogon

.mhtml

https

rlogin

webcal

webcals

%.*s%s%s

{00000000-0000-0000-0000-000000000000}

\\?\Volume

\\?\UNC\

P\\?\

LContent.MSO

office.odf

%s_%s

application/vnd.ms-nexus-telemetrydata-v3 bond

LShouldExecuteRequest is returning false because payload size is greater than limit.

ShouldExecuteRequest is returning false because active number of outstanding request has exceeded the limit.

Request satisfies all criteria to be executed.

application/vnd.ms-nexus-rules-v11 xml

application/vnd.ms-nexus-rules-v12 xml

msoNexusTransport: Exception while getting nexus transport client

ShouldExecuteRequest is returning false because network use is not permitted.

ShouldExecuteRequest is returning false due to lack of network connectivity.

ShouldExecuteRequest is returning false because the network is high cost.

LhXXps://nexusrules.officeapps.live.com

hXXps://nexus.officeapps.live.com

LredirectionUrl

originalUrl

httpCode

wzUrl

Failed to open HTTP request.

Failed to create HTTP request.

Failed to create HTTP request settings.

Failed to create HTTP request context.

Failed to initialize HTTP request context.

Papplication/vnd.ms-nexus-uls-v1

Lapplication/vnd.ms-nexus-telemetrydata-v2 binary

d-d-dTd:d:d.dZ

XMSOINTLIMM.DLL

msointlandroid.dll

mssp7imm.lex

mssp3ko.lex

msgr8imm.dll

msth8imm.dll

msgr8imm.lex

msth8imm.lex

mshy7imm.dll

mshy7imm.lex

mscss7imm.dll

MSOINTL30_WINRT.DLL

MSOINTL30_ANDROID.dll

MSOIMM.DLL

msoresandroid.dll

msproof7imm.dll

mssp7imm.dll

officeandroid.odf

RICHEDIM.DLL

SEQCHK10IMM.DLL

mso.acl

xlsrvintlandroid.dll

MsPtlsImm.dll

CSIIMM.DLL

MsoIdCliM.dll

TellMeRuntimeImm.dll

MParseProductCode failed for %s

{86573C72-9908-4334-9CC0-0A39C4B58833}

{610F491D-BE5F-4ED1-A0F7-759D40C7622E}

Call to GetPackageVersionToReport failed.

GetPackageVersionToReport did not return an expected package version.

MCorrupted GUID in reg key.

WindowsSqmMachineId

WindowsErrorReportingMachineId

%d.%d

Failed to set fields on OperatingSystemStateProvider.

OperatingSystemStateProvider triggered.

OperatingSystemStateProvider triggered with no data.

IsJoinedToDomain

AppVEntSubsystems32.dll

AppVEntSubsystems64.dll

C2R32.dll

C2R64.dll

{52263C53-5561-4FD5-A88D-2382945E5E8B}

{02BB3A66-D796-4938-94E3-1D6FF2A96B5B}

{E6930809-6796-466F-BC45-F0937362FDC1}

{6516C530-02EA-49D9-AD33-A824902B1065}

{AA1A1140-B8A1-4377-BFF0-4DCFF82F6ED1}

{5770F497-3F1D-4396-A729-18677AFE6359}

{003D2533-6A8C-4163-9A4E-76376B21ED15}

{0B40C0DA-6C2C-4BB6-9C05-EF8B30F96668}

{59C95D45-74A6-405E-815B-99CF2692577A}

{ADE257E8-4824-497F-B767-C0D06CDA3E4E}

{9CF873F3-5112-4C73-86C5-B94808F675E0}

{2D40ED06-955E-4725-80FC-850CDCBC1396}

{B688E64D-6305-4CCF-9981-CBF6823B3F65}

{65A4C65F-780B-4B57-B640-2AEA70761087}

{7BBE17F2-24C7-416A-8821-A7ACAF91A4AA}

{5D8AAAF2-3EAB-48E0-822A-6EFAE35980F7}

{FDA59085-BDB9-4ADC-B9D7-4B5E7DFD3EAC}

{AB2A78FF-5C52-494A-AE2A-99C0E481CA99}

{9540C768-CEDF-401C-B27A-15DD833E7053}

{949594B8-4FBF-44A7-BD8D-911E25BA2938}

{2A859A5B-3B1F-43EA-B3E3-C1531CC23363}

{5B7C4417-66C2-46DB-A2AF-DD1D811D8DCA}

{7E6F537B-AF16-43E6-B07F-F457A96F58FE}

{AE88E21A-D981-45A0-9813-3452F5390A1E}

{09322079-6043-4D33-9AB1-FFC268B8248E}

{E0C4D41F-B115-4D51-9E8C-63AF19B6EEB8}

{5917FA4B-7A37-4D70-B835-2755CF165E01}

{12F1FDF0-D744-48B6-9F9A-B3D7744BEEB5}

{A46815E5-C7E6-4F4F-8994-65BD19DC831D}

{D059DF6E-43A4-40EE-894D-5186F85AF9A0}

{E47D40AD-D9D0-4AB0-9C3D-B209E77E7AE8}

{58DB55C7-BB77-4C4D-A170-D7ED18A4AECE}

{B58FB371-5E42-46CE-927B-1A27AE89194C}

{D84CB3EA-CB53-466A-85C8-E8ED69D3F394}

{286E0A48-550E-4AFE-A223-27D510DE9E3B}

{A4CB27DA-2524-4998-92AE-6A836124BF9F}

{DAA7B9D0-F65A-482B-8AD3-474A33A05BE2}

{21757D20-006A-4BA0-8FDB-9DE272A11CF4}

{44938520-350C-4919-8E2F-E840C99AF4BF}

{F1997D24-27E6-4350-A9C7-50E63F85406A}

{7F3D4AF1-E298-4C30-8118-A0533B436C43}

{CB9FE322-23F2-4FC5-8569-0E63D0853072}

{F3449F6D-D512-4BBC-AC02-8C654845F6CB}

{436055A7-25A6-40FF-A124-B43A216FD369}

{3B694869-1556-4339-98C2-96C893040E31}

{7BAA6D3A-9EA9-47A8-8DFF-DC33F63CFEB3}

{11FC26E1-ADC8-4BEE-B42A-5C57D5FEC516}

{396D571C-B08F-4BEE-BE0B-28C5B640BC23}

{B6C0DE84-37D8-41B2-9EAF-8A80A008D58A}

{BCEF3379-4C3F-46D6-9922-8D3E513E75FA}

{C299D07D-803A-423C-88E9-029DE50D79ED}

{8C4F02D4-30C0-441A-860D-A68BE9EFC1EE}

{89B643DB-DFA5-4AF4-AEFC-43D17D98B084}

{D7E4AF12-6EB0-40DA-BF0E-D818BBC62AFB}

{183C0D5A-5AAE-45EB-B0CE-88009B8B3939}

{2E8E87E2-ED03-4DFB-8B40-0F73785B43FD}

{6B102F6C-50D4-4137-BF9F-5E446348188B}

{BE161169-49EC-4277-9802-6C5964D96593}

{D495DE19-448F-4C7E-8343-E54D7F336582}

{16C432FF-E13E-46A5-AB7D-A1CE7519119A}

{E0ECE06B-9123-4314-9570-338573410DE7}

{1752DF1B-8314-4790-9DF8-585D0BF1D0E3}

{3CF36478-D8B9-4FF4-9B42-0EDC60415E6A}

{CCB0F52E-312E-406E-A13A-566AF3C6B91D}

{634C8BC9-357C-4A70-A6B1-C2A9BC1BF9E5}

{B6512468-269D-4910-AD2D-A6A3D769FEBA}

{FEDA65D8-640B-4220-B8AE-6E221A990258}

{F337DD12-BF19-456B-82ED-B022B3032737}

{CB5E4CFF-1C96-43CA-91F8-0559DBA5456C}

{C2B1EC65-443F-4B2A-BF99-B46B244F0179}

{C9D3D19B-60A6-4213-BC72-C1A1A59DC45B}

{943CDA82-BDAC-4298-981F-21E97303DCCE}

{991A2521-DBB2-436C-82EB-C1BF93AC46FD}

{ED7482AE-C31E-4B62-A7CB-9291A0D616D2}

{63F119BD-171E-4034-B98F-A85759367616}

{792DE587-45FD-4F49-AD84-BFD40087792C}

{90984839-248D-4746-8F55-C943CAB009CF}

{62CCF9BD-1F60-414A-B766-79E98E55283B}

{F600E366-4C93-4CF0-BED5-BF2398759E00}

{174F331D-103E-4654-B6BD-C86D5B259A1A}

{DEA194EA-A396-4F91-88F2-77E501C8B9D2}

{B64CFCED-19A0-4C81-8B8D-A72DDC7488BA}

{C5B6E8E0-AD3D-4712-A5C6-FB7E7CC4DA59}

{A9AF7310-F6E0-40E2-B44A-076B2BA7E118}

{1F3BF441-3BD5-4DC5-B3DA-DB90450866F4}

{BDA57528-BB32-43DB-8CF0-36A32372F527}

{F98827AD-4B5F-48F1-B81B-FEE63DF5858E}

{B333EAB2-86CB-4B08-A5B8-A4C64AFC7A4B}

{F988DF4F-10DF-444F-909F-679BB9DF70D2}

{4D57374B-F5EA-4513-BB95-0456E424BCEE}

{9AF02C45-EE74-4400-A4E7-1251D11780A0}

{9459DA1D-F113-416B-AB41-A81D1C29A7A0}

{F8FF7F1C-1D40-4B84-9535-C51F7B3A70D0}

{04D62A0B-845D-48ED-A872-A064FCC56B07}

{5CA79892-8746-4F00-BB15-F3C799EDBCF4}

{E96A7A9C-162D-41E1-8C3D-D4C0929B6558}

{934ECDD6-7438-4464-B0FD-ED374AAB9CA6}

{5F1FB9D5-F241-4543-994F-36B37F888585}

{E5606A7D-8C29-4AD7-94B5-7427BF457616}

{4B9B31AA-00FA-481C-A25F-A2067F3FF24C}

{92B51A69-397D-4796-A5E8-D1672B349469}

{1AE119A6-40ED-4FA9-B52A-909841BD6E3F}

{FA25F074-80F9-44C1-B233-4019D3E70230}

{77A58083-E86D-45C1-B56E-77EC925167CF}

{523AABDF-9353-4151-9179-F708A2B48F6B}

{85133BEE-AD80-4CB4-977B-F16FD2DC3A20}

{3DC943FD-4E44-4FD6-A05F-8B421FF1C68A}

{8978F58A-BDC1-418C-AB3E-8017859FCC1E}

{9156E89A-1370-4079-AAA5-695DC9CEEAA2}

{B7CD5DC5-A2E6-4E74-BA44-F16B81B931F2}

{87D9FF03-50F4-4247-83E7-32ED575F2B1B}

{064A3A09-3B2B-441D-A86B-F3D47F2D2EC6}

{09775609-A49B-4F28-97AE-7F7740415C66}

{C9693FD7-4024-4544-BF5B-45160F7D5687}

{537EA5B5-7D50-4876-BD38-A53A77CACA32}

{52287AA3-9945-44D1-9046-7A3373666821}

{C85FE025-B033-4F41-936B-B121521BA1C1}

{B58A5943-16EA-420F-A611-7B230ACD762C}

{28F64A3F-CF84-46DA-B1E8-2DFA7750E491}

{A96F8DAE-DA54-4FAD-BDC6-108DA592707A}

{77F47589-2212-4E3B-AD27-A900CE813837}

{96353198-443E-479D-9E80-9A6D72FD1A99}

{B4AF11BE-5F94-4D8F-9844-CE0D5E0D8680}

{4C1D1588-3088-4796-B3B2-8935F3A0D886}

{951C0FE6-40A8-4400-8003-EEC0686FFBC4}

{FB3540BC-A824-4C79-83DA-6F6BD3AC6CCB}

{86AF9220-9D6F-4575-BEF0-619A9A6AA005}

{AE9D158F-9450-4A0C-8C80-DD973C58357C}

{95820F84-6E8C-4D22-B2CE-54953E9911BC}

{8BF9E61F-3905-4E9B-99C4-1C3946C1FCA7}

{35EC6E0E-2DF4-4629-9EE3-D525E806B988}

{3AD61E22-E4FE-497F-BDB1-3E51BD872173}

{149DBCE7-A48E-44DB-8364-A53386CD4580}

{E3DACC06-3BC2-4E13-8E59-8E05F3232325}

{A8119E32-B17C-4BD3-8950-7D1853F4B412}

{6E5DB8A5-78E6-4953-B793-7422351AFE88}

{FF02E86C-FEF0-4063-B39F-74275CDDD7C3}

{46D2C0BD-F912-4DDC-8E67-B90EADC3F83C}

{26B6A7CE-B174-40AA-A114-316AA56BA9FC}

{B6B47040-B38E-4BE2-BF6A-DABF0C41540A}

{E538D623-C066-433D-A6B7-E0708B1FADF7}

{DFC5A8B0-E9FD-43F7-B4CA-D63F1E749711}

{18C10CE7-C025-4615-993C-2E0C32F38EFA}

{8DED1DA3-5206-4540-A862-E8473B65D742}

{58E55634-63D9-434A-8B16-ADE5F84737B8}

{BACD4614-5BEF-4A5E-BAFC-DE4C788037A2}

{0BC1DAE4-6158-4A1C-A893-807665B934B2}

{65C607D5-E542-4F09-AD0B-40D6A88B2702}

{4CB3D290-D527-45C2-B079-26842762FDD3}

{881D148A-610E-4F0A-8985-3BE4C0DB2B09}

{6AE65B85-E04E-4368-80A7-786D5766325E}

{2030A84D-D6C7-4968-8CEC-CF4737ACC337}

{2F756D47-E1B1-4D2A-922B-4D76F35D007D}

{C5A706AC-9733-4061-8242-28EB639F1B29}

{090506FC-50F8-4C00-B8C7-91982A2A7C99}

{81D507D6-E729-436D-AD4D-FED2CBE4E566}

{D98FA85C-4FD0-40D4-895C-6CC11DF2899F}

{436366DE-5579-4F24-96DB-3893E4400030}

{66C66DB4-55EA-427B-90A8-B850B2B87FD0}

{F680A57C-24C4-4FDD-80A3-778877F63D0A}

{83AC4DD9-1B93-40ED-AA55-EDE25BB6AF38}

{04388DC4-ABCA-4924-B238-AC4273F8F74B}

{D8CACE59-33D2-4AC7-9B1B-9B72339C51C8}

{23B672DA-A456-4860-A8F3-E062A501D7E8}

{6D47BDDA-2331-4956-A1D6-E57889F326AB}

{6FAC4EBC-930E-4DF5-AAAE-9FF5A36A7C99}

{5A670809-0983-4C2D-8AAD-D3C2C5B7D5D1}

{2DCD3F0B-AAFB-48D7-9F5F-01E14160AC43}

{EC9D9265-9D1E-4ED0-838A-CDC20F2551A1}

{50059979-AC6F-4458-9E79-710BCB41721A}

{338E5858-1E3A-4ACD-900E-7DBEF543BB9B}

{34EBB57F-0773-4DF5-8EBD-BF55D194DC69}

{5AAB8561-1686-43F7-9FF5-2C861DA58D17}

{D545CCF1-CF46-41D0-8D55-D3E8B03CDB64}

{B444EF2B-340F-4E88-9E32-FCB747EE5D04}

{E66E9AA9-D6CE-43DA-8A34-EF62ECDAE720}

{A9F645A1-0D6A-4978-926A-ABCB363B72A6}

{FBBC4AAB-247A-43DB-8CE6-69ABE89A82E5}

{E5101C42-817D-432D-9783-8C03134A51C2}

{17A89B14-4244-4B97-BF6B-76D586CF91D0}

{F32D1284-0792-49DA-9AC6-DEB2BC9C80B6}

{E48D4EBB-FD30-43B2-BE87-0EB2335EC2C9}

{D70B1BBA-B893-4544-96E2-B7A318091C33}

{9B4060C9-A7F5-4A66-B732-FAF248B7240F}

{EB264A11-A2EE-4740-8AC2-3751C8859374}

{2A3D3010-CDAB-4F07-8BF2-0E3639BC6B98}

{4E26CAC1-E15A-4467-9069-CB47B67FE191}

{70A633E5-AB58-487A-B077-E410B30C5EA4}

{7A0560C5-21ED-4518-AD41-B7F870B9FD1A}

{54FF28C4-56AD-4168-AB75-7207F98DE5EB}

{12367CA7-3B7D-44FD-8765-02469CA5004E}

{D64EDC00-7453-4301-8428-197343FAFB16}

{39A1BE8C-9E7F-4A75-81F4-21CFAC7CBECB}

{D20B83AB-A959-4FA3-9C28-82C14D74285A}

{4031E9F3-E451-4E18-BEDD-91CAA3690C91}

{AE1310F8-2F53-4994-93A3-C61502E91D04}

{2B456DC8-145A-4D2D-9C72-703D1CD8C50E}

{13104647-EE01-4016-AFAF-BBA564215D6E}

{2CB19A15-BAB2-4FCB-ACEE-4BDE5BE207A5}

{2F72340C-B555-418D-8B46-355944FE66B8}

{539165C6-09E3-4F4B-9C29-EEC86FDF545F}

{330A4ACE-9CC1-4AF5-8D36-8D0681194618}

{CA5B3EEA-C055-4ACF-BC78-187DB21C7DB5}

{2A9E12E5-48A2-497C-98D3-BE7170D86B13}

{0F42F316-00B1-48C5-ADA4-2F52B5720AD0}

{067DABCC-B31D-4350-96A6-4FCAD79CFBB7}

{AEEDF8F7-8832-41B1-A9C8-13F2991A371C}

{4F414197-0FC2-4C01-B68A-86CBB9AC254C}

{82F502B5-B0B0-4349-BD2C-C560DF85B248}

{053D3F49-B913-4B33-935E-F930DECD8709}

{594E9433-6492-434D-BFCE-4014F55D3909}

{B480F090-28FE-4A67-8885-62322037A0CD}

{58D95B09-6AF6-453D-A976-8EF0AE0316B1}

{5DF83BED-7E8E-4A28-80EF-D8B0A004CF3E}

{75F08E14-5CF5-4D59-9CEF-DA3194B6FD24}

{587BECE0-14F5-4039-AA1F-7CFCE036FCCC}

{6185F4C9-522C-4808-8508-946D28CEA707}

{E9F0B3FC-962F-4944-AD06-05C10B6BCD5E}

{DA7DDABC-3FBE-4447-9E01-6AB7440B4CD4}

{82E6B314-2A62-4E51-9220-61358DD230E6}

{60AFA663-984D-47A6-AC9C-00346FF5E8F0}

{84832881-46EF-4124-8ABC-EB493CDCF78E}

{70D9CEB6-6DFA-4DA4-B413-18C1C3C76E2E}

{6C1BED1D-0273-4045-90D2-E0836F3C380B}

{596BF8EC-7CAB-4A98-83AE-459DB70D24E4}

{26B394D7-7AD7-4AAB-8FCC-6EA678395A91}

{5829FD99-2B17-4BE4-9814-381145E49019}

{339A5901-9BDE-4F48-A88D-D048A42B54B1}

{AA64F755-8A7B-4519-BC32-CAB66DEB92CB}

{DE52BD50-9564-4ADC-8FCB-A345C17F84F9}

{C8CE6ADC-EDE7-4CE2-8E7B-C49F462AB8C3}

{E1FEF7E5-6886-458C-8E45-7C1E9DAAB00C}

{D450596F-894D-49E0-966A-FD39ED4C4C64}

{C47456E3-265D-47B6-8CA0-C30ABBD0CA36}

{AD96EEE1-FD16-4D77-8A5A-91B0C9A2369A}

{6CB2AFA8-FFFF-49FE-91CF-5FFBB0C9FD2B}

{6BB0FF35-9392-4635-B209-642C331CF1EE}

{6E0C1D99-C72E-4968-BCB7-AB79E03E201E}

{FBD9E09F-6B81-4FFB-97EF-E8919A0C9E06}

{041A06CB-C5B8-4772-809F-416D03D16654}

{FCC1757B-5D5F-486A-87CF-C4D6DEDB6032}

{971CD368-F2E1-49C1-AEDD-330909CE18B6}

{17C5A0EB-24EE-4EB3-91B6-6D9F9CB1ACF6}

{418D2B9F-B491-4D7F-84F1-49E27CC66597}

{BDB32189-C636-46CD-A011-FFB834B552D9}

{E7851824-6844-4D85-ABE7-7CA026FB3314}

{83E04EE1-FA8D-436D-8994-D31A862CAB77}

{03CA3B9A-0869-4749-8988-3CBC9D9F51BB}

{9103F3CE-1084-447A-827E-D6097F68C895}

{2395220C-BE32-4E64-81F2-6D0BDDB03EB1}

{C7D96193-844A-44BD-93D0-76E4B785248E}

{4A31C291-3A12-4C64-B8AB-CD79212BE45E}

{6CE96173-4198-49FC-9924-CC8EEC1A7285}

{DEDFA23D-6ED1-45A6-85DC-63CAE0546DE6}

{0ED94AAC-2234-4309-BA29-74BDBB887083}

{D4639CC7-7B3A-4AC6-99C4-B0AF9ACE7B27}

{4B2E77A0-8321-42A0-B36D-66A2CDB27AF4}

{6C44E4BD-C6DB-474A-877E-1BB899ACA206}

{79EEBE53-530A-4869-B56B-B4FFE0A1B831}

{D0C2BC53-DB5F-4A9E-84AC-17C8862C27DA}

{3846A94F-3005-401E-B663-AF1CF99813D5}

{A56A3B37-3A35-4BBB-A036-EEE5F1898EEE}

{27B162B5-F5D2-40E9-8AF3-D42FF4572BD4}

{402DFB6D-631E-4A3F-9A5A-BE753BFD84C5}

{5821EC16-77A9-4404-99C8-2756DC6D4C3C}

{ED967494-A18E-41A9-ABB8-9030C51BA685}

{2DFE2075-2D04-4E43-816A-EB60BBB77574}

{1F7413CF-88D2-4F49-A283-E4D757D179DF}

{A17F9ED0-C3D4-4873-B3B8-D7E049B459EC}

{6BF301C1-B94A-43E9-BA31-D494598C47FB}

{295B2C03-4B1C-4221-B292-1411F468BD02}

{C5A7B998-FAE7-4F08-9802-9A2216F1EC2B}

{1B170697-99F8-4B3C-861D-FBDBE5303A8A}

{2F632ABD-D62A-46C8-BF95-70186096F1ED}

{980F9E3E-F5A8-41C8-8596-61404ADDF677}

{CEED49FA-52AD-4C90-B7D4-926ECDFD7F52}

{2E5F5521-6EFA-4E29-804D-993C1D1D7406}

{AD310F32-BD8D-40AD-A882-BC7FCBAD5259}

{15265EDE-4272-4B92-9D47-EF584858D0AE}

{C76DBCBC-D71B-4F45-B5B3-B7494CB4E23E}

{AA2A7821-1827-4C2C-8F1D-4513A34DDA97}

{44151C2D-C398-471F-946F-7660542E3369}

{5B45E2C1-3D5A-4C24-AD16-B26499F64FC2}

{6285E8B3-2D05-4954-BF85-65159DEEB966}

{60F6C5C4-96C1-4FFB-9719-388276C61605}

{CACAA1BF-DA53-4C3B-9700-11738EF1C2A5}

{E52D2A85-80E5-435B-882F-8884792D8ABF}

{BB11BADF-D8AA-470E-9311-20EAF80FE5CC}

{C3000759-551F-4F4A-BCAC-A4B42CBF1DE2}

SkypeServiceBypassRetail

office-AppPrivilege.ProEE-DRM

office-AppPrivilege.ProXML

office-AppPrivilege.VisioDataFeature

office-AppPrivilege.ProEE-Classify

office-AppPrivilege.ProEE-BarcodesAndLabels

office-AppPrivilege.ProEE-Workflow

office-AppPrivilege.SaveForXLServices

office-AppPrivilege.ProSlideLibraryPublish

office-AppPrivilege.CommercialUse

office-AppPrivilege.ProOutlookPolicyTags

office-AppPrivilege.ServicesA

office-AppPrivilege.ServicesB

office-AppPrivilege.GroupPolicySupport

office-AppPrivilege.SharePointWorkspace

office-AppPrivilege.BusinessIntelligence

office-AppPrivilege.LyncPro

office-AppPrivilege.ProjectPro

office-AppPrivilege.OPEP

office-AppPrivilege.OneNotePro

office-AppPrivilege.PremiumBI

office-AppPrivilege.licensing_testingEnabled

office-PerpetualUrl

office-DependsOnWindows

{DFC79B08-1388-44E8-8CBE-4E4E42E9F73A}

{DAF2E6D5-1424-47B9-8820-42B32E4BC3A2}

{BFA358B0-98F1-4125-842E-585FA13032E6}

{BB6FE552-10FB-4C0E-A4BE-6B867E075735}

{9D9FAF9E-D345-4B49-AFCE-68CB0A539C7C}

{67C0FC0C-DEBA-401B-BF8B-9C8AD8395804}

{3B2FA33F-CD5A-43A5-BD95-F49F3F546B0B}

{FC61B360-59EE-41A2-8586-E66E7B43DB89}

{740A90D3-A366-49FA-9845-1FA8257ED07B}

{424D52FF-7AD2-4BC7-8AC6-748D767B455D}

{A49503A7-3084-4140-B087-6B30B258F92E}

{C3E65D36-141F-4D2F-A303-A842EE756A29}

{685062A7-6024-42E7-8C5F-6BB9E63E697F}

{2AA09C36-3E86-4580-8E8D-E67DFC13A5A6}

{D95CFA27-EDDF-4116-8D28-BBDB1E07B0A5}

{C02FB62E-1CD5-4E18-BA25-E0480467FFAA}

{E260D7A1-49DC-41EE-B275-33A544C96904}

{6379F5C8-BAA4-482E-A5CC-38ADE1A57348}

{BEA06487-C54E-436A-B535-58AEC833F05B}

{45C8342D-379D-4A4F-99C5-61141D3E0260}

{327DAB29-B51E-4A29-9204-D83A3B353D76}

{91AB0C97-4CBE-4889-ACA0-F0C9394046D7}

{55671CEE-5384-454B-9160-975BD5441C4B}

{86834D00-7896-4A38-8FAE-32F20B86FA2B}

{AC9C8FB4-387F-4492-A919-D56577AD9861}

{522F8458-7D49-42FF-A93B-670F6B6176AE}

{3A4A2CF6-5892-484D-B3D5-FE9CC5A20D78}

{3E0F37CC-584B-46B1-873E-C44AD57D6605}

{090896A0-EA98-48AC-B545-BA5DA0EB0C9C}

{5F2C45C3-232D-43A1-AE90-40CD3462E9E4}

{6BBE2077-01A4-4269-BF15-5BF4D8EFC0B2}

{1ECBF9C7-7C43-483E-B2AD-06EF5C5744C4}

{8E2E934E-C319-4CCE-962E-F0546FB0AA8E}

{253CD5CD-F190-4A8C-80AC-0144DF8990F4}

{C28ACDB8-D8B3-4199-BAA4-024D09E97C99}

{861343B3-3190-494C-A76E-A9215C7AE254}

{99D89E49-3F21-4D6E-BB17-3E4EE4FE8726}

{E7B23B5D-BDB1-495C-B7CE-CC13652ACF2F}

{8507F630-BEE7-4833-B054-C1CA1A43990C}

{E914EA6E-A5FA-4439-A394-A9BB3293CA09}

{BF3AB6CF-1B0D-4250-BAD9-4B61ECA25316}

{B21367DF-9545-4F02-9F24-240691DA0E58}

{69EC9152-153B-471A-BF35-77EC88683EAE}

{37256767-8FC0-4B6A-8B92-BC785BFD9D05}

{9E7FE6CF-58C6-4F36-9A1B-9C0BFC447ED5}

{CEBCF005-6D81-4C9E-8626-5D01C48B834A}

{26421C15-1B53-4E53-B303-F320474618E7}

{EE6555BB-7A24-4287-99A0-5B8B83C5D602}

{D229947A-7C85-4D12-944B-7536B5B05B13}

{9CAABCCB-61B1-4B4B-8BEC-D10A3C3AC2CE}

{2CD0EA7E-749F-4288-A05E-567C573B2A6C}

{3D0631E3-1091-416D-92A5-42F84A86D868}

{6337137E-7C07-4197-8986-BECE6A76FC33}

{742178ED-6B28-42DD-B3D7-B7C0EA78741B}

{812837CB-040B-4829-8E22-15C4919FEBA4}

{0C6911A0-1FD3-4425-A4B3-DA478D3BF807}

{7AB38A1C-A803-4CA5-8EBB-F8786C4B4FAA}

{D7279DD0-E175-49FE-A623-8FC2FC00AFC4}

{0C7137CB-463A-44CA-B6CD-F29EAE4A5201}

{EB778317-EA9A-4FBC-8351-F00EEC82E423}

fb_SkypeServiceBypassRetail

failed to open file '%s'

failed to delete file %s

Cannot set file %s attbutes to %u

Cannot load system string for error x in language %i

CreateDirectory failed for directory: %s

Error: %s HResult: %s. %s

Error: %s ErrorCode: %d(0x%x). %s

Error: Type: %s. %S ErrorCode: %d(0x%x). %s

Error: %s Type: %d::%S. %s

ORegistryKey.CreateSubKey failure: The RegistryKey on which this method is being invoked is closed

ORegistryKey.CreateSubKey failure: Empty key name string.

ORegistryKey.CreateSubKey failure: The length of the specified subkey is too long

ORegistryKey.GetValue failure: Cannot get DWORD value. The registry key is closed or not set

ORegistryKey.GetValue failure: Cannot get registry %s value %s

ORegistryKey.GetValue failure: Cannot get value. The

registry key is closed or not set

ORegistryKey.GetValue failure: Cannot get the binary value "%s" in registry key %s.

ORegistryKey.Open failure: Parent key is NULL

ORegistryKey.Open failure: The length of subkey %s is longer than the maximum length allowed

PipelineServerName

UpdateUrl

CDNBaseUrl

ProductKeys

BackgroundTransportMethodDefault

BackgroundTransportMethodFailures

{'ModulePath':'%s','CommandLine':'%s','Bitness':'%d','IntegrityLevel':'0x%x','SecuritySessionId':'%d','ExeVer':'%s','ProcessType':'%s'}

{'OSVersion':'%d.%d','SP':'%d','ProductType:'%d','ProcessorArch':'%d','Locale':'%d'}

OException caught {'Error':'%s'}

OException caught in call to IsElevated {'Error':'%s'}

SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate

ORegistryKey.SetValue failure: Cannot set DWORD value. The registry key is closed or not set

ORegistryKey.SetValue failure: Cannot set DWORD value. value name is too long

ORegistryKey.SetValue failure: Cannot set DWORD name "%s" value "%i" in registry key %s

ORegistryKey.SetValue failure: Cannot set "%s" string. The registry key is closed or not set

ORegistryKey.SetValue failure: Cannot set "%s" string into registry key %s. The value name is too long

ORegistryKey.SetValue failure: Cannot set "%s" string name "%s" value "%s" into registry key %s.

I%s\%s

PersistenceStore::TryGetValue: Not a valid setting for the Store %s

PersistenceStore::Persist: Not a valid setting for the Store %s

%s.%s

Setting Type (%d) is not valid for Store (%s)

Settings::PersistSetting: Not a valid Setting Type (%d) for the Store %s

(%s) is not valid for Setting Type (%d) from Store (%s)

Settings::PersistSetting: (%s) is not valid for Setting Type (%d)

Settings::TryGetValue: Not a valid Setting Type (%d) for the Store %s

.pseudo

.hashid

Invalid Url or Path : %s

UrlOrPathSettingValidator::Validate

PRID %s maps to Deferred with priority %s

PRID %s maps to %s with priority %s

PRID %s maps to Current with priority %s

PRID %s maps to channel %s with priority %s

New Best Channel found - PRID %s maps to channel %s with priority %s

UpdateChannels::GetDefaultChannelUrl returned invalid data.

BitfieldValues contained an unexpected channelId value {'BitfieldValues':'%s','ChannelIdValue':'%d'}

GetGroupPolicyValue: Got %s setting from policy.

NNot a valid version %s

Cab not found %s

CabManager::Extract: Cab not found %s

CabManager::Extract: Extracting %s -> %s

Extraction Failed {'File':'%s'}

hash.txt

.hash

CabManager::DetermineCabName: Type:%d, Platform:%s, Version:%s, Culture:%s -> %s

CabManager::GetCabPrefix: Unknown CabType %d

CabErrorDetection::Validate: .hash file not found for "%s". Was expecting %s

.hash file is not found. Was expecting %s

OSmartPointer cannot apply operator '->' to an empty object pointer

RobustFileOps::EnsureDirectoryForFile: Creating directory at "%s".

RobustFileOps::MoveFileToBackup: Shutdown event set, abandoning MoveFileEx of existing fileToMoveToBackupPath "%s" to bakPath "%s".

RobustFileOps::MoveFileToBackup: Moving existing fileToMoveToBackupPath "%s" to bakPath "%s": Attempt %d of %d.

RobustFileOps::MoveFileToBackup: MoveFileEx failed to move existing fileToMoveToBackupPath "%s" to bakPath "%s": LastError: %d

RobustFileOps::MoveFileToBackup: File at fileToMoveToBackupPath "%s" no longer exists; no need to move it to a backup location.

RobustFileOps::MoveFileToBackup: Shutdown event set, abandoning MoveFileEx of existing fileToMoveToBackupPath "%s" to bakPath "%s" (after failure)

RobustFileOps::MoveFileToBackup: FAILED! MoveFileEx failed to move existing fileToMoveToBackupPath "%s" to bakPath "%s". All %d of %d attempts exhausted!

RobustFileOps::MoveFile: [F] "%s" -> "%s"

RobustFileOps::MoveFile: Shutdown event set, abandoning MoveFileEx of new sourceFilePath "%s" to destinationFilePath "%s".

RobustFileOps::MoveFile: Moving new sourceFilePath "%s" to destinationFilePath "%s": Attempt %d of %d.

RobustFileOps::MoveFile: MoveFileEx failed to move new sourceFilePath "%s" to destinationFilePath "%s": LastError: %d

RobustFileOps::MoveFile: Shutdown event set, abandoning MoveFileEx of new sourceFilePath "%s" to destinationFilePath "%s" (after failure)

RobustFileOps::MoveFile: FAILED! MoveFileEx failed to move new sourceFilePath "%s" to destinationFilePath "%s". All %d of %d attempts exhausted!

RobustFileOps::MoveFile: Failed to replace existing file: "%s" with "%s":

RobustFileOps::RollbackFiles: Rolling back %d file operations.

RobustFileOps::RollbackFiles: ROLLBACK of move from "%s" to "%s".

RobustFileOps::RollbackFiles: FAILED ROLLBACK of Empty Dir removal for "%s"!

RobustFileOps::RollbackFiles: FAILED ROLLBACK of move from "%s" to "%s"!

RobustFileOps::DeleteFiles: Deleting %d files, markFilesThatFailToDeleteAsDeleteOnReboot=%d.

RobustFileOps::DeleteFiles: Deleting "%s".

RobustFileOps::DeleteFiles: Failed to delete "%s"! Marking file to be deleted at next reboot.

RobustFileOps::DeleteFiles: Failed to delete "%s"! Ignoring failure.

RobustFileOps::MoveFiles: Applying %d file operations.

RobustFileOps::MoveFiles: %d backup files were created.

RobustFileOps::MoveFiles: Not deleting backup files, as backupFileDeleteType is %d.

RobustFileOps::MoveFiles: Done with %d backup files, result=%d.

RobustFileOps::MoveFiles: Done applying %d file operations, result=%d.

RobustFileOps::AddFilesToFileOpsForDirectoryMove: Adding files in "%s", total file ops so far=%d.

RobustFileOps::AddFilesToFileOpsForDirectoryMove: Found %d files to add in "%s".

RobustFileOps::AddFilesToFileOpsForDirectoryMove: Skipping move from "%s" to "%s".

RobustFileOps::AddFilesToFileOpsForDirectoryMove: Added move from "%s" to "%s".

RobustFileOps::AddFilesToFileOpsForDirectoryMove: Found %d subdirectories under "%s".

RobustFileOps::AddFilesToFileOpsForDirectoryMove: Added Empty Dir creation at "%s".

RobustFileOps::AddFilesToFileOpsForDirectoryMove: No further subdirectories found under "%s".

RobustFileOps::AddFilesToFileOpsForDirectoryMove: Done adding files in "%s", total file ops so far=%d.

RobustFileOps::MoveDirectoryFiles : Destination directory not found at "%s", attempting to create it.

RobustFileOps::MoveDirectoryFiles : No source directory found at "%s".

RobustFileOps::RemoveDirectory: GetFilesRecursive failed with exception: %s

RobustFileOps::RemoveDirectory: Errors encountered while cleaning install directory: %s

RobustFileOps::RemoveDirectory: Exception caught: %s

RobustFileOps::RemoveDirectory: Removed install directory: %s

OSmartPointer cannot apply operator '*' to an empty object pointer

Failed to read %d bytes from %s. Number of bytes read = %d

QTransport: Not a valid address: %s.

Failed to open file. Exception: %s

FileTransport::DoConnect

Bytes read (%d) != Bytes to read (%d)

Failed to read file. Exception: %s

Copy failed. Last error : %d

FileTransport::DoLoadFile

failed to create security descriptor from string %s, error = %d

Failed to create event %s

Error: Deadlock: Thread %d is waiting for itself to exit

Failed to get the exit code for finished thread, error = %d.

NHttpTransportLoadRangeCancelEvent

Failed to create Http Request : {'Result':'%s'}

HttpTransport::CreateHttpRequest

Failed to create Http Request

bytes=%d-%d

Opening Http %s request

Sending Http %s request

Getting Http GET request status

CheckReachable via Http %s request failed

HttpTransport::CheckReachable

Http %s request failed

{'X-CID':'%s'}

ClickToRun Http Transport

HttpTransport::DoConnect: Creating Http request context

HttpTransport::DoConnect: Initializing request context

HttpTransport::DoConnect: Create Http request settings

HttpTransport::ReadRangeProc: Getting response stream

HttpTransport::ReadRangeProc

Failed to Read the response stream: 0x%x.

Create Http request settings

Opening Http GET request

Sending Http GET Range request

Http GET Range request failed: Status = %d

HttpTransport::DoBeginLoadRange

Http GET Range request failed

HttpTransport::EndLoadRange: Invalid loadRangeAsyncResult

HttpTransport::DoEndLoadRange - Request is being cancelled.

HttpTransport::DoEndLoadRange - Request is cancelled

Http request cancelled

HttpTransport::CancelLoadRange - Empty loadRangeAsyncResult.

HttpTransport::CancelLoadRange

Http GET request failed to set user agent: %s

HttpTransport::DoLoadFile

Sending Http GET request

Http GET request failed: Status = %d

Http GET request failed

Getting Http GET response blob

Got response blob {'Expected':'%d','Actual':'%d','Match':'%d'

Didn't find directory %s. Ensured it. %s

%s. Error: %s (0x%x)

Bits download job error. Source Address format is not expected. Source address %s

BitsTransport::DoLoadFile

BitsTransport::DoLoadFile: Wrong format for Source Address.

Bits download job error. Source address %s

BitsTransport::DoLoadFile: Failed to load the file.

Bits download job returned false. Source address %s

Transport::LoadFile: Not Connected.

Invalid TransportRetry: no available transport

ClickToRun.TransportRetry.ExecuteDownloadFile

Download succeeded {'SourcePath':'%s','DestinationPath':'%s','Attempt':'%d'}

TransportRetry::ExecuteDownloadFile

Download failed for current transport {'SourcePath':'%s','Attempt':'%d','Size':'%u','MD5Hash':'%s'}

Download failed {'SourcePath':'%s','Attempt':'%d'}

hXXp://officecdn.microsoft.com/sg

hXXp://officecdn.microsoft.com/db

hXXp://officecdn.microsoft.com/pr

DNot an Http source

OHttp does not implement range downloads

PIDKEY

hXXp://o15.officeredir.microsoft.com/r/rlidC2RRemovalTool?clid=

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\%s

SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\%s

baseurl

cdnbaseurl

updatebaseurl

pidkeys

Exception occured %d

BaseCommandLine::TryGetCommandLine: No config file. Using default values for bootstrapper: %s

BaseCommandLine::TryGetCommandLine: Adding %s as an Upgrade Sku

%lu-%d (%lu)

O%s.%d

::LookupAccountNameW failed to retrieve size of account security identifier (systemname=%s, accountname=%s).

::LookupAccountNameW failed to retrieve account security identifier (systemname=%s, accountname=%s).

Mutex '%s' already created

Got handle to existing mutex %s

Failed to create the mutex %s: LastError: 0x%x

TrySetUserRegistry::HandleStateAction: Unable to set AttemptGetKey for bootstrapper.

TrySetUserRegistry::HandleStateAction: Unable to write out the Token or Key appropriately.

Failed to parse command line: %s

TrySetUserRegistry::TrySetAttemptGetKey: Setting Attempt Get Key for %s

OException has occured %s. Continuing bootstrapper.

TrySetUserRegistry::TrySetAttemptGetKey

Failed to set AttemptGetKey for: %s

TrySetUserRegistry::TrySetLicenseTokenOrKey: Key or Token was found for %s

Based on size, key was found.

TrySetUserRegistry::TrySetLicenseTokenOrKey

Token found. {'OlsToken':'0x%s'}

No key or token found for %s

Failed to set read property for: %s

Failed to parse the command line succesfully: %s

%s_x-none

HandleCommandLineAction::HandleStateAction: Start installation with configuration file: %s

HandleCommandLineAction::HandleStateAction: Invalid Admin command. Command: %s

%s %s

DownloadOffice::DownloadPackages: Getting Office for culture: %s

DownloadOffice::DownloadPackages: Getting Office in directory: %s

v%s.cab

DownloadOffice::DownloadPackages: Succesfully downloaded .dat file

DownloadOffice::DownloadFile: Downloading file %s

File is missing: %s

BaseUrl is not empty, using value of %s

Starting CDNBaseUrl is %s

CDNBaseUrl is not empty, so setting propertyBag[PB_CDN_BASE_URL] to %s

Ignoring client culture request as it is not known to be a full-product culture. {'Culture':'%s'}

BaseConfigure::TryGetConfiguration: Setting product keys.

InstallationConfigure::HandleStateAction: Using recovery data: %s

InstallationConfigure::HandleStateAction: Using recovery data from property bag: %s

AdminConfigure::HandleStateAction Do not have a valid installation and attempting to do a remove operation.

Failed determine if prereqs have passed or not.

BypassPromptUserToContinueOrQuit::HandleStateAction

Failure has occured with unknown action: %d

{'ErrorUrl':'%s','ErrorCode':'%d','ErrorSource':'%d'}

{'ErrorUrl':'%s','ErrorCode':'%d','ErrorSource':'%s'}

TryGetVersionDescriptor::HandleStateAction: Getting Cab: %s

Determined version to install {'VersionToInstall':'%s'}

TryGetClient::HandleStateAction: Getting Client Cabs: %s

TryGetClient::HandleStateAction: Installation path is: %s

Failed to download and extract the client cab: %s

%s outputpath="%s"

%s uninstallpreviousversion="%s"

scenariosubtype=%s %s

sourcetype=%s %s

%s scenario=unknown %s

Failed to build command line. command: %s parameters: %s

TryConfigureUninstallClient::HandleStateAction: Platform to be removed: %s

TryConfigureUninstallClient::HandleStateAction: removing: %s

scenario=install %s

TryConfigureUninstallClient::HandleStateAction There is no client found at %s.

Preparing to launch client. {'ProductInfoAdding':'%s','ProductInfoRemoving':'%s','BranchID':'%d'}

TryLaunchClient::HandleStateAction: Launching %s with parameters: %s

Upgrade failed with error code %d

C2R client returned failing error code %d

Upgrade completed as expected : %d

Failed to find the C2R Client {'CommandLine':'%s'}

scenario=removeinstallation displaylevel=%s

TryCheckNetworkCost::HandleStateAction: Failed to initialize NetworkCostManager for %s. Assuming low cost and proceeding.

%s="%s"

productstoadd="%s"

%s productstoremove="%s"

%s trackedduration=%s

ConfigureUpdatesSettings::HandleStateAction: Installation path is: %s

DisplayUpgradeAddRemovePrompt::HandleStateAction: User has following installed: %s

DisplayUpgradeAddRemovePrompt::DetermineUninstallationSkuMappings: Looking at: %s comparing to: %s

DisplayUpgradeAddRemovePrompt::DetermineUninstallationSkuMappings: Mapping succesful. %s is in set contained by O365ProPlusRetail or ProPlusRetail

DisplayUpgradeAddRemovePrompt::DetermineUninstallationSkuMappings: Mapping succesful. %s is in set contained by O365SmallBusPremRetail

DisplayUpgradeAddRemovePrompt::DetermineUninstallationSkuMappings: Mapping succesful. %s is in set contained by O365HomePremRetail or ProfessionalRetail

DisplayUpgradeAddRemovePrompt::DetermineUninstallationSkuMappings: Mapping succesful. %s is in set contained by HomeBusinessRetail

DisplayUpgradeAddRemovePrompt::DetermineUninstallationSkuMappings: Mapping succesful. %s is in set contained by HomeStudentRetail

DisplayUpgradeAddRemovePrompt::DetermineUninstallationSkuMappings: %s does not match %s

DisplayUpgradeAddRemovePrompt::DetermineUninstallationSkuMappings: Unable to match %s

Unable to get display names for all the PRIDs. Outliers : [%s]

RestorePreviousService::HandleStateAction: Attempt to restore previous service. Previous client located here: %s

Not updating client because client culture is not known to be a full-product culture. {'Culture':'%s'}

C2R Service is running with unexpected command line - '%s'. Expected clientPath - '%s'. Expected client15Path - '%s'

scenario=CLIENTUPDATE %s

Machine State {'fatalInconsistencyDetected' : '%d', 'currentClientExists' : '%d', 'o15ClientExists' : '%d', 'fireFlyClientExists' : '%d', 'nextState' : '%lu', 'noServiceIsRunning' : '%d', 'o16ServiceIsInstalled' : '%d'}

Q%s.Approximate duration : %d milliseconds.

MonitoredScope::ExecuteUnderStopWatch

VEncountered continuable prereq failure {'error':'%d'}

OException has occured %s.Exiting bootstrapper.

Exception has occured.Exiting bootstrapper

Prereq::ShowPrereqFailure: A Prereq check has failed. %s

windowsversion

Args::GetNextArgument: Next argument: %s

SETUP %s

SETUP %s [path to configuration file] %s

SETUP %s [path to configuration file]

%s %s

configuration.xml

Args::GetConfigFile: config file: %s

Args::Load: Have scenario: %s

Args::Load: Setting baseurl to: %s

hXXps://

Args::Load: product release id: %s culture: %s

Args::Load: Invalid commands passed in for admin scenario: %s

hXXp://go.microsoft.com/fwlink/?LinkId=%d

{1280039B-E673-41f9-A9ED-F0548E91C02B}

C2RWindowUtil::LoadUIString: string ID %d not found.

GetTextFont: height is %d pixels.

GetSmallTextFont: height is %d pixels.

GetHeaderTextFont: height is %d pixels.

combase.dll

minkernel\crts\ucrt\inc\corecrt_internal_strtox.h

__crt_strtox::floating_point_value::as_double

__crt_strtox::floating_point_value::as_float

mscoree.dll

ext-ms-win-ntuser-windowstation-l1-1-0

Failed to convert the blob to hex string, empty blob passed

%s is signed, validating signer

Warning: %s is not signed.

Error: %s is not trusted.

%s is not signed by Microsoft (TrustStatus:%d)

%s is %s (TrustStatus:%d)

Failed to retrieve SeessionId for processId=%d.

\StringFileInfo\xx\FileVersion

Failed to copy file src: %s, dest: %s

Failed to schedule delete file %s. Error Code: 0x%x.

Cannot get temp file name in path %s with prefix %s

OCOMInterface cannot apply operator '->' to NULL interface pointer

Failed to check free space in drive "%s"

Software\Microsoft\Windows\CurrentVersion\Policies\System

OREgistryKey.SubKeyCount failure: Cannot get sub key count. The registry key is closed or not set

OREgistryKey.SubKeyCount failure: Cannot get sub key count for registry key %s

ORegistryKey.ValueCount failure: Cannot get value count. The registry key is closed or not set

ORegistryKey.ValueCount failure: Cannot get value count for registry key %s

ORegistryKey.DeleteSubKeyTree failure: Empty key path

ORegistryKey.DeleteSubKeyTree failure: The subkey name "%s" is too long

ORegistryKey.DeleteSubKeyTree failure: Cannot delete Registry Key %s\%s.

ORegistryKey.DeleteValue failure: The registry key is closed or not set

ORegistryKey.DeleteValue failure: Cannot delete registry value from Registry Key %s. The Registry value is null

ORegistryKey.DeleteValue failure: Cannot delete registry value from Registry Key %s.

ORegistryKey.GetSubKeyNames failure: Cannot get all sub key names. The registry is closed or not set

ORegistryKey.GetSubKeyNames failure: Cannot get all sub key names for registry %s

ORegistryKey.GetValueNames failure: Cannot get all value names. The registry is closed or not set

ORegistryKey.GetValueNames failure: Cannot get all value names for registry %s

ORegistryKey.SetValue failure: Registry key is not initialized

ORegistryKey.SetValue failure: Cannot set binary into registry key %s. The value name is too long

ORegistryKey.SetValue failure: Cannot set binary "%s" reg value %s.

GetDirectories: search path %s does not exist

GetFiles: search path %s does not exist

Path passed in is too long.

_-%\.[]{}`~!@#$^&() =,;

_-%[]{}`~!@#$^&() =,;

xxxxxxxxxxxxxxxx

Initialization failed 0x%x

Unable to obtain BITS job state: error code: 0x%x

While downloading %s to %s

GetStatus called for an invalid state %d

Unexpected error while enumerating BITS job, 0x%x

Unable to Add file to bits job HRESULT=%d :LastError = %d

Download file operation cancelled

Unable to start the bits job HRESULT=%d :LastError = %d

Operation Cancelled

BITS connection error: %s

%s. %s

Failed to start process (as user) for file: %s arguments: %s

Failed to start process for file: %s arguments: %s

Starting %s %s

ShellExec: %s %s admin=%d

Failed to runas admin for file: %s arguments: %s

sftldr.dll

sftldr_wow64.dll

Failed to Open Win Http session

Crack URL failed

Failed to set the passport option

Failed to connect the url

Range: bytes=%d-%d

OHttp::DownloadRanges, not enough data

WinHttp request resend is required

OHttp::SendRequest: WinHttp request resend count exceeded limits

OHttp::SendRequest: Http Send request failed

OHttp::SendRequest: Http Send request failed, trying proxy index %d.

OHttp::SendRequest: Failed to set authentication scheme

WinHttpReceiveResponse failed, error=%d

OHttp::SendRequest: Http Receive request failed

OHttp::SendRequest: Http Receive request failed, trying proxy index %d.

Unexpected status code received for Http Send request

OHttp::ReadRequestData: cancelled

WinHttpQueryDataAvailable: failed Http Request has no data: Last error: 0xx

Header %d not available in the request: LastError: 0x%x

Passport.Net\*

Passport is not supported by the server

OService::Open - Open service %s failed %d

OService::StartService - Failed to Start Service : ret = %d : errCode = %d

OService::StopServiceRecursive - Failed to control service : errCode = %d

OService::TryStopDependents - Warning: failed to enumerate dependent services : errCode = %d

OService::TryStopDependents - Stopping dependent service '%S'

OService::TryStopDependents - Warning: Failed to stop dependent service '%S'

failed to delete service '%s'

OService::Install - CreateService failed %d

failed to create service '%s'

GetAddrInfoW failed on server %s with error %d

Unsupported IP Family

%d, %p

CoCreateInstance failed with HRESULT=0xx

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall

WindowsInstaller

[WindowsFolder]

SelectNodes: %s called for OXmlNode with null interface

selectSingleNode failed for %s

XML node %s is not found

%s not found

Failed to load XML document %s, HRESULT=0xx

http session not initialized

Reporting configuration of non-default log writers.

U%s-ddd-dd%s.log

d/d/d d:d:d.d

_osppc.dll

sppc.dll

sppcext.dll

O15Client::StopOfficeService: Unable to open service. {'ServiceName':'%s'}

O15Client::StopOfficeService: Service %s running. Need to stop it.

Service stopped. {'ServiceName':'%s', 'TimeToStopService':'%d'}

O15Client::StopOfficeService: Unable to stop service %s. WaitHint:%d, LastError:%d

{'TimeToStopService':'%d', 'TimeToFinishShuttingDown':'%d', 'LastError':'%d'}

Service unable to be stopped. Current state of %s is %d.

O15Client::StartOfficeService: Unable to open service. {'ServiceName':'%s'}

O15Client::StartOfficeService: Service %s is not running. Need to start it.

Service started. {'ServiceName':'%s', 'TimeToStartService':'%d'}

O15Client::StartOfficeService: Unable to start service %s. WaitHint:%d, LastError:%d

{'TimeToStartService':'%d', 'TimeToFinishStartingUp':'%d', 'LastError':'%d'}

Service unable to be started. Current state of %s is %d.

Unable to open service. {'ServiceName':'%s'}

Exception occurred %d

O15Client::IsInstalled: O15 client version: "%s"

O15 client version: "%s" failed to parse; ignoring and continuing. Error= %x

O15Client::IsFireflyInstalled: O15 client version: "%s"

O15 firefly client version: "%s" failed to parse; ignoring and continuing.

O15Client::IsFireflyInstalled: is firefly installed: %d

O15Client::RemoveOfficeService: '%s' is not installed. Continuing.

O15Client::RemoveOfficeService: Ensure service '%s' is shut down and removed.

Service removal failed. {'ServiceName':'%s'}

Service removal completed successfully. {'ServiceName':'%s'}

O15Client::IsServiceRestoreRequired: RestorePreviousService:'%d' PreviousClientPath:'%s' PreviousServiceName:'%s'

"%s" /service

%s service's binary path cannot be set - error code %d.

%s service cannot open - error code %d.

O15Client::RestoreOfficeService - %s previous service re-installed, starting the service.

%s service cannot start - error code %d.

Removal state {'RemovalComplete':'%s','ElapsedTime':'%d', 'LastError':'%d'}

O15Client::GetInstalledPackages - found package %s.

O15Client::GetProductEquivalents - ignoring %s.

O15Client::GetProductEquivalents - Adding subscription/freemium product %s.

O15Client::GetProductEquivalents - deprecating perpetual product %s.

O15Client::IsSubscriptionOrFreemiumPrid: Added %s to AcidList for %s

O15Client::IsSubscriptionOrFreemiumPrid: Found acid %s

O15Client::IsSubscriptionOrFreemiumPrid: Acid %s is not subscription or freemium

Unable to determine prid type. {'Exception':'%s'}

Configuration::Load: Using config file: %s

Configuration::Load: Failed while trying to load data out of %s

Configuration::Load: Setting culture to: %s

Configuration::InitializeDefaults: Base URL is %s

Repair recovery data detected, so using BaseUrl %s as the CDNBaseUrl too.

Default PRID is %s. Reconciled CDNBaseUrl is %s

Configuration::InitializeDefaults: Adjusted base url for local source: %s

Not using OEM or local source. Using reconciled CDNBaseUrl '%s' and Tax Origin '%s' to initialize BaseUrl to %s

Configuration::AdjustBaseUrlForLocalSource: Found the version cab at: %s

Configuration::AdjustBaseUrlForLocalSource: Removing %s

Configuration::AdjustBaseUrlForLocalSource: Could not find version cab ending in a folder with Office\Data: %s

%CommonProgramW6432%

%CommonProgramFiles%

Configuration::GetClientFolder - Unknown Installation Type (%d)

Found OEM source registry keys. Redirecting base url. {'BaseURL':'%s'}

Configuration::AdjustBaseUrlForOEMSource

Configuration::FShouldCheckOemSource: Found PRID match: %s

Configuration::FShouldCheckOemSource: Looking for branding: %s

Calculated Channel ID based on product list is: %s

Reconciled Channel ID based on product list vs. existing CDNBaseUrl is: %s

No Channel assigned from config XML, so using CDNBaseUrl based product calculation: %s

Configuration::GetClient15ConfigurationInfo: Read property %s: Value %s Out of: %s

Configuration::GetClient15ConfigurationInfo: Unable to read property %s: Out of: %s

Configuration::GetSourceType: Base Url %s is of type DVD or USB

Descriptor::Load: Reading Available value from descriptor: %s

Descriptor::Load: Reading Bootstrapper value from descriptor: %s

Failed to parse VersionDescriptor.xml.

Descriptor::Load: Failed to parse VersionDescriptor.xml.

ar-sa.pseudo

ja-jp.pseudo

ORegistryKey.GetValue failure: Cannot get String value. The registry key is closed or not set

OException has occured %s. Failing test

IsNativeValidator::CheckPreReq: returning: %d.

SXSValidator::CheckPreReq: Has preexisting 64bit products: %s.

SXSValidator::CheckPreReq: Has preexisting 32bit products: %s.

SXSValidator::CheckPreReq: Cross bitness test passed.

{'BlockingApp': '%s', 'Bitness' : '%s'}

BootstrapperValidator::CheckPreReq: Version of bootstrapper too low to install with: Have: %s Need: %s

BootstrapperValidator::CheckPreReq: returning: %d.

O15BetaValidator::CheckPreReq: Currently installed version: %s

O15BetaValidator::CheckPreReq: Current build is newer than Beta build. Prereq check passes.

O15BetaValidator::CheckPreReq: No Office 15 installation detected. Prereq check passes.

O15BetaValidator::CheckPreReq: returning: %d.

ILanguage value used: %d

OException has occured %s. Using default value

O15BetaValidator::GetErrorMessageBodyParam: returning: %s.

32 Bit Windows detected.

Unknown platform type: %s.

MSIxC2RBlockValidator::CheckPreReq: returning: %d.

Blocking apps: %s

Outlook key not found.

%s\Profiles\%s\%s

ProfileValueKey not found.

guid vector '%s' size: %d

guidKeyPath '%s'

OException has occured %s.

Exception has occured %s.

Software\Microsoft\Office\Outlook\Addins\Microsoft.BusinessSolutions.eCRM.OutlookAddIn.Connect.5

%s %s %s

PartnerAppValidator::GetErrorMessageBodyParam Unexpected PrereqFailureType: %d

PartnerAppValidator::LoadUIString: string ID %d not found.

shared_ptr cannot apply operator '->' to an empty object pointer

Branch [alias to channel]: %s

Channel: %s

ConfigFile::ParseAddNode: No source path specified. Using default value: %s

ConfigFile::ParseAddNode: ForceDowngrade: %s

ConfigFile::ParseAddNode: ForceUpgrade: %s

OfficeMgmtCOM: %s

ConfigFile::ParseAttribute: Value of %s: %s

Invalid Branch name specified in configuration: %s

Illegal app specified for exclude %s

Has has unknown C2R Client platform installed: %s

Has has unknown Firefly platform installed: %s.

IsWindows8OrGreater

Determining Windows version

IsWindows8OrLater

IsWindows7

Trying to load SPP based on Windows version

{A2E714DE-1AB8-4D98-8C47-51003DAB4D3A}

Failed to convert ACID: %s to SLID

Failed to get attribute %s

XML Attribute %s is not found

'Office needs a newer version of Windows

We're sorry, we couldn't install your Office product because you don't have a modern Windows operating system.

You need Microsoft Windows 7 (or newer) to install this product.

Please save the file you used to start this installation to a place you can find easily. Then use Windows Explorer to view that location and try installing Office again.

We found a problem!kWe're sorry, Office does not work with Windows 8 Consumer Preview.

You need the full version of Windows 8.

&Close3%s

<a href="%s">Go online for additional help.</a>

Invalid product %s specified.

Important: Once we

We hit an issue trying to uninstall your previous Office version./<a href="%s">Go online for additional help.</a>'hXXp://support.microsoft.com/kb/2739501 Save your work before continuing$We need to close the following apps:

We're sorry, Office (64-bit) couldn't be installed because your computer does not support 64-bit applications. Please try installing the 32-bit version of Office instead.

We're sorry, Office Click-to-Run installer encountered a problem because you have these Windows Installer based Office programs installed on your computer:

Click-to-Run and Windows Installer editions of Office programs don't get along for this version, so you can only have one type installed at a time. Please try installing the Windows Installer edition of Office instead, or uninstall your other Windows Installer based Office programs and try this installation again.

Microsoft OfficeB%s

Error Code: %s

Client update needed.QWe are sorry, but we could not complete the installation. Please try again later.-hXXp://go.microsoft.com/fwlink/?LinkId=613501

<a href="%s">Learn more</a>\This installation requires a compatible Microsoft Office program installed on your computer.

<a href="%s">Learn why</a>

<a href="%s">Learn why</a>#I understand. I don't want to wait.

%s You may want to contact your mailbox provider or system administrator about this issue.

<a href="%s">Learn why</a>MBusiness Contact Manager will no longer work.

%s You may want to contact your mailbox provider about these issues.

<a href="%s">Learn why</a>2Outlook 2016 is not compatible with Exchange 2007.SOutlook 2016 requires access to the AutoDiscover service for your Exchange service.

16.0.6831.5775

Bootstrapper.exe

Windows

OfficeOnDemand.exe

RoamingOffice.exe

{225F8CFE-1B76-48E6-8E75-62CC471AFA28}

hXXp://officeredir.microsoft.com/r/rlidOfficeWebHelp?p1=OCSAC2R%s&ver=15&clid=%d&helpid=%s-%s-%s&app=webview

Failed to create registry key: %d

AdminBootstrapper::Main: OException has occured. Exiting bootstrapper. %s

AdminBootstrapper::Main: Exception has occured %s. Exiting bootstrapper.

%s-ddd-dd%s.log

Xls Keyboard Input

%c%c%c%c

%c%c%c%c%c

%s (%#x)

hXXps://nexus.officeapps.live.com/nexus/upload/

application/vnd.ms-nexus-uls-v1

CMicrosoft Office/15.0 (Windows NT %d.%d; %s 15.0.%d; %s)

Passport

Mso::Http[%s]: setting identity '%s'

WinHttp handle is null

csi.dll

nMso::Http[%s]: failure due to the following not being an HTTP URL: %s

Mso::Http[%s]: failure due to the following not being an absolute URL: %s

Mso::Http[%s]: opens request method=%s, url=%s

Mso::Http[%s]: Error: failed to create http request settings

Mso::Http[%s]: received response header Id=%s

Mso::Http[%s]: Sending request for url=%s

Mso::Http[%s]: Request for url=%s is sent. Response status=%d

Mso::Http[%s]: Error: Failed to send request for %s, error=0xx

Mso::Http[%s]: Failed to send winhttp request, probably due to an auth issue

Mso::Http[%s]: received status text of ="%s"

Mso::Http[%s]: setting AutoLogonLevel=%u on the WinHttp request handle

Mso::Http[%s]: WinHttpQueryAuthSchemes returned: 0xx (%s)

Mso::Http[%s]: ChooseAuthScheme returned 0xx (%s)

Mso::Http[%s]: Context: Processing request token, authReason='Any'

Mso::Http[%s]: Context: AutoLogonLevel=%u

Mso::Http[%s]: Context: Processing request token, authReason='%s'

Mso::Http[%s]: Context: Setting certificate

Mso::Http[%s]: Context: Authenticating with LiveId token

Mso::Http[%s]: Context: Authenticating with Sharepoint Cookie

Mso::Http[%s]: Context: Authenticating with ADAL token

, null password

Mso::Http[%s]: Context: Authenticating with name/password, name=%s%s

HttpWin set ignore SSL cert warning

Mso::Http[%s]: Context: Failed to set %s creds

HttpWin Failed to set passport proxy creds

HttpWin received PASSPORT auth scheme - ignoring

@Mso::Http: Error: Could not get REQUEST_ID from settings

DCWinHttpHelperBase::SetWinHttpSecureProtocols failed to set secure protocols option, error %d

CWinHttpHelperBase::InitConnection failed in WinHttpConnect, error %d

CWinHttpHelperBase::CreateRequest failed in WinHttpOpenRequest, error %d

CWinHttpHelperBase::CreateRequest failed in WinHttpSetStatusCallback, error %d

CWinHttpProxyHandler::InitSession detected named proxy %s, bypass %s

CWinHttpProxyHandler::InitSession failed in WinHttpOpen with named proxy, error %d

CWinHttpProxyHandler::InitSession detected no proxy

CWinHttpProxyHandler::InitSession failed in WinHttpOpen with no proxy, error %d

CWinHttpProxyHandler::InitSession detected proxy %s auto config URL %s

CWinHttpProxyHandler::InitSession detected proxy auto detect

CWinHttpProxyHandler::InitSession setting proxy option proxy name %s, bypass %s

CWinHttpProxyHandler::InitSession setting default proxy option

CWinHttpProxyHandler::InitSession setting no proxy option

CWinHttpProxyHandler::InitSession using no proxy (on fallback)

CWinHttpProxyHandler::InitSession caught an unhandled exception

redirect URL and could not appropriately resolve it: hr=0xx

POWRPROF.DLL

IMM32.DLL

msosync.exe

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

software\policies\microsoft\windows\windows error reporting

software\microsoft\windows\windows error reporting

software\policies\windows\microsoft\windows error reporting

software\policies\microsoft\windows\windows error reporting\consent

software\microsoft\windows\windows error reporting\consent

ModulePath||%s,,CommandLine||%s,,Bitness||%d,,IntegrityLevel||0x%x,,SecuritySessionId||%d,,ExeVer||%s

OSVersion||%d.%d,,SP||%d,,ProductType||%d,,ProcessorArch||%d,,Locale||%d

GetMachineID - OException caught: %s.

"%s":"%s"

ErrorCode||%d,,ErrorType||%s,,AppVErrorSource||%s,,ErrorMessage||%s%s

G%s\%s

G%s.%s

Settings::PersistSetting - Setting Type (%d) is not valid for Store (%s)

Settings::PersistSetting - (%s) is not valid for Setting Type (%d) from Store (%s)

{80C94D2C-4DDE-47AE-82D2-A2ADDE81E653}

{6EE7622C-18D8-4005-9FB7-92DB644A279B}

{360E9813-EA13-4152-B020-B1D0BBF1AC17}

{F7461D52-7C2B-43B2-8744-EA958E0BD09A}

{323277B1-D81D-4329-973E-497F413BC5D0}

{FB4875EC-0C6B-450F-B82B-AB57D8D1677F}

{0900883A-7F90-4A04-831D-69B5881A0C1C}

{CE6A8540-B478-4070-9ECB-2052DD288047}

{FBE35AC1-57A8-4D02-9A23-5F97003C37D3}

{A30B8040-D68A-423F-B0B5-9CE292EA5A8F}

{FF693BF4-0276-4DDB-BB42-74EF1A0C9F4D}

{0EA305CE-B708-4D79-8087-D636AB0F1A4D}

{1B9F11E3-C85C-4E1B-BB29-879AD2C909E3}

{E1F5F599-D875-48CA-93C4-E96C473B29E7}

{DC981C6B-FC8E-420F-AA43-F8F33E5C0923}

{3391E125-F6E4-4B1E-899C-A25E6092D40D}

{FD97BCB1-8F3C-4185-91D2-A2AB7EE278C2}

{EFE1F3E6-AEA2-4144-A208-32AA872B6545}

{A3A4593B-97DC-4364-9910-70202AF2D0B5}

{771C3AFA-50C5-443F-B151-FF2546D863A0}

{A75ADD9F-3982-464D-93FE-7D3BEC07FB46}

{F3A4939A-92A7-47CC-9D05-7C7DB72DD968}

{8C762649-97D1-4953-AD27-B7E2C25B972E}

{A9419E0F-8A3F-4E58-A143-E4B4803F85D2}

{AE7B1E26-3AEE-4FE3-9C5B-88F05E36CD34}

{4A5D124A-E620-44BA-B6FF-658961B33B9A}

{6883893B-9DD9-4943-ACEB-58327AFDC194}

{427A28D1-D17C-4ABF-B717-32C780BA6F07}

{1B686580-9FB1-4B88-BFBA-EAE7C0DA31AD}

{B322DA9C-A2E2-4058-9E4E-F59A6970BD69}

{DB8E8683-A848-473B-B2E7-D1DE4D042095}

{00C79FF1-6850-443D-BF61-71CDE0DE305F}

{BA3E3833-6A7E-445A-89D0-7802A9A68588}

{370155F7-D1EC-4B8B-9FBA-EE8ACC6E0BB7}

{B13AFB38-CD79-4AE5-9F7F-EED058D750CA}

{024EA285-2685-48BC-87EF-79B48CC8C027}

{E13AC10E-75D0-4AFF-A0CD-764982CF541C}

{F97246FA-C8CE-4D41-B6F7-AE718E7891C5}

{AC4EFAF0-F81F-4F61-BDF7-EA32B02AB117}

{92485559-060B-44A7-9FC4-207C7A9BD39C}

{D9F5B1C6-5386-495A-88F9-9AD6B41AC9B3}

wwwbaseurl

reportid

%userprofile%\AppData\Local\Microsoft\Internet Explorer\Downloaded Program Files\Microsoft Office 15

-UNINSTALL_WEBCONTROLS

BootstrapperStateMachine::Run: OException has occured. Exiting bootstrapper. %s

G%lu-%d (%lu)

Dexcel.exe

firstrun.exe

groove.exe

infopath.exe

onenote.exe

visio.exe

winwordd.exe

Software\MozillaPlugins\@microsoft.com/Office on Demand;version=1

TrySetUserRegistry::HandleStateAction: OException has occured. Exiting bootstrapper. %s

TrySetUserRegistry::HandleStateAction: Failed to parse command line: %s

TrySetUserRegistry::TrySetAttemptGetKey: OException has occured. Continuing bootstrapper. %s

TrySetUserRegistry::TrySetAttemptGetKey: Failed to set AttemptGetKey for: %s

TrySetUserRegistry::TrySetLicenseTokenOrKey: Based on size, key was found.

OlsToken||%s

TrySetUserRegistry::TrySetLicenseTokenOrKey: Token found: %s

TrySetUserRegistry::TrySetLicenseTokenOrKey: No key or token found for %s

TrySetUserRegistry::TrySetLicenseTokenOrKey: OException has occured. Continuing bootstrapper. %s

TrySetUserRegistry::TrySetLicenseTokenOrKey: Failed to set read property for: %s

TrySetUserRegistry::GetHashedOLSToken: Failed to compute token hash. %s

TryParseCommandLine::HandleStateAction: Failed to parse the command line succesfully: %s

TryParseCommandLine::HandleStateAction: OException has occured. Exiting bootstrapper. %s

TryParseCommandLine::HandleStateAction: Failed to parse command line: %s

HandleCommandLineAction::HandleStateAction: OException has occured. Exiting bootstrapper. %s

TryGetElevation::HandleStateAction: OException has occured. Exiting bootstrapper. %s

BootStateMachine::ShowHelp: OException has occured. Exiting bootstrapper. %s

DownloadOffice::HandleStateAction: Failed to ensure Log Folder. Exception : %s

DownloadOffice::HandleStateAction: OException has occured. Exiting bootstrapper. %s

DownloadOffice::DownloadPackages: Getting Office lcid: %s

PackageOffice::HandleStateAction: OException has occured. Exiting bootstrapper. %s

BaseConfigure::TryGetConfiguration: Failed to ensure Log Folder. Exception : %s

BaseConfigure::TryGetConfiguration: Base Url %s is of type DVD

BaseConfigure::TryGetConfiguration: OException has occured. Exiting bootstrapper. %s

InstallationConfigure::HandleStateAction: OException has occured. Exiting bootstrapper. %s

AdminConfigure::HandleStateAction: OException has occured. Exiting bootstrapper. %s

Local\mutex_%s_%s_%d

OnDemandConfigure::HandleStateAction: Uninstall OOD Webcontrols.

OnDemandConfigure::HandleStateAction: Installing OOD Webcontrols.

OnDemandConfigure::HandleStateAction: OException has occured. Exiting bootstrapper. %s

OnDemandClearCache::HandleStateAction: Failed with OException: %s

OnDemandClearCache::HandleStateAction: Failed with unexpected exception. Last Error: %d

OnDemandClearCache::ClearCache: Roaming cleanup failed, launching might fail: %d

OnDemandClearCache::CacheStateHealthy: OException caught. Last Error: %d. %s

OnDemandClearCache::CacheStateHealthy: std::exception caught: %s Last Error: %d

OnDemandClearCache::CacheStateHealthy: Unknown exception caught while checking cache state: LastError: %d

OnDemandClearCache::Terminate: TerminateRoamingOfficeProcesses: Found: %d - %s.

OnDemandClearCache::Terminate: Terminating %d.

OnDemandClearCache::Terminate: Terminating %d failed.

OnDemandClearCache::Terminate: Terminating %d failed, most likely process is not running any more. %s

OnDemandClearCache::CheckRoamingUserChanged: CheckRoamingUserChanged: New puididentifier=%s is different from existing one %s.

OnDemandUninstallWebControl::HandleStateAction: Uninstlling the web controls and cleaning up.

OnDemandUninstallWebControl::HandleStateAction: Finished uninstall web controls.

%userprofile%

OnDemandUninstallWebControl::HandleStateAction: Delete client files located at: %s

OnDemandUninstallWebControl::HandleStateAction: Delete office files located at: %s

OnDemandUninstallWebControl::HandleStateAction: Unable to delete files.

OnDemandUninstallWebControl::HandleStateAction: OException has occured. Exiting bootstrapper. %s

OnDemandUninstallWebControl::HandleStateAction: Failed to show help to the user.

OnDemandInstallWebControl::HandleStateAction: installing the web controls.

Software\Microsoft\Windows\CurrentVersion\Ext\Settings\%s

Main: PERF: Done setting up roaming webcontrol

OnDemandInstallWebControl::HandleStateAction: OException has occured. Exiting bootstrapper. %s

OnDemandInstallWebControl::HandleStateAction: Failed to show help to the user.

RunPrereqs::HandleStateAction: OException has occured. Exiting bootstrapper. %s

RunPrereqs::HandleStateAction: Failed determine if prereqs have passed or not.

HandlePrereqFailure::HandleStateAction: Failure has occured with unknown action: %d

errorCode||%d,,errorSource||%d

TryShowUI::HandleStateAction - url is: %s. %s

errorCode||%d,,errorSource||%s

TryGetVersionDescriptor::HandleStateAction: Failed to succesfully get the cab file. %s

TryGetVersionDescriptor::HandleStateAction: Determined version to install {'Ver':'%s'}

TryGetVersionDescriptor::HandleStateAction: OException has occured. Exiting bootstrapper. %s

TryGetClient::HandleStateAction: Found C2R Client at: %s

TryGetClient::HandleStateAction: Found Firefly Client at: %s

TryGetClient::HandleStateAction : Creating InstallPath with ProtectedView Permissions: %s

TryGetClient::HandleStateAction: OException has occured. Exiting bootstrapper. %s

TryGetClient::HandleStateAction: Failed to download and extract the client cab: %s

TryGetClient::HandleStateAction: Getting Cab: %s

TryGetClient::HandleStateAction: Failed to succesfully get the cab file. %s

%s firstrun="%s"

scenariosubtype=onlinerepair %s

scenariosubtype=odt %s

scenariosubtype=odt%s %s

%sscenario=unknown %s

TryConfigureClient::HandleStateAction: OException has occured. Exiting bootstrapper. %s

TryConfigureClient::HandleStateAction: Failed to build command line. command: %s parameters: %s

TryConfigureClient::HandleStateAction: Platform to be removed: %s

TryConfigureClient::HandleStateAction: removing: %s

TryLaunchClient::HandleStateAction: C2R Client Install Process returned code %d

TryLaunchClient::HandleStateAction: C2R Client returned failing error code %d

TryLaunchClient::HandleStateAction: Failed to find the C2R Client located at %s. %s

TryLaunchClient::HandleStateAction: OException has occured while trying to launch installation %s.

TryHandleClientError::HandleStateAction: OException has occured while trying to launch installation %s

HandleCabExtractionFailures::TryHandleExctractionFailure: Invalid signature exception. OnDemand: %d

HandleCabExtractionFailures::TryHandleExctractionFailure: Download failed. OnDemand: %d

TryConfigureClient::HandleStateAction: Unable to find %s . Found Firefly client %s

TryConfigureClient::HandleStateAction: No client found at %s

TryCheckNetworkCost::HandleStateAction: OException has occured %s. Assuming low cost and proceeding

%s:%s

%s;%s

%s%s%s%s%s

TryLaunchFireflyUpgrade::HandleStateAction: Copying new client from: %s to: %s

baseurl="%s" culture=%s platform=%s version=%s productstoadd=%s migratingproducts="%s" cdnbaseurl="%s" installid=%s

updatesenabled=%s

updatesfromadminsource=%s

updatetoversion=%s

displaylevel=%s

forceappshutdown=%s

scenario=clientupgrade %s

TryLaunchFireflyUpgrade::HandleStateAction: Launching %s with parameters: %s

TryLaunchFireflyUpgrade::HandleStateAction: C2R Client returned failing error code %d

TryLaunchFireflyUpgrade::HandleStateAction: Unable to find: %s.

TryLaunchFireflyUpgrade::HandleStateAction: OException has occured while trying to launch installation %s.

TryLaunchFirefly:: No config file. Using default values for bootstrapper: %s

TryLaunchFirefly:: About to check the base url to see if it needs updating.

TryLaunchFirefly:: Need to add relative path to base url. Updating to: %s

TryLaunchFirefly:: Setting %s: %s

%s %s %s "%s" %s root\office15\firstrun.exe

operation

%s %s %s %s %s %s %s %s %s %s %s root\office15\firstrun.exe

TryLaunchFirefly::HandleStateAction: Launching %s with parameters: %s

TryLaunchFirefly::HandleStateAction: C2R Client returned failing error code %d

TryLaunchFirefly::HandleStateAction: OException has occured while trying to launch installation %s.

TryLaunchFireflyUninstall::HandleStateAction: Setting force app shutdown to %s

%s %s %s "%s"

TryLaunchFireflyUninstall::HandleStateAction: Launching %s with parameters: %s

TryLaunchFireflyUninstall::HandleStateAction: C2R Client returned failing error code %d

TryLaunchFireflyUninstall::HandleStateAction: OException has occured while trying to launch uninstallation %s.

ConfigureUpdatesSettings::HandleStateAction: OException has occured while trying to launch uninstallation %s.

BlockVolumeInstall::HandleStateAction: OException has occured while displaying error to user %s.

HMonitoredScope::ExecuteUnderStopWatch: %s. Approximate duration: %d milliseconds.

Prereq::PrereqsFailed returned %d

Prereq::PrereqsFailed: OException has occured. Exiting bootstrapper. %s

%s_%s_x-none

Args::Load: Saw protocol handler: %s And Have removed it

Args::Load: Saw protocol handler : %s And Have removed it from front of baseurl

Failed to get current process exe name

IFailed to create event %s

WebControl::Init: IsWow64Process failed; are we running under pre WinXP SP2? Assuming native.

WebControl::WriteUpdateKey: writing %s to registry as bootstrapper's version descriptor.

RoamingOfficeActiveX.32.dll

RoamingOfficeActiveX.64.dll

npofficeondemand.dll

bootstrapper.exe

.CONFLICT.%d

Copying %s to %s

WebControl::TryCopyFiles: Exception caught copying activex to %s

WebControl::TryCopyFiles: OException has occured %s.

WebControl::TryCopyFiles: Failed to copy activex to install dir after %d tries; giving up.

WebControl::RunDll: RunDll: calling %s in dll: %s

%windir%\system32\rundll32.exe

%windir%\Sysnative\rundll32.exe

%s,%s

Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\%s

Software\Microsoft\Windows\CurrentVersion\Ext\Stats\%s\iexplore\AllowedDomains\*

Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\%s

%s:Zone.Identifier

SOFTWARE\Classes\CLSID\%s

MarkSafeForScripting: We are running under WoW, setting WoW keys for safe scripting and initialization.

SOFTWARE\Classes\Wow6432Node\CLSID\%s

MarkSafeForScripting: We are running native (non-WoW), setting native keys for safe scripting and initialization.

Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}

Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}

URL Protocol

Software\Microsoft\Internet Explorer\ProtocolExecute\

%s\MimeTypes\application/x-vnd.officeondemand.1

ieframe.dll

WebControl::Load: IERefreshElevationPolicies succeeded.

WebControl::Load: IERefreshElevationPolicies failed: hresult 0x%x.

WebControl::RemoveAll: Unable to delete %s . Will do so on reboot.

WebControl::RemoveAll: Cleaning up registry entries.

Software\Classes\CLSID\%s\InProcServer32

Software\Classes\Wow6432Node\CLSID\%s\InProcServer32

WebControl::FindActiveXDll: Couldnt open key, maybe AX is not registered? Nothing to do.

WebControl::FindActiveXDll: Dllpath is %s

hXXp://office.microsoft.com

URLInfoAbout

c2rui.dll

RoamingApps_CloseWebcontrolInstallDialog

AKernel32.dll

StreamFile::MoveFile: Failed to replace existing file: "%s" with "%s":

BHKEY_CURRENT_USER

WinHttpSecureProtocols

Failed to retrieve version information about the current operation system.

ORegistryKey.DeleteSubKey failure: The key is not opened

ORegistryKey.DeleteSubKey failure:The specified subkey "%s" is not a valid reference to a registry key

::OpenProcess failed to retrieve process handle for ProcessId=%d (DesiredAccess=%d, fInheritHandle=%d).

::EnumWindows() failed to enumerate the list of windows for processId: %d

::GetWindowTextLength() failed to get the length of window title for window-handle: %d

::GetWindowTextW() failed to get window title for window-handle: %d

::GetWindowThreadProcessId() failed to get the ProcessId for window with handle: %d.

JFailed to Open Win Http session

GFailed to copy string '%S' to buffer.

Configuration::AdjustBaseUrlForOEMSource: Found OEM source registry keys. Redirecting base url: %s

Configuration::GetProductSource: Adjusted base url: %s

CabManager::Extract: Extraction Failed for "%s". Size:%u, MD5 hash:%s. %s

CabManager::CultureFromLCID: Could not find culture for LCID %d

CabErrorDetection::Validate: hash file not found for "%s"

GFileDownload::Download: Downloading %s -> %s

FileDownload::Download: Download failed for "%s", try %d. %s

IsNativeValidator::CheckPreReq: OException has occured %s. Failing test

SXSValidator::CheckPreReq: Has has unknown C2R Client platform installed: %s

SXSValidator::CheckPreReq: Has has unknown Firefly platform installed: %s. %s

SXSValidator::BlockSetup: Found Blocking application %s.

GrooveMSIValidator::BlockSetup: Found Blocking application %s.

GrooveMSIValidator::CheckPreReq: Has preexisting blocking MSI products: %s.

GrooveMSIValidator::CheckPreReq: Existing MSI product test passed.

ClientValidator::CheckPreReq: C2R Client located here %s is version %s

ClientValidator::CheckPreReq: Comparison result: %d

ClientValidator::CheckPreReq: Version of client too low to install with: Have: %s Need: %s

ClientValidator::CheckPreReq: Firefly Client located here %s is version %s

ClientValidator::CheckPreReq: returning: %d.

O15BetaValidator::CheckPreReq: OException has occured %s. Failing test

O15BetaValidator::GetErrorMessageBodyParam: ILanguage value used: %d

O15BetaValidator::GetErrorMessageBodyParam: OException has occured %s. Using default value

MSIxC2RBlockValidator::CheckPreReq: OException has occured %s.

ConfigFile::ProcessExcludeAppNodes: Illegal app specified for exclude %s

Not an Http source

Download failed for "%s", try %d. %s

KParseProductCode failed for %s

FhXXp://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675K_scenario_admin_culture_en-us_lcid_1033_platform_x86_productreleaseid_none_

Microsoft Office5The Office on Demand webcontrols have been installed.'Office needs a newer version of Windows

You can try again in a moment, we recommend using a new web browser window.

We're sorry, we can't stream your Office program on demand for you on this computer because it's not running a modern Windows operating system.

Microsoft Windows 7 (or newer) is required to stream Office on Demand programs.

You can try editing this document in your web browser instead.

We're done uninstalling!7Office on Demand web browser add-ons have been removed.*Microsoft Office on Demand Browser Add-ons

You can try launching again in a moment or try using the Office Web Apps for now if this problem continues.

%s-Office on Demand needs to close some programs

Client update needed.QWe are sorry, but we could not complete the installation. Please try again later.

You're all set.<OneDrive for Business is already installed on your computer.B%s

We're sorry, Office Click-to-Run installer encountered a problem because you have these Windows Installer based Office programs installed on your computer:

Click-to-Run and Windows Installer editions of Office programs don't get along for this version, so you can only have one type installed at a time. Please try installing the Windows Installer edition of Office instead, or uninstall your other Windows Installer based Office programs and try this installation again.

15.0.4801.1000

<Task version="1.2" xmlns="hXXp://schemas.microsoft.com/windows/2004/02/mit/task">

<ExecutionTimeLimit>PT0S</ExecutionTimeLimit>

<Exec>

<Command>"%WINDIR%\OInstall.exe"</Command>

</Exec>

' Name: OffScrubC2R.vbs

' Author: Microsoft Customer Support Services

Const SCRIPTFILE = "OffScrubC2R.vbs"

Const RETVALFILE = "ScrubRetValFile.txt"

Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\"

Const ERROR_STAGE1 = 8 'Bit #4. Informational. Msiexec based install was not possible

Const ERROR_STAGE2 = 16 'Bit #5. Critical. Not all of the intended cleanup operations could be applied

Const ERROR_USER_ABORT = &HC000013A 'RESERVED. Dec -1073741510. Critical error. Returned when user aborts with <Ctrl> <Break> or closes the cmd window

Dim ComputerItem, Key, Item, LogStream, TmpKey

Dim KeepLis, dicApps, KeepFolder, dicDelRegKey, KeepReg

Dim sOSinfo, sDefault, sTemp, sTmp, sCmd, sLogDir, sPrompt, sProfilesDirectory

Dim f64, fLogInitialized, fNoCancel, fRemoveOse, fDetectOnly, fQuiet, fForce

ParseCmdLine

Log "Ensure Windows Installer metadata integrity " & " (" & Time & ")"

EnsureValidWIMetadata HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products", COMPRESSED

EnsureValidWIMetadata HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components", COMPRESSED

If dicC2RSuite.Count > 0 Then

For Each Key In dicC2RSuite.Keys

Log " - " & Key & " - " & dicC2RSuite.Item(Key)

Next 'Key

' For Each Item in dicC2RSuite.Items

If oFso.FolderExists(oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office 15") Then

sPackageFolder = oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office 15"

ElseIf oFso.FolderExists(oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office 16") Then

sPackageFolder = oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office 16"

ElseIf oFso.FolderExists(oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office\PackageManifests") Then

sPackageFolder = oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office"

ElseIf oFso.FolderExists(oWShell.ExpandEnvironmentStrings("%programfiles(x86)%") & "\Microsoft Office\PackageManifests") Then

sPackageFolder = oWShell.ExpandEnvironmentStrings("%programfiles(x86)%") & "\Microsoft Office"

If CBool(iError AND ERROR_STAGE1) Then Log " - Msiexec failed"

If MsgBox(sPrompt, vbYesNo, SCRIPTNAME & " - Reboot Required") = VB_YES Then

Set oWmiReboot = GetObject("winmgmts:{impersonationLevel=impersonate,(Shutdown)}!\\.\root\cimv2")

Set colOS = oWmiReboot.ExecQuery ("Select * from Win32_OperatingSystem")

oOS.Reboot()

wscript.quit iError

fLogInitialized = False

Set oWmiLocal = GetObject("winmgmts:\\.\root\cimv2")

Set oWShell = CreateObject("Wscript.Shell")

Set oShellApp = CreateObject("Shell.Application")

Set oFso = CreateObject("Scripting.FileSystemObject")

Set oMsi = CreateObject("WindowsInstaller.Installer")

Set oReg = GetObject("winmgmts:\\.\root\default:StdRegProv")

sAppData = oWShell.ExpandEnvironmentStrings("%appdata%")

sLocalAppData = oWShell.ExpandEnvironmentStrings("%localappdata%")

sTemp = oWShell.ExpandEnvironmentStrings("%temp%")

sAllUsersProfile = oWShell.ExpandEnvironmentStrings("%allusersprofile%")

RegReadValue HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory", sProfilesDirectory, "REG_EXPAND_SZ"

If NOT oFso.FolderExists(sProfilesDirectory) Then

sProfilesDirectory = oFso.GetParentFolderName(oWShell.ExpandEnvironmentStrings("%userprofile%"))

sProgramFiles = oWShell.ExpandEnvironmentStrings("%programfiles%")

'sProgramFilesX86 = deferred. Depends on operating system architecture check

sCommonProgramFiles = oWShell.ExpandEnvironmentStrings("%commonprogramfiles%")

'sCommonProgramFilesX86 = deferred. Depends on operating system architecture check

sProgramData = oWSHell.ExpandEnvironmentStrings("%programdata%")

sWinDir = oWShell.ExpandEnvironmentStrings("%windir%")

sScriptDir = wscript.ScriptFullName

If InStr(LCase(wscript.path), "syswow64") > 0 Then RelaunchAs64Host

If Not oFso.FolderExists(sScrubDir) Then oFso.CreateFolder sScrubDir

' detect bitness of the operating system

Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_ComputerSystem")

f64 = Instr(Left(Item.SystemType, 3), "64") > 0

If f64 Then sProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%programfiles(x86)%")

If f64 Then sCommonProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%CommonProgramFiles(x86)%")

' get Win32_OperatingSystem details

Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_OperatingSystem")

sOSinfo = sOSinfo & Item.Caption

sOSinfo = sOSinfo & Item.OtherTypeDescription

sOSinfo = sOSinfo & ", " & "SP " & Item.ServicePackMajorVersion

sOSinfo = sOSinfo & ", " & "Version: " & Item.Version

sOsVersion = Item.Version

sOSinfo = sOSinfo & ", " & "Codepage: " & Item.CodeSet

sOSinfo = sOSinfo & ", " & "Country Code: " & Item.CountryCode

sOSinfo = sOSinfo & ", " & "Language: " & Item.OSLanguage

If UCase(Mid(Wscript.FullName, Len(Wscript.Path)   2, 1)) = "C" Then

If Not fLogInitialized Then CreateLog

wscript.quit iError

fCScript = UCase(Mid(Wscript.FullName, Len(Wscript.Path)   2, 1)) = "C"

Set dicInstalledSku = CreateObject("Scripting.Dictionary")

Set dicRemoveSku = CreateObject("Scripting.Dictionary")

Set KeepSku = CreateObject("Scripting.Dictionary")

Set KeepLis = CreateObject("Scripting.Dictionary")

Set KeepFolder = CreateObject("Scripting.Dictionary")

Set dicApps = CreateObject("Scripting.Dictionary")

Set dicDelRegKey = CreateObject("Scripting.Dictionary")

Set KeepReg = CreateObject("Scripting.Dictionary")

Set dicC2RSuite = CreateObject("Scripting.Dictionary")

Set dicDelInUse = CreateObject("Scripting.Dictionary")

Set dicDelFolder = CreateObject("Scripting.Dictionary")

' add initial known .exe files that need to be closed

dicApps.Add "appvshnotify.exe", "appvshnotify.exe"

dicApps.Add "integratedoffice.exe", "integratedoffice.exe"

dicApps.Add "integrator.exe", "integrator.exe"

dicApps.Add "firstrun.exe", "firstrun.exe"

dicApps.Add "setup.exe", "setup.exe"

dicApps.Add "communicator.exe", "communicator.exe"

dicApps.Add "msosync.exe", "msosync.exe"

dicApps.Add "OneNoteM.exe", "OneNoteM.exe"

dicApps.Add "iexplore.exe", "iexplore.exe"

dicApps.Add "mavinject32.exe", "mavinject32.exe"

dicApps.Add "werfault.exe", "werfault.exe"

dicApps.Add "perfboost.exe", "perfboost.exe"

dicApps.Add "roamingoffice.exe", "roamingoffice.exe"

dicApps.Add "officeclicktorun.exe", "officeclicktorun.exe"

dicApps.Add "officeondemand.exe", "officeondemand.exe"

dicApps.Add "OfficeC2RClient.exe", "OfficeC2RClient.exe"

' ParseCmdLine

Sub ParseCmdLine

iArgCnt = Wscript.Arguments.Count

If wscript.Arguments(0) = "UAC" Then

If wscript.arguments.count = 1 Then iArgCnt = 0

Select Case UCase(wscript.ScriptName)

arrArguments(iCnt) = UCase(Wscript.Arguments(iCnt))

fLogInitialized = False

If oFso.FolderExists(arrArguments(iCnt   1)) Then

oFso.CreateFolder(arrArguments(iCnt   1))

If Not fLogInitialized Then CreateLog

End Sub 'ParseCmdLine

Wscript.Echo sErr & vbCrLf & _

Wscript.Quit

' name in the "Uninstall" key.

Dim sCurKey, sValue, sConfigName, sCulture, sDisplayVersion, sProd

Dim arrKeys, arrProducts, arrCultures

Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\"

If dicInstalledSku.Count > 0 Then Exit Sub 'Already done from command line parser

' Check O15 Configuration key

Err.Clear

If NOT dicInstalledSku.Exists(LCase(prod)) Then

dicInstalledSku.Add LCase(prod), sDisplayVersion

' Check O15 PropertyBag key

' Check Office Configuration key

If RegEnumKey(HKLM, REG_C2RPRODUCTIDS & sActiveConfiguration & "\culture", arrCultures) Then

If RegEnumKey(HKLM, REG_C2RPRODUCTIDS & sActiveConfiguration, arrProducts) Then

If NOT dicInstalledSku.Exists(sProd) Then

dicInstalledSku.Add sProd, sDisplayVersion

Err.Clear

If NOT dicInstalledSku.Exists(LCase(prod)) Then

' Check O16 Configuration key

RegEnumKey HKLM, REG_ARP, arrKeys

If IsArray(arrKeys) Then

For Each ArpItem in arrKeys

sCurKey = REG_ARP & ArpItem & "\"

fUninstallString = RegReadValue(HKLM, sCurKey, "UninstallString", sValue, "REG_SZ")

If (fUninstallString And( (InStr(UCase(sValue), UCase("Microsoft Office 1")) > 0) Or (InStr(UCase(sValue), UCase("OfficeClickToRun.exe")) > 0) )) Then

fDisplayVersion = RegReadValue(HKLM, sCurKey, "DisplayVersion", sDisplayVersion, "REG_SZ")

If NOT dicC2RSuite.Exists(ArpItem) Then dicC2RSuite.Add ArpItem, prod & " - " & sDisplayVersion

fSystemComponent0 = NOT (RegReadValue(HKLM, sCurKey, "SystemComponent", sValue, "REG_DWORD") AND (sValue = "1"))

fDisplayVersion = RegReadValue(HKLM, sCurKey, "DisplayVersion", sValue, "REG_SZ")

If Not Err <> 0 Then Err.Clear

fUninstallString = RegReadValue(HKLM, sCurKey, "UninstallString", sUninstallString, "REG_SZ")

If (fUninstallString And( (InStr(UCase(sUninstallString), UCase("Microsoft Office 1")) > 0) Or (InStr(UCase(sUninstallString), UCase("OfficeClickToRun.exe")) > 0) )) Then

If NOT dicInstalledSku.Exists(LCase(sConfigName)) Then

dicInstalledSku.Add LCase(sConfigName), sDisplayVersion

If NOT dicC2RSuite.Exists(ArpItem) Then dicC2RSuite.Add ArpItem, sConfigName & " - " & sDisplayVersion

' classic .msi install SKU

If NOT KeepSku.Exists(ArpItem) Then KeepSku.Add ArpItem, sConfigName & " - " & sDisplayVersion

RegReadValue HKLM, sCurKey, "DisplayName", sConfigName, "REG_SZ"

If NOT dicInstalledSku.Exists(LCase(ArpItem)) Then

dicInstalledSku.Add LCase(ArpItem), sDisplayVersion

If NOT dicC2RSuite.Exists(ArpItem) Then dicC2RSuite.Add ArpItem, sConfigName & " - " & sDisplayVersion

sConfigName = "MSOIDLOGIN"

If NOT KeepSku.Exists(ArpItem) Then KeepSku.Add ArpItem, ArpItem

Sub EnsureValidWIMetadata(hDefKey, sKey, iValidLength)

Dim arrKeys

Dim SubKey

If Len(sKey) > 1 Then

If Right(sKey, 1) = "\" Then sKey = Left(sKey, Len(sKey) - 1)

If RegEnumKey(hDefKey, sKey, arrKeys) Then

For Each SubKey in arrKeys

If NOT Len(SubKey) = iValidLength Then

RegDeleteKey hDefKey, sKey & "\" & SubKey & "\"

Next 'SubKey

Dim sCleanOSPP, sCmd, sRetVal

CONST OfficeAppId = "0ff1ce15-a989-479d-af46-f275c6370663" 'Office 2013

sCleanOSPP = "x64\CleanOSPP.exe"

If Not f64 Then sCleanOSPP = "x86\CleanOSPP.exe"

If oFso.FileExists(sScriptDir & sCleanOSPP) Then

sCmd = """" & sScriptDir & sCleanOSPP & """"

Log " Running: " & sCmd

sRetVal = oWShell.Run(sCmd, 0, True)

If NOT (dicC2RSuite.Count > 0 OR KeepSku.Count > 0) Then

Set oProductInstances = oWmiLocal.ExecQuery("SELECT ID, ApplicationId, PartialProductKey, Name, ProductKeyID FROM SoftwareLicensingProduct WHERE ApplicationId = '" & OfficeAppId & "' " & "AND PartialProductKey <> NULL")

Set oProductInstances = oWmiLocal.ExecQuery("SELECT ID, ApplicationId, PartialProductKey, Name, ProductKeyID FROM OfficeSoftwareProtectionProduct WHERE ApplicationId = '" & OfficeAppId & "' " & "AND PartialProductKey <> NULL")

pi.UninstallProductKey( pi.ProductKeyID)

Dim sCmd

oWShell.Run "SCHTASKS /Delete /TN FF_INTEGRATEDstreamSchedule /F", 0, False

wscript.sleep 500

oWShell.Run "SCHTASKS /Delete /TN FF_INTEGRATEDUPDATEDETECTION /F", 0, False

oWShell.Run "SCHTASKS /Delete /TN C2RAppVLoggingStart /F", 0, False

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "Office 15 Subscription Heartbeat" & Chr(34) & " /F"

oWShell.Run sCmd, 0, False

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "Microsoft Office 15 Sync Maintenance for {d068b555-9700-40b8-992c-f866287b06c1}" & Chr(34) & " /F"

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "\Microsoft\Office\OfficeInventoryAgentFallBack" & Chr(34) & " /F"

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "\Microsoft\Office\OfficeTelemetryAgentFallBack" & Chr(34) & " /F"

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "\Microsoft\Office\OfficeInventoryAgentLogOn" & Chr(34) & " /F"

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "\Microsoft\Office\OfficeTelemetryAgentLogOn" & Chr(34) & " /F"

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "Office Background Streaming" & Chr(34) & " /F"

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "\Microsoft\Office\Office Automatic Updates" & Chr(34) & " /F"

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "\Microsoft\Office\Office ClickToRun Service Monitor" & Chr(34) & " /F"

sCmd = "SCHTASKS /Delete /TN " & Chr(34) & "Office Subscription Maintenance" & Chr(34) & " /F"

sUserWarn = "Please save all open documents and close all Office, IE and Windows Explorer applications before proceeding." & vbCrLf & _

"When you click OK this removal process will terminate all running Office, IE and Windows Explorer processes and applications." & vbCrLf & vbCrLf & _

For Each app in dicApps.Keys

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name like '" & sAppName & "'")

If NOT InStr(sUserWarn, Process.Name) > 0 Then sUserWarn = sUserWarn & vbCrLf & " - " & Process.Name

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process")

For Each prop in Process.Properties_

If prop.Name = "ExecutablePath" Then

If IsC2R(prop.Value) Then sUserWarn = sUserWarn & vbCrLf & " - " & Process.Name

iRet = MsgBox(sUserWarn, 49, "Save your unsaved work now!")

For Each app in dicApps.Keys

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name like '" & sAppName & "'")

sOut = "End process '" & Process.Name

iRet = Process.Terminate()

CheckError "CloseOfficeApps: " & "Process.Name"

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process")

For Each prop in Process.Properties_

If prop.Name = "ExecutablePath" Then

If IsC2R(prop.Value) Then

sOut = "End process '" & Process.Name

iRet = Process.Terminate()

CheckError "CloseOfficeApps: " & "Process.Name"

If fWait Then wscript.sleep 5000

Dim hDefKey, sSubKeyName, sValue, Name, arrNames, arrTypes

Dim sku, prod, sUninstallCmd, sReturn, sMsiProp, sCmd

Set OseService = oWmiLocal.Execquery("Select * From Win32_Service Where Name like 'ose%'")

If (srvc.StartMode = "Disabled") AND (Not srvc.ChangeStartMode("Manual") = 0) Then _

If (Not srvc.StartName = "LocalSystem") AND (srvc.Change( , , , , , , "LocalSystem", "")) Then _

If NOT dicC2RSuite.Count > 0 Then

If oFso.FolderExists(sValue & "\root\Integration") Then

sCmd = "cmd.exe /c del " & chr(34) & sPkgFld & "\root\Integration\C2RManifest*.xml" & chr(34)

sReturn = oWShell.Run (sCmd, 0, True)

If oFso.FileExists(sPkgFld & "\root\Integration\integrator.exe") Then

sCmd = chr(34) & sPkgFld & "\root\Integration\integrator.exe" & chr(34) & " /U /Extension PackageRoot=" & chr(34) & sPkgFld & "\root" & chr(34) & " PackageGUID=" & sPkgGuid

Log " Running: " & sCmd

sReturn = oWShell.Run (sCmd, 0, True)

sCmd = chr(34) & sPkgFld & "\root\Integration\integrator.exe" & chr(34) & " /U"

If oFso.FileExists(sProgramData & "\Microsoft\ClickToRun\{" & sPkgGuid & "}\integrator.exe") Then

sCmd = chr(34) & sProgramData & "\Microsoft\ClickToRun\{" & sPkgGuid & "}\integrator.exe" & chr(34) & " /U /Extension PackageRoot=" & chr(34) & sPkgFld & "\root" & chr(34) & " PackageGUID=" & sPkgGuid

' delete potential blocking registry keys for msiexec based tasks

For Each sku in dicC2RSuite.Keys

RegDeleteKey HKLM, REG_ARP & sku

RegDeleteKey HKCU, "SOFTWARE\Microsoft\Office\15.0\ClickToRun"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRun"

RegDeleteKey HKCU, "SOFTWARE\Microsoft\Office\16.0\ClickToRun"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRun"

RegDeleteKey HKCU, "SOFTWARE\Microsoft\Office\ClickToRun"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\ClickToRun"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office"

RegDeleteKey HKCU, "SOFTWARE\Microsoft\Office"

' AppV keys

hDefKey = HKCU

sSubKeyName = "SOFTWARE\Microsoft\AppV\ISV"

If RegEnumValues(hDefKey, sSubKeyName, arrNames, arrTypes) Then

If IsC2R(Name) Then RegDeleteValue hDefKey, sSubKeyName, Name, False

If hDefKey = HKLM Then Exit Do

hDefKey = HKLM

' msiexec based uninstall

For Each prod in oMsi.Products

Log "Calling msiexec.exe to remove " & prod

sUninstallCmd = "msiexec.exe /x" & prod & sMsiProp

sUninstallCmd = sUninstallCmd & " /q"

sUninstallCmd = sUninstallCmd & " /qb-!"

sUninstallCmd = sUninstallCmd & " /l*v " & chr(34) & sLogDir & "\Uninstall_" & prod & ".log" & chr(34)

LogOnly "Calling msiexec with '" & sUninstallCmd & "'"

sReturn = oWShell.Run(sUninstallCmd, 0, True)

Log "msiexec returned: " & SetupRetVal(sReturn) & " (" & sReturn & ")" & vbCrLf

oWShell.Run "cmd.exe /c net stop msiserver", 0, False

Dim hDefKey, item, name, value, RetVal

Dim sGuid, sSubKeyName, sValue, sCmd

Dim arrKeys, arrNames, arrTypes, arrTestNames, arrTestTypes

RegDeleteKey HKCU, "Software\Microsoft\Office\15.0\Registration"

RegDeleteKey HKCU, "Software\Microsoft\Office\16.0\Registration"

RegDeleteKey HKCU, "Software\Microsoft\Office\Registration"

' AppV key "SOFTWARE\Microsoft\AppV" has already been cleared in uninstall stage

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot\Virtual"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot\Virtual"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\Common\InstallRoot\Virtual"

If NOT KeepSku.Count > 0 Then RegDeleteKey HKLM, "SOFTWARE\Classes\CLSID\{2027FC3B-CF9D-4ec7-A823-38BA308625CC}"

' C2R keys

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\15.0\ClickToRunStore"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\16.0\ClickToRunStore"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Office\ClickToRunStore"

' Office key in HKLM

If Not KeepSku.Count > 0 Then

RegDeleteKey HKLM, "Software\Microsoft\Office\15.0"

RegDeleteKey HKLM, "Software\Microsoft\Office\16.0"

' Run key

sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

If RegEnumValues (HKLM, sSubKeyName, arrNames, arrTypes) Then

If RegReadValue(HKLM, sSubKeyName, name, sValue, "REG_SZ") Then

If IsC2R(sValue) Then RegDeleteValue HKLM, sSubKeyName, name, False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "Lync15", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run", "Lync16", False

If NOT KeepSku.Count > 0 Then

RegDeleteKey HKLM, "SOFTWARE\Classes\Protocols\Handler\osf"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 1 (ErrorConflict)"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 2 (SyncInProgress)"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 3 (InSync)"

RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 1 (ErrorConflict)"

RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 2 (SyncInProgress)"

RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Microsoft SPFS Icon Overlay 3 (InSync)"

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{B28AA736-876B-46DA-B3A8-84C5E30BA492}", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{8B02D659-EBBB-43D7-9BBA-52CF22C5B025}", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{42042206-2D85-11D3-8CFF-005004838597}", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{506F4668-F13E-4AA1-BB04-B43203AB3CC0}", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{D66DC78C-4F61-447F-942B-3FB6980118CF}", False

RegDeleteValue HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\", "{46137B78-0EC3-426D-8B89-FF7C3A458B5E}", False

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}"

RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}"

RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}"

RegDeleteKey HKLM, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}"

' Web Sites

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\Namespace\{B28AA736-876B-46DA-B3A8-84C5E30BA492}"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\Namespace\{46137B78-0EC3-426D-8B89-FF7C3A458B5E}"

RegDeleteKey HKLM, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Microsoft Office Temp Files"

End If 'NOT KeepSku.Count > 0

If RegEnumKey(HKLM, REG_ARP, arrKeys) Then

For Each item in arrKeys

If CheckDelete(sGuid) Then RegDeleteKey HKLM, REG_ARP & item & "\"

LogH2 "Scanning Windows Installer metadata for removeable UpgradeCodes"

sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\"

hDefKey = HKLM

sSubKeyName = "Installer\UpgradeCodes\"

hDefKey = HKCR

sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\"

sSubKeyName = "Installer\Features\"

sSubKeyName = "Installer\Products\"

If RegEnumKey(hDefKey, sSubKeyName, arrKeys) Then

For Each item in arrKeys

' check if it's an Office key

RegEnumValues hDefKey, sSubKeyName & item, arrNames, arrTypes

If CheckDelete(sGuid) Then RegDeleteValue hDefKey, sSubKeyName & item & "\", name, True

RegDeleteValue hDefKey, sSubKeyName & item & "\", name, True

' if all entries were removed - delete the key

If NOT RegEnumValues(hDefKey, sSubKeyName & item, arrNames, arrTypes) Then RegDeleteKey hDefKey, sSubKeyName & item & "\"

RegDeleteKey hDefKey, sSubKeyName & item & "\"

End If 'RegEnumKey

LogH2 "Scanning Windows Installer Global Components metadata"

sSubKeyName = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\"

hDefKey = HKLM

If RegEnumKey(hDefKey, sSubKeyName, arrKeys) Then

If RegEnumValues(hDefKey, sSubKeyName & item, arrNames, arrTypes) Then

RegDeleteValue hDefKey, sSubKeyName & item & "\", name, False

' if all entries were removed - delete the key

If NOT RegEnumValues(hDefKey, sSubKeyName & item, arrTestNames, arrTestTypes) Then RegDeleteKey hDefKey, sSubKeyName & item & "\"

End If 'RegEnumKey

LogH2 "Scanning Windows Installer Published Components metadata"

sSubKeyName = "Installer\Components\"

hDefKey = HKCR

If RegReadValue (hDefKey, sSubKeyName & item, name, sValue, "REG_MULTI_SZ") Then

If NOT UBound(arrMultiSzValues) = i Then oReg.SetMultiStringValue hDefKey, sSubKeyName & item, name,arrMultiSzNewValues

' if all entries were removed - delete the key

If NOT RegEnumValues(hDefKey, sSubKeyName & item, arrTestNames, arrTestTypes) Then RegDeleteKey hDefKey, sSubKeyName & item & "\"

dicApps.Add "explorer.exe", "explorer.exe"

dicApps.Add "msiexec.exe", "msiexec.exe"

dicApps.Add "ose.exe", "ose.exe"

If oFso.FolderExists(sProgramFiles & "\Microsoft Office 15") _

Or oFso.FolderExists(sProgramFiles & "\Microsoft Office 16") _

Or oFso.FolderExists(oWShell.ExpandEnvironmentStrings("%programfiles%") & "\Microsoft Office\PackageManifests") _

Or oFso.FolderExists(oWShell.ExpandEnvironmentStrings("%programfiles(x86)%") & "\Microsoft Office\PackageManifests") Then

Log " Attention: Now closing Explorer.exe for file delete operations"

wscript.sleep 2000

DeleteFile sProgramFiles & "\Microsoft Office\AppXManifest.xml"

DeleteFile sProgramFiles & "\Microsoft Office\FileSystemMetadata.xml"

If Not KeepSku.Count > 0 Then

DeleteFile sProgramFilesX86 & "\Microsoft Office\AppXManifest.xml"

DeleteFile sProgramFilesX86 & "\Microsoft Office\FileSystemMetadata.xml"

If oFso.FileExists(sProgramData & "\Microsoft\office\FFPackageLocker") Then DeleteFile sProgramData & "\Microsoft\office\FFPackageLocker"

If oFso.FileExists(sProgramData & "\Microsoft\office\FFStatePBLocker") Then DeleteFile sProgramData & "\Microsoft\office\FFStatePBLocker"

If NOT KeepSku.Count > 0 Then DeleteFolder sProgramData & "\Microsoft\office\Heartbeat"

DeleteFolder oWShell.ExpandEnvironmentStrings("%userprofile%") & "\Microsoft Office"

DeleteFolder oWShell.ExpandEnvironmentStrings("%userprofile%") & "\Microsoft Office 15"

DeleteFolder oWShell.ExpandEnvironmentStrings("%userprofile%") & "\Microsoft Office 16"

' restore explorer.exe if needed

If dicDelFolder.Count > 0 Then

If dicDelInUse.Count > 0 Then ScheduleDeleteEx

Set oFolder = oFso.GetFolder(sFolder)

If CBool(oFolder.Attributes AND 1024) Then Exit Sub

For Each fld In oFolder.SubFolders

CleanShortcuts fld.Path, fDelete, fUnPin

For Each file In oFolder.Files

If LCase(Right(file.Path, 4)) = ".lnk" Then

LogOnly " check file: " & file.Path

set sc = oWShell.CreateShortcut(file.Path)

'Compare if the shortcut target is in the list of executables that will be removed

'LogOnly " - SC.TargetPath: " & sc.TargetPath

If Len(sc.TargetPath) > 0 Then

If InStr(sc.TargetPath,"{") > 0 Then

'Handle Windows Installer shortcuts

If Len(sc.TargetPath) >= InStr(sc.TargetPath,"{")   37 Then

If CheckDelete(Mid(sc.TargetPath, InStr(sc.TargetPath,"{"), 38)) Then fDeleteSC = True

If NOT oFso.FileExists(sc.TargetPath) Then

If IsC2R(sc.TargetPath) Then

LogOnly "removing Office shortcut with non-existent target: " & file.Path & " - " & sc.TargetPath

'LogOnly " - keep orphaned SC as target is not in scope: " & sc.TargetPath

'LogOnly " - keep SC as shortcut target does still exist: " & sc.TargetPath

sFolder = file.Drive & file.Path

DeleteFile file.Path

Set fldItem = oShellApp.NameSpace(file.ParentFolder.Path).ParseName(file.Name)

For Each verb in fldItem.Verbs

verb.DoIt

If iVersionNT = 601 Then verb.DoIt

' Recursively search and clear the HKLM Office key from references in scope

Sub ClearOfficeHKLM (sSubKeyName)

Dim key, name

Dim arrKeys, arrNames, arrTypes

Dim arrTestNames, arrTestTypes, arrTestKeys

If RegEnumKey(HKLM, sSubKeyName, arrKeys) Then

For Each key in arrKeys

ClearOfficeHKLM sSubKeyName & "\" & key

Next 'key

If RegEnumValues(HKLM, sSubKeyName, arrNames, arrTypes) Then

' clear out empty keys

If (NOT RegEnumValues(HKLM, sSubKeyName, arrNames, arrTypes)) AND _

(NOT RegEnumKey(HKLM, sSubKeyName, arrKeys)) AND _

(NOT KeepSku.Count > 0) Then _

RegDeleteKey HKLM, sSubKeyName

' Check if the passed in string is related to C2R

' Test the permissions on some key registry locations to determine if

Const KEY_QUERY_VALUE = &H0001

Const KEY_SET_VALUE = &H0002

Const KEY_CREATE_SUB_KEY = &H0004

Dim sSubKeyName

sSubKeyName = "Software\Microsoft\Windows\"

oReg.CheckAccess HKLM, sSubKeyName, KEY_QUERY_VALUE, fReturn

oReg.CheckAccess HKLM, sSubKeyName, KEY_SET_VALUE, fReturn

oReg.CheckAccess HKLM, sSubKeyName, KEY_CREATE_SUB_KEY, fReturn

oReg.CheckAccess HKLM, sSubKeyName, DELETE, fReturn

iParentProcessId = GetObject("winmgmts:root\cimv2").Get("Win32_Process.Handle='" & oWShell.Exec("cscript.exe").ProcessId & "'").ParentProcessId

Err.Clear

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process WHERE Name='cscript.exe' AND CommandLine like '%" & SCRIPTNAME & "%'")

iParentProcessId = Process.ProcessId

' Returns the delimiter for a passed in string

Dim Argument, sCmd

sCmd = Replace(LCase(wscript.Path), "syswow64", "sysnative") & "\cscript.exe " & Chr(34) & WScript.scriptFullName & Chr(34)

If Wscript.Arguments.Count > 0 Then

For Each Argument in Wscript.Arguments

sCmd = sCmd & " " & chr(34) & Argument & chr(34)

Wscript.Quit CLng(oWShell.Run(sCmd, 1, True))

Dim sCmdLine, sRetValFile, sValue

Set oShell = CreateObject("Shell.Application")

sCmdLine = Chr(34) & WScript.ScriptFullName & Chr(34)

sCmdLine = sCmdLine & " " & chr(34) & Argument & chr(34)

' oWShell.Popup "System reboot complete. OffScrub will now prompt for elevation!", 10, SCRIPTNAME & " - NOTE!"

oShell.ShellExecute "cscript.exe", sCmdLine & " /NoElevate UAC", "", "runas", 1

WScript.Sleep 500

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process WHERE ParentProcessId='" & iParentProcessId & "'")

If Processes.Count > 0 Then

iSpawnedProcessId = Process.ProcessId

While oWmiLocal.ExecQuery("Select * From Win32_Process WHERE ProcessId='" & iSpawnedProcessId & "'").Count > 0

WScript.Sleep 3000

Wscript.Quit GetRetValFromFile

Dim sCmdLine

sCmdLine = "cmd.exe /c " & WScript.Path & "\cscript.exe //NOLOGO " & Chr(34) & WScript.scriptFullName & Chr(34)

sCmdLine = sCmdLine & " " & chr(34) & Argument & chr(34)

Wscript.Quit CLng(oWShell.Run(sCmdLine, 1, True))

'don't fail script execution if writing the return value to file fails

Set RetValFileStream = oFso.createTextFile(sScrubDir & "\" & RETVALFILE, True, True)

RetValFileStream.Write iError

RetValFileStream.Close

On Error Resume Next 'don't fail script execution when getting the return value from file fails

If oFso.FileExists(sScrubDir & "\" & RETVALFILE) Then

Set RetValFileStream = oFso.OpenTextFile(sScrubDir & "\" & RETVALFILE, 1, False, -2)

GetRetValFromFile = RetValFileStream.ReadAll

RetValFileStream.Close

Set DateTime = CreateObject("WbemScripting.SWbemDateTime")

DateTime.SetVarDate Now, True

sLogName = sLogDir & "\" & oWShell.ExpandEnvironmentStrings("%COMPUTERNAME%")

sLogName = sLogName & "_" & Left(DateTime.Value, 14)

sLogName = sLogName & "_ScrubLog.txt"

Set LogStream = oFso.CreateTextFile(sLogName, True, True)

sLogName = sLogDir & "\" & oWShell.ExpandEnvironmentStrings("%COMPUTERNAME%")

sLogName = sLogName & "_" & Left(DateTime.Value, 14)

sLogName = sLogName & "_ScrubLog.txt"

Set LogStream = oFso.CreateTextFile(sLogName, True, True)

Log "Microsoft Customer Support Services - " & ONAME & " Removal Utility" & vbCrLf &_

fLogInitialized = True

Function HiveString(hDefKey)

Select Case hDefKey

Case HKCR : HiveString = "HKEY_CLASSES_ROOT"

Case HKCU : HiveString = "HKEY_CURRENT_USER"

Case HKLM : HiveString = "HKEY_LOCAL_MACHINE"

Case HKU : HiveString = "HKEY_USERS"

Case Else : HiveString = hDefKey

' RegKeyExists

' Returns a boolean for the test on existence of a given registry key

Function RegKeyExists(hDefKey, sSubKeyName)

RegKeyExists = False

If oReg.EnumKey(hDefKey, sSubKeyName, arrKeys) = 0 Then RegKeyExists = True

Function RegValExists(hDefKey,sSubKeyName,sName)

If Not RegKeyExists(hDefKey,sSubKeyName) Then Exit Function

If oReg.EnumValues(hDefKey,sSubKeyName,arrValueNames,arrValueTypes) = 0 AND IsArray(arrValueNames) Then

End If 'oReg.EnumValues

' The correct type has to be passed in as argument

Function RegReadValue(hDefKey, sSubKeyName, sName, sValue, sType)

RetVal = oReg.GetStringValue(hDefKey, sSubKeyName, sName, sValue)

If Not RetVal = 0 AND f64 Then RetVal = oReg.GetStringValue(hDefKey, Wow64Key(hDefKey, sSubKeyName), sName, sValue)

RetVal = oReg.GetExpandedStringValue(hDefKey, sSubKeyName, sName, sValue)

If NOT RetVal = 0 AND f64 Then RetVal = oReg.GetExpandedStringValue(hDefKey, Wow64Key(hDefKey, sSubKeyName), sName, sValue)

RetVal = oReg.GetBinaryValue(hDefKey, sSubKeyName, sName, sValue)

If NOT RetVal = 0 AND f64 Then RetVal = oReg.GetBinaryValue(hDefKey, Wow64Key(hDefKey, sSubKeyName), sName, sValue)

RetVal = oReg.GetDWORDValue(hDefKey, sSubKeyName, sName, sValue)

If NOT RetVal = 0 AND f64 Then RetVal = oReg.GetDWORDValue(hDefKey, Wow64Key(hDefKey, sSubKeyName), sName, sValue)

RetVal = oReg.GetMultiStringValue(hDefKey, sSubKeyName, sName, arrValues)

If NOT RetVal = 0 AND f64 Then RetVal = oReg.GetMultiStringValue(hDefKey, Wow64Key(hDefKey, sSubKeyName), sName, arrValues)

If RetVal = 0 Then sValue = Join(arrValues, chr(13))

' Enumerate a registry key to return all values

Function RegEnumValues(hDefKey, sSubKeyName, arrNames, arrTypes)

RetVal = oReg.EnumValues(hDefKey, sSubKeyName, arrNames32, arrTypes32)

RetVal64 = oReg.EnumValues(hDefKey, Wow64Key(hDefKey, sSubKeyName), arrNames64, arrTypes64)

arrNames = RemoveDuplicates(Split((Join(arrNames32, "\") & "\" & Join(arrNames64, "\")), "\"))

arrTypes = RemoveDuplicates(Split((Join(arrTypes32, "\") & "\" & Join(arrTypes64, "\")), "\"))

RetVal = oReg.EnumValues(hDefKey, sSubKeyName, arrNames, arrTypes)

' RegEnumKey

' Enumerate a registry key to return all subkeys

Function RegEnumKey(hDefKey, sSubKeyName, arrKeys)

Dim arrKeys32, arrKeys64

RetVal = oReg.EnumKey(hDefKey, sSubKeyName, arrKeys32)

RetVal64 = oReg.EnumKey(hDefKey, Wow64Key(hDefKey, sSubKeyName), arrKeys64)

If (RetVal = 0) AND (NOT RetVal64 = 0) AND IsArray(arrKeys32) Then arrKeys = arrKeys32

If (Not RetVal = 0) AND (RetVal64 = 0) AND IsArray(arrKeys64) Then arrKeys = arrKeys64

If IsArray(arrKeys32) AND IsArray (arrKeys64) Then

arrKeys = RemoveDuplicates(Split((Join(arrKeys32, "\") & "\" & Join(arrKeys64, "\")), "\"))

ElseIf IsArray(arrKeys64) Then

arrKeys = arrKeys64

arrKeys = arrKeys32

RetVal = oReg.EnumKey(hDefKey, sSubKeyName, arrKeys)

RegEnumKey = ((RetVal = 0) OR (RetVal64 = 0)) AND IsArray(arrKeys)

End Function 'RegEnumKey

' Wrapper around oReg.DeleteValue to handle 64 bit

Sub RegDeleteValue(hDefKey, sSubKeyName, sName, fRegMultiSZ)

Dim sDelKeyName, sValue

sSubKeyName = sSubKeyName & "\"

While InStr(sSubKeyName, "\\") > 0

sSubKeyName = Replace(sSubKeyName, "\\", "\")

fKeep = KeepReg.Exists(LCase(sSubKeyName & sName))

If (NOT fKeep AND f64) Then fKeep = KeepReg.Exists(LCase(Wow64Key(hDefKey, sSubKeyName) & sName))

LogOnly "Disallowing the delete of still required keypath element: " & HiveString(hDefKey) & "\" & sSubKeyName & sName

LogOnly "Enforced delete of still required keypath element: " & HiveString(hDefKey) & "\" & sSubKeyName & sName

If RegValExists(hDefKey, sSubKeyName, sName) Then

sDelKeyName = sSubKeyName

ElseIf RegValExists(hDefKey, Wow64Key(hDefKey, sSubKeyName), sName) Then

sDelKeyName = Wow64Key(hDefKey, sSubKeyName)

LogOnly "Value not found. Cannot delete value: " & HiveString(hDefKey) & "\" & sSubKeyName & sName

If RegReadValue(hDefKey, sDelKeyName, sName, sValue, "REG_MULTI_SZ") AND NOT fRegMultiSZ Then

LogOnly "Disallowing unsafe delete of REG_MULTI_SZ: " & HiveString(hDefKey) & "\" & sDelKeyName & sName

' execute delete operation

LogOnly "Delete registry value: " & HiveString(hDefKey) & "\" & sDelKeyName & " -> " & sName

iRetVal = oReg.DeleteValue(hDefKey, sDelKeyName, sName)

LogOnly "Preview mode. Disallowing delete registry value: " & HiveString(hDefKey) & "\" & sDelKeyName & " -> " & sName

' RegDeleteKey

' Wrappper around RegDeleteKeyEx to handle 64bit

Sub RegDeleteKey(hDefKey, sSubKeyName)

Dim sDelKeyName

fKeep = KeepReg.Exists(LCase(sSubKeyName))

If (NOT fKeep AND f64) Then fKeep = KeepReg.Exists(LCase(Wow64Key(hDefKey, sSubKeyName)))

LogOnly "Disallowing the delete of still required keypath element: " & HiveString(hDefKey) & "\" & sSubKeyName

LogOnly "Enforced delete of still required keypath element: " & HiveString(hDefKey) & "\" & sSubKeyName

If Len(sSubKeyName) > 1 Then

sSubKeyName = Left(sSubKeyName, Len(sSubKeyName) - 1)

' ensure key exists

If RegKeyExists(hDefKey, sSubKeyName) Then

ElseIf f64 AND RegKeyExists(hDefKey, Wow64Key(hDefKey, sSubKeyName)) Then

sDelKeyName = Wow64Key(hDefKey, sSubKeyName)

LogOnly "Key not found. Cannot delete key: " & HiveString(hDefKey) & "\" & sSubKeyName

' execute delete

LogOnly "Delete registry key: " & HiveString(hDefKey) & "\" & sDelKeyName

RegDeleteKeyEx hDefKey, sDelKeyName

LogOnly "Preview mode. Disallowing delete of registry key: " & HiveString(hDefKey) & "\" & sSubKeyName

End Sub 'RegDeleteKey

' RegDeleteKeyEx

Sub RegDeleteKeyEx(hDefKey, sSubKeyName)

Dim arrSubkeys

Dim sSubkey

If Right(sSubKeyName, 1) = "\" Then sSubKeyName = Left(sSubKeyName, Len(sSubKeyName) - 1)

If (hDefKey = HKLM) AND (sSubKeyName = "SOFTWARE\Microsoft\Office\15.0\ClickToRun") Then

iRetVal = oWShell.Run("reg delete HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /f", 0, True)

oReg.EnumKey hDefKey, sSubKeyName, arrSubkeys

If IsArray(arrSubkeys) Then

For Each sSubkey In arrSubkeys

RegDeleteKeyEx hDefKey, sSubKeyName & "\" & sSubkey

iRetVal = oReg.DeleteKey(hDefKey, sSubKeyName)

End Sub 'RegDeleteKeyEx

' Wow64Key

' Return the 32bit regkey location on a 64bit environment

Function Wow64Key(hDefKey, sSubKeyName)

If Left(sSubKeyName, 17) = "Software\Classes\" Then

Wow64Key = Left(sSubKeyName, 17) & "Wow6432Node\" & Right(sSubKeyName, Len(sSubKeyName) - 17)

iPos = InStr(sSubKeyName, "\")

Wow64Key = Left(sSubKeyName, iPos) & "Wow6432Node\" & Right(sSubKeyName, Len(sSubKeyName) - iPos)

Wow64Key = "Wow6432Node\" & sSubKeyName

End Select 'hDefKey

End Function 'Wow64Key

Set dicNoDupes = CreateObject("Scripting.Dictionary")

If Not dicNoDupes.Exists(Item) Then dicNoDupes.Add Item,Item

RemoveDuplicates = dicNoDupes.Keys

LogOnly " Error: " & sModule & " - Source: " & Err.Source & "; Err# (Hex): " & Hex( Err ) & _

"; Err# (Dec): " & Err & "; Description : " & Err.Description

LogStream.WriteLine ""

If NOT fQuiet AND fCScript Then wscript.echo ""

If NOT fQuiet AND fCScript Then wscript.echo sLog

LogStream.WriteLine sLog

' Write w/o indent Cmd window and the log file

' Echos the log string to the Cmd window and the log file

LogStream.WriteLine " " & Time & ": " & sLog

Err.Clear

If sProd = "{6C1ADE97-24E1-4AE4-AEDD-86D3A209CE60}" Then fInScope = True

If sProd = "{9520DDEB-237A-41DB-AA20-F2EF2360DCEB}" Then fInScope = True

If KeepSku.Exists(UCase(sProductCode)) Then Exit Function

Dim sQuery, sStates, sProcessName, sCmd

Set Services = oWmiLocal.Execquery(sQuery)

Log " Found service " & sName & " (" & srvc.DisplayName & ") in state " & srvc.State

sProcessName = Trim(Replace(Mid(srvc.PathName, InStrRev(srvc.PathName,"\")   1), chr(34), ""))

If InStr(sStates, UCase(srvc.State)) > 0 Then

iRet = srvc.StopService()

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name='" & sProcessName & "'")

iRet = process.Terminate()

iRet = srvc.Delete()

sCmd = "sc delete " & sName

iRet = oWShell.Run(sCmd, 0, True)

'msiexec return values

Case 1623 : SetupRetVal = "INSTALL_LANGUAGE_UNSUPPORTED"

Case 1630 : SetupRetVal = "UNSUPPORTED_TYPE"

Case 1633 : SetupRetVal = "INSTALL_PLATFORM_UNSUPPORTED"

Case 1637 : SetupRetVal = "PATCH_PACKAGE_UNSUPPORTED"

Case 1646 : SetupRetVal = "PATCH_REMOVAL_UNSUPPORTED"

fKeep = KeepFolder.Exists(LCase(sFile))

If (NOT fKeep AND f64) Then fKeep = KeepFolder.Exists(LCase(Wow64Folder(sFile)))

LogOnly "Disallowing the delete of still required keypath element: " & sFile

LogOnly "Enforced delete of still required keypath element: " & sFile

If oFso.FileExists(sFile) Then

ElseIf f64 AND oFso.FileExists(Wow64Folder(sFile)) Then

Set File = oFso.GetFile(sDelFile)

attr = File.Attributes

If CBool(attr AND 1) Then File.Attributes = attr AND (attr - 1)

If NOT dicDelFolder.Exists(File.ParentFolder.Path) Then dicDelFolder.Add File.ParentFolder.Path, File.ParentFolder.Path

sFile = File.Path

File.Delete True

Dim sDelFolder, sFolderName, sNewPath, sCmd

fKeep = KeepFolder.Exists(LCase(sFolder))

If (NOT fKeep AND f64) Then fKeep = KeepFolder.Exists(LCase(Wow64Folder(sFolder)))

LogOnly "Disallowing the delete of still required keypath element: " & sFolder

LogOnly "Enforced delete of still required keypath element: " & sFolder

If oFso.FolderExists(sFolder) Then

ElseIf f64 AND oFso.FolderExists(Wow64Folder(sFolder)) Then

Set Folder = oFso.GetFolder(sDelFolder)

attr = Folder.Attributes

If CBool(attr AND 1) Then Folder.Attributes = attr AND (attr - 1)

If NOT dicDelFolder.Exists(Folder.Path) Then dicDelFolder.Add Folder.Path, Folder.Path

sCmd = "cmd.exe /c rd /s " & chr(34) & sDelFolder & chr(34) & " /q"

oWShell.Run sCmd, 0, True

If NOT oFso.FolderExists(sDelFolder) Then Exit Sub

Folder.Delete True

sCmd = "cmd.exe /c rd /s " & chr(34) & sDelFolder & chr(34) & " /q"

oWShell.Run sCmd, 0, True

If NOT oFso.FolderExists(sDelFolder) Then Exit Sub

sCmd = "cmd.exe /c rd /s " & chr(34) & sDelFolder & chr(34) & " /q"

oWShell.Run sCmd, 0, True

If NOT oFso.FolderExists(sDelFolder) Then Exit Sub

Set Folder = oFso.GetFolder(sDelFolder)

For Each fld in Folder.Subfolders

sCmd = "cmd.exe /c rd /s " & chr(34) & fld.Path & chr(34) & " /q"

sCmd = "cmd.exe /c del " & chr(34) & fld.Path & "\*.*" & chr(34)

oWShell.Run sCmd, 0, True

Set Folders = oWmiLocal.ExecQuery ("Select * from Win32_Directory where name = '" & sWqlFolder & "'")

iRet = Folder.Delete

' Returns the WOW folder structure to handle folder-path operations on

If NOT dicDelInUse.Exists(sFile) Then dicDelInUse.Add sFile, sFile Else Exit Sub

attr = oFolder.Attributes

For Each fld In oFolder.SubFolders

DeleteFolder fld.Path

For Each file In oFolder.Files

DeleteFile file.Path

If NOT dicDelInUse.Exists(oFolder.Path) Then dicDelInUse.Add oFolder.Path, "" Else Exit Sub

LogOnly "Adding folder for delete on reboot: " & oFolder.Path

' affected files/folders to the PendingFileRenameOperations registry entry

Dim key, hDefKey, sKeyName, sValueName

sKeyName = "SYSTEM\CurrentControlSet\Control\Session Manager"

sValueName = "PendingFileRenameOperations"

LogH2 "Adding " & dicDelInUse.Count & " PendingFileRenameOperations"

If NOT RegValExists(hDefKey, sKeyName, sValueName) Then

oReg.GetMultiStringValue hDefKey, sKeyName, sValueName, arrData

ReDim Preserve arrData(UBound(arrData)   (dicDelInUse.Count * 2))

For Each key in dicDelInUse.Keys

LogOnly " " & key

arrData(i) = "\??\" & key

Next 'key

oReg.SetMultiStringValue hDefKey, sKeyName, sValueName, arrData

If oFso.FolderExists(sFolder) Then

Set Folder = oFso.GetFolder(sFolder)

If (Folder.Subfolders.Count = 0) AND (Folder.Files.Count = 0) Then

For Each sFolder in dicDelFolder.Keys

If oFso.FolderExists(sFolder) Then

Set Folder = oFso.GetFolder(sFolder)

If (Folder.Subfolders.Count = 0) AND (Folder.Files.Count = 0) Then

ElseIf f64 AND oFso.FolderExists(Wow64Folder(sFolder)) Then

' Executes the folder delete operation(s)

Set Folder = oFso.GetFolder(oFso.GetParentFolderName(sFolder))

If (Folder.Subfolders.Count = 0) AND (Folder.Files.Count = 0) Then SmartDeleteFolderEx(Folder.Path)

' Ensure Windows Explorer is restarted if needed

wscript.sleep 1000

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name='explorer.exe'")

If Processes.Count < 1 Then

oWShell.Run "explorer.exe"

oWShell.Run "SCHTASKS /Create /TN OffScrEx /TR explorer /SC ONCE /ST 12:00 /IT", 0, True

oWShell.Run "SCHTASKS /Run /TN OffScrEx", 0, True

oWShell.Run "SCHTASKS /Delete /TN OffScrEx /F", 0, False

' MyJoin

' Replacement function to the internal Join function to prevent failures

Function MyJoin(arrToJoin, sSeparator)

Dim sJoined

sJoined = ""

If IsArray(arrToJoin) Then

For i = 0 To UBound(arrToJoin)

sJoined = sJoined & arrToJoin(i) & sSeparator

If Len(sJoined) > 1 Then sJoined = Left(sJoined, Len(sJoined) - 1)

MyJoin = sJoined

oFso.CopyFile WScript.scriptFullName, sScrubDir & "\" & SCRIPTFILE

oReg.CreateKey HKCU, "SOFTWARE"

oReg.CreateKey HKCU, "SOFTWARE\Microsoft"

oReg.CreateKey HKCU, "SOFTWARE\Microsoft\Office"

oReg.CreateKey HKCU, "SOFTWARE\Microsoft\Office\15.0"

oReg.CreateKey HKCU, "SOFTWARE\Microsoft\Office\15.0\CleanC2R"

oReg.SetDWordValue HKCU, "SOFTWARE\Microsoft\Office\15.0\CleanC2R", "Rerun", 1

' oReg.CreateKey HKCU, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"

' oReg.SetStringValue HKCU, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce", "CleanC2R", "cscript.exe " & chr(34) & sScrubDir & "\" & SCRIPTFILE & chr(34)

oReg.CreateKey HKCU, "SOFTWARE\Microsoft\Windows\CurrentVersion"

oReg.CreateKey HKCU, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"

sValue = "cscript.exe " & chr(34) & sScrubDir & "\" & SCRIPTFILE & chr(34) & " /NoElevate /Relaunched"

oReg.SetStringValue HKCU, "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce", "O15CleanUp", sValue

' Name: OffScrub_O15msi.vbs

Const SCRIPTFILE = "OffScrub_O15msi.vbs"

Const REG_ARP = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\"

Const LYNC_ALL = "{4A2C120F-307B-4400-B239-F29ADB54D3C6}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{5CFD6599-10E5-4CF0-B6E1-BF39D30A64F8}{BF3AC8BA-1A0F-42AD-8B65-4250617AF682}{3475BF22-3564-4EF3-A633-C5F3F4582392}{263BA91B-7782-4EEB-A4FC-7BD554CAF1F3}{AA256AE1-6B6A-48E6-9957-B38F92CA614B}{D79732A1-BB17-4789-AE75-69D61261E305}{C7B887F2-07CA-4903-93A2-9B4E16E4EABD}{81BE0B17-563B-45D4-B198-5721E6C665CD}{11298539-8073-4D54-B6A0-88D4FA512E5C}{C192041D-2861-4E02-9F43-4041858A58F1}{7023C711-0E65-471E-8048-12C455968841}{58A013B1-1613-4978-881A-FCA43710C84A}{7FD6C049-9777-4B51-91FF-B19D79ADF439}{D3001D99-675B-44DF-A8EB-A7BB6F864DB7}{0C5EA724-8649-47FA-B505-75B35390378D}{13DE0C92-2AE4-48D0-8CC8-58D5E327BDCB}{E7EC16E6-C220-41C0-9C91-5E7702B8EC86}{1B10C75C-70E1-460E-B07B-D7DFF365D80F}{331977BC-B246-46B4-8829-1D52F41C8C7B}{D8255EF2-0BB2-4AF1-A662-5EBACD179475}{DD069437-C92B-4C1C-A992-14F6C7E12C2C}{E9E30DB3-8D72-43A0-B1B8-A6F8261D20D6}{545B7E32-E254-40E1-8935-91C61E3D02C2}{70409E9E-AFAE-4C05-AE57-F83B89819434}{1D6E3225-753D-41AD-A2C4-68684700F592}{217AA75D-82C0-4C49-9252-A0E6F9661688}{5AB81CD4-7C78-420C-AAAC-855C4BADBDDD}{AA595672-6515-4961-B81F-485F86627C76}{C9F2C38C-21F0-4687-8C7D-51AA02CE8C98}{DD80DED6-700D-4CC5-B2A9-C64A1AD155B9}{88257193-EC61-4152-8AB1-A5FB4BE638D7}{7D9109C3-58A9-4AFD-A1D3-47E7D811726E}{71C6D199-5B8E-41E7-BA36-D99F66E0072E}{1CFE7869-777D-4563-8161-2C75ED95B621}{FE25DDB2-5766-4A9E-86D2-2B709CC8F65D}{621F7793-1C51-45BA-899F-41557946B0E3}{B31017AA-FBF8-4003-8785-EC789C2AE0C2}{11849FBC-C416-4742-8279-17C3A2C85F72}{4F380D4B-A84D-45C7-AF58-59EA2AEDF35A}{81BE0B17-563B-45D4-B198-5721E6C665CD}"

Dim ComputerItem, Item, LogStream, TmpKey

Dim KeepProd, KeepLis, dicApps, KeepFolder, dicDelRegKey, KeepReg

Dim fPassive : fPassive = True

Dim fLogInitialized : fLogInitialized = False

Dim fBypass_Stage1 : fBypass_Stage1 = True 'Component Detection

Dim fBypass_Stage2 : fBypass_Stage2 = False 'Setup

Dim fBypass_Stage3 : fBypass_Stage3 = False 'Msiexec

Dim fBypass_Stage4 : fBypass_Stage4 = False 'CleanUp

Set oWmiLocal = GetObject("winmgmts:{(Debug)}\\.\root\cimv2")

Set oWShell = CreateObject("Wscript.Shell")

Set oShellApp = CreateObject("Shell.Application")

Set oFso = CreateObject("Scripting.FileSystemObject")

Set oMsi = CreateObject("WindowsInstaller.Installer")

Set oReg = GetObject("winmgmts:\\.\root\default:StdRegProv")

sAppData = oWShell.ExpandEnvironmentStrings("%appdata%")

sLocalAppData = oWShell.ExpandEnvironmentStrings("%localappdata%")

sTemp = oWShell.ExpandEnvironmentStrings("%temp%")

sAllUsersProfile = oWShell.ExpandEnvironmentStrings("%allusersprofile%")

RegReadValue HKLM, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList", "ProfilesDirectory", sProfilesDirectory, "REG_EXPAND_SZ"

If NOT oFso.FolderExists(sProfilesDirectory) Then

sProfilesDirectory = oFso.GetParentFolderName(oWShell.ExpandEnvironmentStrings("%userprofile%"))

sProgramFiles = oWShell.ExpandEnvironmentStrings("%programfiles%")

'sProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%programfiles(x86)%")

sCommonProgramFiles = oWShell.ExpandEnvironmentStrings("%commonprogramfiles%")

'sCommonProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%CommonProgramFiles(x86)%")

sProgramData = oWSHell.ExpandEnvironmentStrings("%programdata%")

sWinDir = oWShell.ExpandEnvironmentStrings("%windir%")

sScriptDir = wscript.ScriptFullName

fCScript = UCase(Mid(Wscript.FullName, Len(Wscript.Path)   2, 1)) = "C"

Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_ComputerSystem")

f64 = Instr(Left(Item.SystemType,3),"64") > 0

If f64 Then sProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%programfiles(x86)%")

If f64 Then sCommonProgramFilesX86 = oWShell.ExpandEnvironmentStrings("%CommonProgramFiles(x86)%")

Set ComputerItem = oWmiLocal.ExecQuery("Select * from Win32_OperatingSystem")

sOSinfo = sOSinfo & Item.Caption

sOSinfo = sOSinfo & Item.OtherTypeDescription

sOSinfo = sOSinfo & ", " & "SP " & Item.ServicePackMajorVersion

sOSinfo = sOSinfo & ", " & "Version: " & Item.Version

sOsVersion = Item.Version

sOSinfo = sOSinfo & ", " & "Codepage: " & Item.CodeSet

sOSinfo = sOSinfo & ", " & "Country Code: " & Item.CountryCode

sOSinfo = sOSinfo & ", " & "Language: " & Item.OSLanguage

If InStr(LCase(wscript.path), "syswow64") > 0 Then RelaunchAs64Host

If UCase(Mid(Wscript.FullName, Len(Wscript.Path)   2, 1)) = "C" Then

If Not fLogInitialized Then CreateLog

TmpKeyCleanUp

wscript.quit 3

Set KeepProd = CreateObject("Scripting.Dictionary")

Set dicInstalledSku = CreateObject("Scripting.Dictionary")

Set dicRemoveSku = CreateObject("Scripting.Dictionary")

Set KeepSku = CreateObject("Scripting.Dictionary")

Set KeepLis = CreateObject("Scripting.Dictionary")

Set KeepFolder = CreateObject("Scripting.Dictionary")

Set dicApps = CreateObject("Scripting.Dictionary")

Set dicDelRegKey = CreateObject("Scripting.Dictionary")

Set KeepReg = CreateObject("Scripting.Dictionary")

Set dicSrv = CreateObject("Scripting.Dictionary")

Set dicCSuite = CreateObject("Scripting.Dictionary")

Set dicCSingle = CreateObject("Scripting.Dictionary")

If Not oFso.FolderExists(sScrubDir) Then oFso.CreateFolder sScrubDir

EnsureValidWIMetadata HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products",COMPRESSED

EnsureValidWIMetadata HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components",COMPRESSED

'Add initial known .exe files that might need to be closed

dicApps.Add "communicator.exe", "communicator.exe"

dicApps.Add "setup.exe", "setup.exe"

dicApps.Add "bcssync.exe","bcssync.exe"

dicApps.Add "officesas.exe","officesas.exe"

dicApps.Add "officesasscheduler.exe","officesasscheduler.exe"

dicApps.Add "msosync.exe","msosync.exe"

dicApps.Add "onenotem.exe","onenotem.exe"

If dicInstalledSku.Count > 0 Then Log "Found registered product(s): " & Join(RemoveDuplicates(dicInstalledSku.Items),",") &vbCrLf

If dicRemoveSku.Count > 0 Then Log "Product(s) to be removed: " & Join(RemoveDuplicates(dicRemoveSku.Items),",")

If NOT dicRemoveSku.Count > 0 Then sMode = "Orphaned " & ONAME & " products"

If fDetectOnly Then Log "* All uninstall and delete operations will only be logged not executed! *"

'Cache .msi files

If dicRemoveSku.Count > 0 Then CacheMsiFiles

If NOT fSkipSD AND dicRemoveSku.Count > 0 Then

If Not fBypass_Stage1 OR fForce Then

If fForce OR fQuiet OR fPassive Then CloseOfficeApps

'Stage # 2 - Setup.exe |

sTmp = "Stage # 2 " & chr(34) & "Setup.exe" & chr(34) & " (" & Time & ")"

If Not fBypass_Stage2 Then

SetupExeRemoval

Log "Skipping Setup.exe because bypass was requested."

'Stage # 3 - Msiexec.exe |

sTmp = "Stage # 3 " & chr(34) & "Msiexec.exe" & chr(34) & " (" & Time & ")"

If Not fBypass_Stage3 Then

MsiexecRemoval

Log "Skipping Msiexec.exe because bypass was requested."

If Not fBypass_Stage4 Then

If fForce OR fQuiet OR fPassive Then RestoreExplorer

'Wipe orphaned files from Windows Installer cache

'Temporary .msi files in scrubcache

Log "Skipping CleanUp because bypass was requested."

Log vbCrLf & "A restart is required to complete the operation!"

If MsgBox("Do you want to reboot now?",vbYesNo,"Reboot Required") = VB_YES Then

Set oWmiReboot = GetObject("winmgmts:{impersonationLevel=impersonate,(Shutdown)}!\\.\root\cimv2")

Set colOS = oWmiReboot.ExecQuery ("Select * from Win32_OperatingSystem")

oOS.Reboot()

For Each Item in Wscript.Arguments

wscript.stdout.write "Press <Enter> to close this window"

sTemp = wscript.stdin.read(1)

'Office configuration products are listed with their configuration product name in the "Uninstall" key

Dim sCurKey, sValue, sConfigName, sProdC, sCVHValue

Dim arrKeys, arrMultiSzValues

If dicInstalledSku.Count > 0 Then Exit Sub 'Already done from InputBox prompt

For Each File in oFso.GetFolder(sWICacheDir).Files

If Len(File.Name)>3 Then

Select Case LCase(Right(File.Name,4))

Case ".msi"

sProductCode = GetMsiProductCode(File.Path)

If NOT RegKeyExists(HKLM,REG_ARP & sProductCode) Then

oFso.CopyFile File.Path,sScrubDir & "\" & sProductCode & ".msi",True

MsiRegisterProduct File.Path

If RegEnumKey(HKLM,REG_ARP,arrKeys) Then

sCurKey = REG_ARP & ArpItem & "\"

fSystemComponent0 = Not (RegReadValue(HKLM,sCurKey,"SystemComponent",sValue,"REG_DWORD") AND (sValue = "1"))

If (fSystemComponent0 AND (NOT RegReadValue(HKLM,sCurKey,"CVH",sCVHValue,"REG_DWORD"))) Then

RegReadValue HKLM,sCurKey,"DisplayVersion",sValue,"REG_SZ"

If NOT RegKeyExists(HKLM,REG_ARP&sConfigName) Then

oReg.CreateKey HKLM,REG_ARP & sConfigName

oReg.SetMultiStringValue HKLM,REG_ARP & sConfigName,OPACKAGE,arrMultiSzValues

oReg.SetStringValue HKLM, REG_ARP & sConfigName, "Comment", "Temporary OffScrub generated key. Please delete this key!"

oReg.SetMultiStringValue HKLM,REG_ARP & sConfigName,"ProductCodes",arrMultiSzValues

oReg.SetStringValue HKLM,REG_ARP & sConfigName,"DisplayVersion",sValue

oReg.SetStringValue HKLM,REG_ARP & sConfigName,"DisplayName",SCRIPTNAME & "_" & sConfigName

oReg.SetDWordValue HKLM,REG_ARP & sConfigName,"SystemComponent",0

oReg.SetMultiStringValue HKLM,REG_ARP & sConfigName,"ProductCodes",Split(sProdC,chr(34))

End If 'RegKeyExists

fSystemComponent0 = NOT (RegReadValue(HKLM,sCurKey,"SystemComponent",sValue,"REG_DWORD") AND (sValue = "1"))

fPackages = RegReadValue(HKLM,sCurKey,OPACKAGE,sValue,"REG_MULTI_SZ")

fDisplayVersion = RegReadValue(HKLM,sCurKey,"DisplayVersion",sValue,"REG_SZ")

If NOT dicInstalledSku.Exists(sConfigName) Then dicInstalledSku.Add sConfigName,sConfigName

If NOT dicSrv.Exists(UCase(sConfigName)) Then dicSrv.Add UCase(sConfigName),sConfigName

If NOT dicCSuite.Exists(UCase(sConfigName)) Then dicCSuite.Add UCase(sConfigName), sConfigName

If NOT KeepProd.Exists(sProductCode) Then KeepProd.Add sProductCode, sConfigName

If NOT dicCSingle.Exists(UCase(sConfigName)) Then dicCSingle.Add UCase(sConfigName),sConfigName

Const OLEGACY = "78E1-11D2-B60F-006097C998E7}.6000-11D3-8CFE-0050048383C9}.6000-11D3-8CFE-0150048383C9}.BDCA-11D1-B7AE-00C04FB92F3D}.6D54-11D4-BEE3-00C04F990354}"

For Each Product in oMsi.Products

Dim Sku, Key, sProductCode, sProductCodeList

For Each Key in dicInstalledSku.Keys

dicRemoveSku.Add Key,dicInstalledSku.Item(Key)

Next 'Key

KeepSku.Add Key,dicInstalledSku.Item(Key)

If KeepSku.Exists(Sku) Then

'A Sku to remove has been passed in

KeepSku.Remove(Sku)

If NOT dicRemoveSku.Exists(Sku) Then dicRemoveSku.Add Sku,Sku

For Each Key in dicInstalledSku.Keys

If dicCSuite.Exists(Key) Then

If KeepSku.Exists(Key) Then KeepSku.Remove(Key)

If NOT dicRemoveSku.Exists(Key) Then dicRemoveSku.Add Key,Key

Next 'Key

If dicCSingle.Exists(Key) Then

If dicSrv.Exists(Key) Then

If NOT KeepSku.Count > 0 Then fRemoveAll = True

For Each Sku in KeepSku.Keys

If NOT KeepProd.Exists(sProductCode) Then

KeepProd.Add sProductCode, Sku

If Not KeepProd.Exists(GetUpgradeCode(sProductCode)) Then KeepProd.Add GetUpgradeCode(sProductCode), Sku & "_UpgradeCode"

Const O11 = "6000-11D3-8CFE-0150048383C9}"

'Cache .msi files for products that will be removed in case they are needed for later file detection

'Errors will be logged but must not fail the execution

Log " Cache .msi files to temporary Scrub folder"

sMsiFile = oMsi.ProductInfo(Product,"LocalPackage") : CheckError "CacheMsiFiles"

LogOnly " - " & Product & ".msi"

If oFso.FileExists(sMsiFile) Then oFso.CopyFile sMsiFile,sScrubDir & "\" & Product & ".msi",True

Dim sQuery, sSubKeyName, sPath, sFile, sMsiFile, sCompClient, sComponent, sCompReg

Dim hDefKey

Set FileList = oFso.OpenTextFile(sScrubDir & "\FileList.txt",FOR_WRITING,True,True)

Set RegList = oFso.OpenTextFile(sScrubDir & "\RegList.txt",FOR_WRITING,True,True)

Set CompVerbose = oFso.OpenTextFile(sScrubDir & "\CompVerbose.txt",FOR_WRITING,True,True)

Set dicFLError = CreateObject("Scripting.Dictionary")

Set oDic = CreateObject("Scripting.Dictionary")

Set oFolderDic = CreateObject("Scripting.Dictionary")

Set dicCompPath = CreateObject("Scripting.Dictionary")

'Prevent that API errors fail script execution

iCompCnt = oMsi.Components.Count

For Each ComponentID In oMsi.Components

CompVerbose.WriteLine vbCrLf & "Checking Component: " & ComponentID

If fCScript Then wscript.stdout.write "." : LogStream.Write "."

dicCompPath.RemoveAll

For Each CompClient In oMsi.ComponentClients(ComponentID)

CompVerbose.Write " CompClient " & CompClient & "-> "

If fRemoveComponent OR (CompClient = "{00000000-0000-0000-0000-000000000000}") Then

sPath = LCase(oMsi.ComponentPath(CompClient,ComponentID))

If CompClient = "{00000000-0000-0000-0000-000000000000}" Then

CompVerbose.Write "CheckDelete: " & fRemoveComponent & "; "

'Since the scope remains within one Office family the keypath for the component

If NOT dicDelRegKey.Exists(sCompReg) Then

dicDelRegKey.Add sCompReg,HKCR

RegList.WriteLine HiveString(HKCR)&"\"&sCompReg

sCompReg = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\"&GetCompressedGuid(ComponentID)&"\"&GetCompressedGuid(CompClient)

dicDelRegKey.Add sCompReg,HKLM

If NOT dicCompPath.Exists(sPath) Then dicCompPath.Add sPath,CompClient

CompVerbose.WriteLine "AffectedComponent: " & fAffectedComponent

CompVerbose.WriteLine " CompClient now set to: " & sCompClient

CompVerbose.Write "InScope: " & fRemoveComponent & "; "

CompVerbose.WriteLine "Error: Invalid metadata"

If NOT dicFLError.Exists("Error: Invalid metadata found. ComponentID: "&ComponentID &", ComponentClient: "&CompClient) Then _

dicFLError.Add "Error: Invalid metadata found. ComponentID: "&ComponentID &", ComponentClient: "&CompClient, ComponentID

CompVerbose.WriteLine "Error: " & Err.number & " " & Err.Description

Err.Clear

fRemoveComponent = fAffectedComponent AND (iRemCnt = oMsi.ComponentClients(ComponentID).Count)

CompVerbose.WriteLine " Component goes away: " & fRemoveComponent

' 'Flag as removable if component has a unique keypath

' sPath = LCase(oMsi.ComponentPath(sCompClient,ComponentID))

' fRemoveComponent = NOT dicCompPath.Exists(sPath)

CompVerbose.WriteLine " msidbComponentAttributesPermanent: " & NOT fRemoveComponent

CompVerbose.WriteLine " RESULT: Component IN SCOPE for removal"

'Add the component registration key to ensure removal

If NOT dicDelRegKey.Exists(sCompReg) Then

dicDelRegKey.Add sCompReg,HKCR

RegList.WriteLine HiveString(HKCR)&"\"&sCompReg

sCompReg = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\"&GetCompressedGuid(ComponentID)&"\"

dicDelRegKey.Add sCompReg,HKLM

sPath = LCase(oMsi.ComponentPath(sCompClient,ComponentID))

CompVerbose.WriteLine " Path: " & sPath

'Registry keypath

hDefKey = HKCR

hDefKey = HKCU

hDefKey = HKLM

'compared to deleting the whole key

If NOT dicDelRegKey.Exists(sPath) Then

dicDelRegKey.Add sPath,hDefKey

RegList.WriteLine HiveString(hDefKey)&"\"&sPath

If oFso.FileExists(sPath) OR oFso.FolderExists(sPath) Then

CompVerbose.WriteLine " Folder check OK"

CompVerbose.WriteLine " File check OK"

If fIsFile Then sPath = oFso.GetFile(sPath).ParentFolder

If Not oFolderDic.Exists(sPath) Then

oFolderDic.Add sPath,sPath

FileList.WriteLine sPath & vbTab & "(FOLDER)"

'Get the .msi file

If oFso.FileExists(sScrubDir & "\" & sCompClient & ".msi") Then

sMsiFile = sScrubDir & "\" & sCompClient & ".msi"

sMsiFile = oMsi.ProductInfo(sCompClient,"LocalPackage")

CompVerbose.WriteLine " Set msi file to : " & sMsiFile

CompVerbose.WriteLine " Error: Failed to obtain .msi file for product " & sCompClient

If NOT dicFLError.Exists("Failed to obtain .msi file for product "&sCompClient) Then _

dicFLError.Add "Failed to obtain .msi file for product "&sCompClient, ComponentID

Err.Clear

CompVerbose.Write " Open .msi file for reading returned: "

Set MsiDb = oMsi.OpenDatabase(sMsiFile,MSIOPENDATABASEREADONLY)

CompVerbose.WriteLine " SUCCESS"

Set qView = MsiDb.OpenView(sQuery) : qView.Execute

Set Record = qView.Fetch()

If Not Record Is Nothing Then sComponent = Record.Stringdata(1)

CompVerbose.WriteLine " Obtained ComponentId as: " & sComponent

sFile = Record.StringData(2)

CompVerbose.WriteLine " File: " & sPath& "\" & sFile

If Not oDic.Exists(sPath & "\" & sFile) Then

Case "FPERSON.DLL"

'Catch exception caused by changed .msi keypath authoring logic for smart tags

For Each prod in oMsi.Products

If oMsi.FeatureState(prod, "MSTagPluginNamesFiles") = MSIINSTALLSTATE_LOCAL Then

CompVerbose.WriteLine " Added as new file to dictionary"

oDic.Add sPath & "\" & sFile,sFile

FileList.WriteLine sFile & vbTab & sPath & "\" & sFile

If Right(sFile,4) = ".exe" Then

If NOT dicApps.Exists(sFile) Then

Case "setup.exe","ose.exe","osppsvc.exe","explorer.exe"

dicApps.Add sFile,LCase(sPath) & "\" & sFile

CompVerbose.WriteLine " Added to the list of processes that need to be closed."

End If 'dicApps.Exists

End If '.exe

End If 'oDic.Exists

Set Record = qView.Fetch()

qView.Close

CompVerbose.WriteLine " Error: Could not read from .msi file"

If NOT dicFLError.Exists("Error: Could not read from .msi file: "&sMsiFile) Then _

dicFLError.Add "Error: Could not read from .msi file: "&sMsiFile, ComponentID

CompVerbose.WriteLine " Error: File check FAILED"

CompVerbose.WriteLine " RESULT: Component NOT in scope for removal"

For Each CompClient In oMsi.ComponentClients(ComponentID)

sPath = "" : sPath = LCase(oMsi.ComponentPath(CompClient,ComponentID))

'Registry keypath

hDefKey = HKCR

hDefKey = HKCU

hDefKey = HKLM

If NOT KeepReg.Exists(LCase(sPath)) Then

KeepReg.Add LCase(sPath),hDefKey

'File keypath

If oFso.FileExists(sPath) Then

If NOT KeepFolder.Exists(LCase(sPath)) Then KeepFolder.Add LCase(sPath)

sPath = LCase(oFso.GetFile(sPath).ParentFolder) & "\"

If NOT KeepFolder.Exists(sPath) Then AddKeepFolder sPath

'Folder keypath

If oFso.FolderExists(sPath) Then AddKeepFolder sPath

If dicFLError.Count > 0 Then LogOnly Join(dicFLError.Keys,vbCrLf)

If Not oFolderDic.Count = 0 Then arrDeleteFolders = oFolderDic.Keys Else Set arrDeleteFolders = Nothing

If Not oDic.Count = 0 Then arrDeleteFiles = oDic.Keys Else Set arrDeleteFiles = Nothing

'Try to remove the products by calling setup.exe

Sub SetupExeRemoval

Dim Sku, sConfigFile, sUninstallCmd, sCatalyst, sDll, sDisplayLevel, sNoCancel

If Not dicRemoveSku.Count > 0 Then

Log " Nothing to remove for Setup.exe"

If OseService.Count = 0 Then Exit Sub

If (Service.StartMode = "Disabled") AND (Not Service.ChangeStartMode("Manual")=0) Then Exit Sub

If (Not Service.StartName = "LocalSystem") AND (Service.Change( , , , , , , "LocalSystem", "")) Then Exit Sub

For Each Sku in dicRemoveSku.Keys

'Create an "unattended" config.xml file for uninstall

Set TextStream = oFso.OpenTextFile(sScrubDir & "\config.xml",FOR_WRITING,True,True)

TextStream.Writeline "<Configuration Product=""" & Sku & """>"

TextStream.Writeline "<Display Level=""" & sDisplayLevel & """ CompletionNotice=""No"" SuppressModal=""Yes"" NoCancel=""" & sNoCancel & """ AcceptEula=""Yes"" />"

TextStream.Writeline "<Logging Type=""Verbose"" Path=""" & sLogDir & """ Template=""Microsoft Office " & Sku & " Setup(*).txt"" />"

TextStream.Writeline "<Setting Id=""MSIRESTARTMANAGERCONTROL"" Value=""Disable"" />"

TextStream.Writeline "<Setting Id=""SETUP_REBOOT"" Value=""Never"" />"

TextStream.Writeline "</Configuration>"

TextStream.Close

'Ensure path to setup.exe is valid to prevent errors

If NOT oFso.FileExists(sCatalyst) Then

sCatalyst = sCommonProgramFiles & "\" & OREF & "\Office Setup Controller\setup.exe"

If NOT oFso.FileExists(sCatalyst) AND f64 Then

sCatalyst = sCommonProgramFilesX86 & "" & OREF & "\Office Setup Controller\setup.exe"

If oFso.FileExists(sCatalyst) Then

sUninstallCmd = Chr(34) & sCatalyst & Chr(34) & " /uninstall " & Sku & " /config " & Chr(34) & sScrubDir & "\config.xml" & Chr(34) & sDll

Log " - Calling Setup.exe to remove " & Sku '& vbCrLf & sUninstallCmd

RetVal = oWShell.Run(sUninstallCmd,0,True) : CheckError "SetupExeRemoval"

Log " - Setup.exe returned: " & SetupRetVal(Retval) & " (" & RetVal & ")" & vbCrLf

Log " Error: Office setup.exe appears to be missing"

End If 'RetVal = 0) AND oFso.FileExists

End Sub 'SetupExeRemoval

'Invoke msiexec to remove individual .MSI packages

Sub MsiexecRemoval

Dim sCmd, sReturn, sMsiProp

'Office System does only support per machine installation so it's sufficient to use Installer.Products

Log " Calling msiexec.exe to remove " & Product

sCmd = "msiexec.exe /x" & Product & sMsiProp

sCmd = sCmd & " /q"

sCmd = sCmd & " /qb-"

sCmd = sCmd & " /l*v  "&chr(34)&sLogDir&"\Uninstall_"&Product&".log"&chr(34)

'Execute the uninstall

LogOnly " - Calling msiexec with '"&sCmd&"'"

sReturn = oWShell.Run(sCmd, 0, True)

Log " - msiexec returned: " & SetupRetVal(sReturn) & " (" & sReturn & ")" & vbCrLf

LogOnly " -> Command: "&sCmd

If i = 0 Then Log " Nothing to remove for msiexec"

End Sub 'MsiexecRemoval

RegDeleteKey HKLM,"SYSTEM\CurrentControlSet\Services\ose\"

'File cleanup operations for the Local Installation Source (MSOCache)

Set LogicalDisks = oWmiLocal.ExecQuery("Select * From Win32_LogicalDisk WHERE DriveType=3")

If oFso.FolderExists(Disk.DeviceID & "\" & LISROOT) Then

Set Folder = oFso.GetFolder(Disk.DeviceID & "\" & LISROOT)

For Each Subfolder in Folder.Subfolders

If (Mid(Subfolder.Name,27,PRODLEN) = OFFICEID AND Mid(SubFolder.Name,4,2)=OVERSIONMAJOR) OR _

LCase(Right(Subfolder.Name,7)) = OVERSIONMAJOR &".data" Then DeleteFolder Subfolder.Path

If (Mid(Subfolder.Name,27,PRODLEN) = OFFICEID AND Mid(SubFolder.Name,4,2)=OVERSIONMAJOR) AND _

CheckDelete(UCase(Left(Subfolder.Name,38))) AND _

UCase(Right(Subfolder,1))= UCase(Left(Disk.DeviceID,1))Then DeleteFolder Subfolder.Path

sFolder = Folder.Path

End If 'oFso.FolderExists

Set Folder = oFso.GetFolder(SubFolder)

If oFso.FolderExists(MseFolder) Then

Set Folder = oFso.GetFolder(MseFolder)

Set Files = Folder.Files

If (LCase(Right(File.Name,4))=".msi") Then

If CheckDelete(ProductCode(File.Path)) Then

End If 'oFso.FolderExists(MseFolder)

End If 'oFso.FolderExists

If fForce OR fQuiet OR fPassive Then CloseOfficeApps

CopyAndDeleteFile sAppdata & "\Microsoft\Templates\Normal.dotm"

CopyAndDeleteFile sAppdata & "\Microsoft\Templates\Normalemail.dotm"

If oFso.FolderExists(sFolder) Then

For Each Subfolder In Folder.Subfolders

If oFso.FileExists(Subfolder & "\blocks.dotx") Then CopyAndDeleteFile Subfolder & "\blocks.dotx"

End If 'oFso.FolderExists(sFolder)

DeleteFile sAllUsersProfile & "\Application Data\Microsoft\Office\Data\opa"&OVERSIONMAJOR&".dat"

DeleteFile sAllUsersProfile & "\Application Data\Microsoft\Office\Data\opa"&OVERSIONMAJOR&".bak"

DeleteFile sAllUsersProfile & "\Microsoft\Office\Data\opa"&OVERSIONMAJOR&".dat"

DeleteFile sAllUsersProfile & "\Microsoft\Office\Data\opa"&OVERSIONMAJOR&".bak"

DeleteFile oWShell.SpecialFolders("AllUsersStartup")&"\OfficeSAS.lnk"

DeleteFile oWShell.SpecialFolders("Startup")&"\OneNote 2010 Screen Clipper and Launcher.lnk"

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name like 'ose%.exe'")

LogOnly " - Running process : " & Process.Name

Log " -> Ending process: " & Process.Name

iRet = Process.Terminate()

If oFso.FileExists(sFile) Then DeleteFile sFile

Set Folder = oFso.GetFolder(sPath)

Set Files = Folder.Files

If Len(File.Name)>3 Then

If (LCase(Right(File.Name,4))=".xml") Then

If Len(File.Name) >= Len(sConfigName) Then

If (UCase(Left(File.Name,Len(sConfigName)))=sConfigName) Then

Set XmlFile = oFso.OpenTextFile(File,1)

sContents = XmlFile.ReadAll

If CheckDelete(sProductCode) Then DeleteFile File.Path Else fKeepFolder = True

End If '.xml

End If 'Len(File.Name)>3

If NOT fBypass_Stage1 Then

For Each item in dicApps.Items

If LCase(sc.TargetPath) = item Then

LogOnly " - removing shortcut per match from component detection: " & file.Path

If InStr (sc.TargetPath, OREF) > 0 Then

LogOnly " - removing Office shortcut with non-existent target: " & file.Path & " - " & sc.TargetPath

If fBypass_Stage1 Then UnPin file

If oFso.FolderExists(sScrubDir & "\ScrubTmp") Then oFso.DeleteFolder sScrubDir & "\ScrubTmp",True

'Ensure there are no unexpected .msi files in the scrub folder

Set Folder = oFso.GetFolder(sScrubDir) : CheckError "DeleteMsiScrubCache"

Set Files = Folder.Files

If LCase(Right(File.Name,4))=".msi" Then

DeleteFile File.Path : CheckError "DeleteMsiScrubCache"

Set Folder = oFso.GetFolder(sWinDir & "\Installer")

Log vbCrLf & "Windows Installer cache CleanUp"

Set AllPatches = oMsi.PatchesEx("",USERSIDEVERYONE,MSIINSTALLCONTEXT_ALL,MSIPATCHSTATE_ALL)

'Fill a comma separated stringlist with all .msp patchfiles

sLocalMsp = "" : sLocalMsp = LCase(Patch.Patchproperty("LocalPackage")) : CheckError "MsiClearOrphanedFiles (msp)"

'Delete all non referenced .msp files from %windir%\installer

sFName = "" : sFName = LCase(File.Path)

If LCase(Right(sFName,4)) = ".msp" Then

If InStr(UCase(MspTargets(File.Path)),OFFICEID)>0 Then DeleteFile File.Path

Set AllProducts = oMsi.ProductsEx("",USERSIDEVERYONE,MSIINSTALLCONTEXT_ALL)

'Fill a comma separated stringlist with all .msi files

sLocalMsi = "" : sLocalMsi = LCase(Product.InstallProperty("LocalPackage")) : CheckError "MsiClearOrphanedFiles (msi)"

'Delete all non referenced .msi files from %windir%\installer

If LCase(Right(sFName,4)) = ".msi" Then

If UCase(Right(ProductCode(File.Path),PRODLEN))=OFFICEID Then DeleteFile File.Path

End If 'LCase(Right(sFName,4)) = ".msi"

Dim Item, Name, Sku, key

Dim hDefKey, sSubKeyName, sCurKey, value, sValue, sGuid

Dim arrKeys, arrNames, arrTypes, arrMultiSzValues, arrMultiSzNewValues

RegDeleteKey HKCU,"Software\Policies\Microsoft\Office\" & OVERSION & "\"

RegDeleteKey HKCU,"Software\Microsoft\Office\" & OVERSION & "\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\" & OVERSION & "\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office Test\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Excel\Addins\Microsoft.PerformancePoint.Planning.Client.Excel\"

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\InfoPath\Converters\Import\InfoPath.DesignerExcelImport\Versions\",OVERSION, False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\InfoPath\Converters\Import\InfoPath.DesignerWordImport\Versions\",OVERSION, False

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Outlook\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\MEWord12\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\Word12\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Export\Word97\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\MEWord12\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word12\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Shared Tools\Text Converters\Import\Word97\"

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\","GrooveMonitor", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\","LobiServer", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\","BCSSync", False

RegDeleteKey HKLM,"SYSTEM\CurrentControlSet\Services\Outlook\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office\" & OVERSION & "\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\"

If RegReadValue(HKCR,"CLSID\{CC2C83A6-9BE4-11D0-98E7-00C04FC2CAF5}\InprocServer32","SystemDB",sValue,"REG_SZ") Then

If LCase(Left(sValue,Len(sOInstallRoot))) = LCase(sOInstallRoot) Then RegDeleteKey HKCR,"CLSID\{CC2C83A6-9BE4-11D0-98E7-00C04FC2CAF5}\InprocServer32\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform_Test\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Office\Common\ActiveX Compatibility\{00024512-0000-0000-C000-000000000046}\"

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Office\OneNote\Adapters\","{456B0D0E-49DD-4C95-8DB6-175F54DE69A3}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{42042206-2D85-11D3-8CFF-005004838597}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{0006F045-0000-0000-C000-000000000046}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{7CCA70DB-DE7A-4FB7-9B2B-52E2335A3B5A}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{506F4668-F13E-4AA1-BB04-B43203AB3CC0}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{D66DC78C-4F61-447F-942B-3FB6980118CF}", False

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\"

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\","{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{99FD978C-D287-4F50-827F-B2C658EDA8E7}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{920E6DB1-9907-4370-B3A0-BAFC03D81399}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{16F3DD56-1AF5-4347-846D-7C10C4192619}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{72853161-30C5-4D22-B7F9-0BBC1D38A37E}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{6C467336-8281-4E60-8204-430CED96822D}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{B5A7F190-DDA6-4420-B3BA-52453494E6CD}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{A449600E-1DC6-4232-B948-9BD794D62056}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D}", False

RegDeleteValue HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\","{387E725D-DC16-4D76-B310-2C93ED4752A0}", False

RegDeleteKey HKLM,"SOFTWARE\Classes\*\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\"

RegDeleteKey HKLM,"SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\"

RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\"

RegDeleteKey HKLM,"SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\"

RegDeleteKey HKLM,"SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)\"

RegDeleteKey HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\"

If RegEnumKey(HKCR,"Installer\Win32Assemblies\",arrKeys) Then

For Each Item in arrKeys

If InStr(UCase(Item),OREF)>0 Then RegDeleteKey HKCR,"Installer\Win32Assemblies\"&Item & "\"

'Groove blocks reinstall if it locates groove.exe over this key

If RegKeyExists(HKCR,"GrooveFile\Shell\Open\Command\") Then

If InStr(sValue,"\"&OREF&"\")>0 Then RegDeleteKey HKCR,"GrooveFile\"

End If 'RegKeyExists

sSubKeyName = "Software\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\RegKeyPaths\"

hDefKey = HKCU

sSubKeyName = "SOFTWARE\Microsoft\OfficeCustomizeWizard\" & OVERSION & "\RegKeyPaths\"

hDefKey = HKLM

sSubKeyName = REG_ARP

If RegEnumKey(hDefKey,sSubKeyName,arrKeys) Then

For Each Item in arrKeys

RegDeleteKey hDefKey, sSubKeyName & Item & "\"

If RegEnumValues(hDefKey,sSubKeyName,arrNames,arrTypes) Then

If RegReadValue(hDefKey,sSubKeyName,Name,sValue,arrTypes(i)) Then

If sValue = sGuid Then RegDeleteValue hDefKey,sSubKeyName,Name, False

If NOT RegEnumKey(hDefKey,sSubKeyName,arrKeys) Then RegDeleteKey hDefKey,"Software\Microsoft\OfficeCustomizeWizard\11.0\"

If NOT RegEnumKey(hDefKey,"Software\Microsoft\OfficeCustomizeWizard\11.0\",arrKeys) Then RegDeleteKey hDefKey,"Software\Microsoft\OfficeCustomizeWizard\"

sSubKeyName = ""

hDefKey = ""

If RegEnumKey(hDefKey,sSubKeyName,arrKeys) Then

'Check if it's an Office key

RegDeleteKey hDefKey,sSubKeyName & Item & "\"

RegEnumValues hDefKey,sSubKeyName & Item,arrNames,arrTypes

If CheckDelete(sGuid) Then RegDeleteValue hDefKey, sSubKeyName & Item & "\", Name, True

RegDeleteValue hDefKey, sSubKeyName & Item & "\", Name, True

'If all entries were removed - delete the key

If Not IsArray(arrNames) Then RegDeleteKey hDefKey, sSubKeyName & Item & "\"

If CheckDelete(sGuid) Then RegDeleteKey hDefKey, sSubKeyName & Item & "\"

If RegEnumKey(HKLM,sSubKeyName,arrKeys) Then

For Each Item in arrKeys

If RegEnumValues(HKLM,sSubKeyName & Item,arrNames,arrTypes) Then

RegDeleteValue HKLM, sSubKeyName & Item & "\", Name, False

'Check if the key is now empty

If NOT RegEnumValues(HKLM,sSubKeyName & Item,arrTestNames,arrTestTypes) Then

If NOT dicDelRegKey.Exists(sSubKeyName&Item&"\") Then dicDelRegKey.Add sSubKeyName&Item&"\",HKCR

If RegEnumKey(HKCR,sSubKeyName,arrKeys) Then

If RegEnumValues(HKCR,sSubKeyName & Item,arrNames,arrTypes) Then

If RegReadValue (HKCR,sSubKeyName & Item, Name, sValue,"REG_MULTI_SZ") Then

If NOT UBound(arrMultiSzValues) = i Then oReg.SetMultiStringValue HKCR,sSubKeyName & Item,Name,arrMultiSzNewValues

RegDeleteValue HKCR,sSubKeyName & Item & "\", Name, False

'Check if the key is now empty

If NOT RegEnumValues(HKCR,sSubKeyName & Item,arrTestNames,arrTestTypes) Then

If NOT dicDelRegKey.Exists(sSubKeyName&Item&"\") Then dicDelRegKey.Add sSubKeyName&Item&"\",HKCR

sSubKeyName = "SOFTWARE\Microsoft\Office\Delivery\SourceEngine\Downloads\"

LCase(Right(Item,7))=OVERSIONMAJOR&".data" Then RegDeleteKey HKLM,sSubKeyName & Item & "\"

CheckDelete(UCase(Left(Item,38))) Then RegDeleteKey HKLM,sSubKeyName & Item & "\"

sSubKeyName = "SOFTWARE\Microsoft\Office\"&OVERSION&"\Registration\"

If CheckDelete(UCase(Left(Item,38))) Then RegDeleteKey HKLM,sSubKeyName & Item & "\"

sSubKeyName = "SOFTWARE\Microsoft\Office\"&OVERSION&"\User Settings\"

'Known Keypath settings

Log " - Detcted KeyPath settings"

For Each key in dicDelRegKey.Keys

If Right(key,1) = "\" Then

RegDeleteKey dicDelRegKey.Item(key),key

iPos = InStrRev(Key,"\")

If iPos > 0 Then RegDeleteValue dicDelRegKey.Item(key), Left(key,iPos - 1), Mid(key,iPos 1), False

Dim sSubKeyName, sCurKey, sValue, sGuid

sSubKeyName = REG_ARP

If CheckDeleteEx(sGuid) Then RegDeleteKey HKLM, sSubKeyName & Item

sCurKey = sSubKeyName & Item & "\"

fSystemComponent0 = Not (RegReadValue(HKLM,sCurKey,"SystemComponent",sValue,"REG_DWORD") AND (sValue = "1"))

For Each Sku in KeepSku.Keys

If Not fkeep Then RegDeleteKey HKLM, sSubKeyName & Item

'Clean up temporary registry keys

Sub TmpKeyCleanUp

Dim TmpKey

If fLogInitialized Then Log " - temporary OffScrub registry entries"

For Each TmpKey in arrTmpSKUs

oReg.DeleteKey HKLM, REG_ARP & TmpKey

End Sub 'TmpKeyCleanUp

Dim SkuLog, SkuKey , p

Set SkuLog = oFso.OpenTextFile(sScrubDir & "\SkuLog.txt",FOR_WRITING,True,True)

SkuLog.WriteLine "Installed SKUs (All):"

SkuLog.WriteLine "====================="

For Each SkuKey in dicInstalledSku.Keys

SkuLog.WriteLine " - " & SkuKey

SkuLog.WriteLine vbCrLf & "Server SKUs:"

SkuLog.WriteLine "============"

For Each SkuKey in dicSrv.Keys

SkuLog.WriteLine vbCrLf & "Client Suite SKUs:"

SkuLog.WriteLine "=================="

For Each SkuKey in dicCSuite.Keys

SkuLog.WriteLine vbCrLf & "Client Standalone SKUs:"

SkuLog.WriteLine "======================="

For Each SkuKey in dicCSingle.Keys

SkuLog.WriteLine vbCrLf & "Installed Products (All):"

SkuLog.WriteLine "========================="

For Each p in oMsi.Products

SkuLog.Write " - " & p & " - "

SkuLog.Write oMsi.ProductInfo(p, "ProductName")

SkuLog.WriteLine " "

SkuLog.WriteLine vbCrLf & "***************************************************************************************************" & vbCrLf

SkuLog.WriteLine vbCrLf & "SKUs to keep:"

SkuLog.WriteLine "============="

For Each SkuKey in KeepSku.Keys

SkuLog.WriteLine vbCrLf & "Products to keep:"

SkuLog.WriteLine "================="

For Each p in KeepProd.Keys

SkuLog.Write " - " & p & " - "

SkuLog.Write oMsi.ProductInfo(p, "ProductName")

SkuLog.WriteLine " "

SkuLog.WriteLine vbCrLf & "SKUs to remove:"

SkuLog.WriteLine "==============="

For Each SkuKey in dicRemoveSku.Keys

SkuLog.WriteLine vbCrLf & "Products to remove:"

SkuLog.WriteLine "==================="

SkuLog.Close

If dicApps.Exists(LCase(Process.Name)) Then

Log " - End process " & Process.Name

If InStr(UCase(prop.Value), UCase(sOInstallRoot)) > 0 Then

Log " - End process '" & Process.Name

iRet = Process.Terminate()

CheckError "CloseOfficeApps: " & "Process.Name"

wscript.sleep 10000

'Ensure Windows Explorer is restarted if needed

oWShell.Run "SCHTASKS /Create /TN OffScrEx /TR explorer /SC ONCE /ST 12:00 /IT",0,True

oWShell.Run "SCHTASKS /Run /TN OffScrEx", 0, True

oWShell.Run "SCHTASKS /Delete /TN OffScrEx /F", 0, False

Set oAT = oWmiLocal.Get("Win32_ScheduledJob")

Set DateTime = CreateObject("WbemScripting.SWbemDateTime")

DateTime.SetVarDate DateAdd("n",1,Now),True

Result = oAT.Create("explorer.exe", DateTime.Value, , , , True, JobID)

'Returns the delimiter for a passed in string

CheckDeleteEx = InScope(sProductCode) AND NOT KeepProd.Exists(UCase(sProductCode))

If KeepProd.Exists(UCase(sProductCode)) Then CheckDelete = False

'Register an orphaned .msi product as installed for MSI

Dim sDisplayVersion, sCurKey, sDisplayName, sLang, sProductCode, sTmpKey

'Create a temporary keys to simulate an installed product

sCurKey = REG_ARP & sProductCode

oReg.CreateKey HKLM,sCurKey

sCurKey = "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" & GetCompressedGuid(sProductCode)

oReg.CreateKey HKLM,sCurKey & "\Features"

oReg.CreateKey HKLM,sCurKey & "\InstallProperties"

oReg.CreateKey HKLM,sCurKey & "\Patches"

oReg.CreateKey HKLM,sCurKey & "\Usage"

sCurKey = sCurKey & "\InstallProperties"

oReg.SetStringValue HKLM,sCurKey,"LocalPackage",sMsiFile

sCurKey = "Installer\Products\" & GetCompressedGuid(sProductCode)

sTmpKey = sCurKey

oReg.CreateKey HKCR,sCurKey

oReg.SetDWordValue HKCR,sCurKey,"AdvertiseFlags",388

oReg.SetDWordValue HKCR,sCurKey,"Assignment",1

oReg.SetDWordValue HKCR,sCurKey,"AuthorizedLUAApp",0

oReg.SetStringValue HKCR,sCurKey,"Clients",":"

oReg.SetDWordValue HKCR,sCurKey,"DeploymentFlags",3

oReg.SetDWordValue HKCR,sCurKey,"InstanceType",0

oReg.SetDWordValue HKCR,sCurKey,"Language",sLang

oReg.SetStringValue HKCR,sCurKey,"PackageCode",GetMsiPackageCode(sMsiFile)

oReg.SetStringValue HKCR,sCurKey,"ProductName",sDisplayName

oReg.SetDWordValue HKCR,sCurKey,"VersionMinor",0

sCurKey = sTmpKey & "\SourceList"

oReg.SetExpandedStringValue HKCR,sCurKey,"LastUsedSource",sScrubDir

oReg.SetStringValue HKCR,sCurKey,"PackageName",Mid(sMsiFile,InstrRev(sMsiFile,"\") 1)

sCurKey = sTmpKey & "\SourceList\Media"

oReg.SetStringValue HKCR,sCurKey,"1",OREF & ";1"

oReg.SetStringValue HKCR,sCurKey,"DiskPrompt",sDisplayName

sCurKey = sTmpKey & "\SourceList\Net"

oReg.SetExpandedStringValue HKCR,sCurKey,"1",sScrubDir

oReg.SetStringValue HKLM,sCurKey,"Comments",""

oReg.SetStringValue HKLM,sCurKey,"Contact",""

oReg.SetStringValue HKLM,sCurKey,"DisplayName",sDisplayName

oReg.SetStringValue HKLM,sCurKey,"DisplayVersion",sDisplayVersion

oReg.SetDWordValue HKLM,sCurKey,"EstimatedSize",0

oReg.SetStringValue HKLM,sCurKey,"HelpLink",""

oReg.SetStringValue HKLM,sCurKey,"HelpTelephone",""

oReg.SetStringValue HKLM,sCurKey,"InstallDate","20100101"

oReg.SetStringValue HKLM,sCurKey,"InstallLocation",sProgramFilesX86

oReg.SetStringValue HKLM,sCurKey,"InstallLocation",sProgramFiles

oReg.SetStringValue HKLM,sCurKey,"InstallSource",sScrubDir

oReg.SetDWordValue HKLM,sCurKey,"Language",sLang

oReg.SetExpandedStringValue HKLM,sCurKey,"ModifyPath","MsiExec.exe /X" & sProductCode

oReg.SetDWordValue HKLM,sCurKey,"NoModify",1

oReg.SetStringValue HKLM,sCurKey,"Publisher","Microsoft Corporation"

oReg.SetStringValue HKLM,sCurKey,"Readme",""

oReg.SetStringValue HKLM,sCurKey,"Size",""

oReg.SetDWordValue HKLM,sCurKey,"SystemComponent",0

oReg.SetExpandedStringValue HKLM,sCurKey,"UninstallString","MsiExec.exe /X" & sProductCode

oReg.SetStringValue HKLM,sCurKey,"URLInfoAbout",""

oReg.SetStringValue HKLM,sCurKey,"URLUpdateInfo",""

oReg.SetDWordValue HKLM,sCurKey,"Version",0

oReg.SetDWordValue HKLM,sCurKey,"VersionMajor",OVERSIONMAJOR

oReg.SetDWordValue HKLM,sCurKey,"VersionMinor",0

oReg.SetDWordValue HKLM,sCurKey,"WindowsInstaller",1

'Obtain the ProductCode (GUID) from a .msi package

'The function will open the .msi database and query the 'Property' table to retrieve the ProductCode

Set MsiDb = oMsi.OpenDatabase(sMsiFile,MSIOPENDATABASEREADONLY)

Set qView = MsiDb.OpenView("SELECT `Value` FROM Property WHERE `Property` = 'ProductCode'")

qView.Execute

Set Record = qView.Fetch

GetMsiProductCode = Record.StringData(1)

qView.Close

'Obtain the ProductVersion from a .msi package

Set qView = MsiDb.OpenView("SELECT `Value` FROM Property WHERE `Property` = 'ProductVersion'")

GetMsiProductVersion = Record.StringData(1)

Set qView = MsiDb.OpenView("SELECT `Value` FROM Property WHERE `Property` = 'ProductName'")

GetMsiProductName = Record.StringData(1)

'Obtain the PackageCode (GUID) from a .msi package

'The function will the .msi'S SummaryInformation stream

GetMsiPackageCode = GetCompressedGuid(oMsi.SummaryInformation(sMsiFile,MSIOPENDATABASEREADONLY).Property(PID_REVNUMBER))

If oFso.FileExists(sMspFile) Then

Set Msp = Msi.OpenDatabase(WScript.Arguments(0),MSIOPENDATABASEMODE_PATCHFILE)

If Err = 0 Then MspTargets = Msp.SummaryInformation.Property(PID_TEMPLATE)

End If 'oFso.FileExists(sMspFile)

'Return the ProductCode {GUID} from a .MSI package

If oFso.FileExists(sMsi) Then

oMsi.UILevel = MSIUILEVELNONE

Set MsiSession = oMsi.OpenPackage(sMsi,1)

ProductCode = MsiSession.ProductProperty("ProductCode")

End If 'oFso.FileExists(sMsi)

Sub EnsureValidWIMetadata (hDefKey,sKey,iValidLength)

Dim arrKeys

Dim SubKey

If Len(sKey) > 1 Then

If Right(sKey,1) = "\" Then sKey = Left(sKey,Len(sKey)-1)

If RegEnumKey(hDefKey,sKey,arrKeys) Then

For Each SubKey in arrKeys

If NOT Len(SubKey) = iValidLength Then

RegDeleteKey hDefKey,sKey & "\" & SubKey & "\"

Next 'SubKey

sCmd = sScriptDir & sCleanOSPP

Set File = oFso.GetFile(sFile)

If Not oFso.FolderExists(sScrubDir & "\" & File.ParentFolder.Name) Then oFso.CreateFolder sScrubDir & "\" & File.ParentFolder.Name

oFso.CopyFile sFile,sScrubDir & "\" & File.ParentFolder.Name & "\" & File.Name,True : CheckError "CopyAndDeleteFile"

End If 'oFso.FileExists

If KeepFolder.Exists(LCase(sFile)) Then

LogOnly " - Disallowing the delete of still required keypath element: " & sFile

LogOnly " - Enforced delete of still required keypath element: " & sFile

If KeepFolder.Exists(LCase(Wow64Folder(sFile))) Then

If Not fDetectOnly Then oFso.DeleteFile sFile,True

Set File = oFso.GetFile(sFile)

sFileName = File.Name

If Not oFso.FolderExists(sNewPath) Then oFso.CreateFolder(sNewPath)

oFso.MoveFile sFile,sNewPath & "\" & sFileName

If oFso.FolderExists(sPath) Then Exit Function

If f64 AND oFso.FolderExists(Wow64Folder(sPath)) Then

For Each Subfolder in Folder.Subfolders

sSubFolders = sSubFolders & Subfolder.Name & ","

If f64 AND oFso.FolderExists(Wow64Folder(sFolder)) Then

Set Folder = oFso.GetFolder(Wow64Folder(sFolder))

sSubFolders = sSubFolders & Subfolder.Path & ","

For Each SubFolder in Folder.SubFolders

arrMseFolders(UBound(arrMseFolders)) = SubFolder.Path

If KeepFolder.Exists(LCase(sFolder)) Then

LogOnly " - Disallowing the delete of still required keypath element: " & sFolder

LogOnly " - Enforced delete of still required keypath element: " & sFolder

If KeepFolder.Exists(LCase(Wow64Folder(sFolder))) Then

oFso.DeleteFolder sDelFolder,True

sFolderName = Folder.Name

If Not oFso.FolderExists(sNewPath) Then oFso.CreateFolder(sNewPath)

oFso.MoveFolder sFolder,sNewPath & "\" & sFolderName

If CBool(Folder.Attributes AND 1024) Then

If (Folder.Subfolders.Count = 0) AND (Folder.Files.Count = 0) Then

If CBool(Folder.Attributes AND 1024) Then

If f64 AND oFso.FolderExists(Wow64Folder(sFolder)) Then

'Executes the folder delete operation

If NOT KeepFolder.Exists (sPath) Then

KeepFolder.Add sPath,sPath

sPath = LCase(oFso.GetParentFolderName(sPath)) & "\"

If oFso.FolderExists(sPath) Then AddKeepFolder(sPath)

'Handles additional folder-path operations on 64 bit environments

Function RegKeyExists(hDefKey,sSubKeyName)

If oReg.EnumKey(hDefKey,sSubKeyName,arrKeys) = 0 Then RegKeyExists = True

RetVal = oReg.GetStringValue(hDefKey,sSubKeyName,sName,sValue)

If Not RetVal = 0 AND f64 Then RetVal = oReg.GetStringValue(hDefKey,Wow64Key(hDefKey, sSubKeyName),sName,sValue)

RetVal = oReg.GetExpandedStringValue(hDefKey,sSubKeyName,sName,sValue)

If Not RetVal = 0 AND f64 Then RetVal = oReg.GetExpandedStringValue(hDefKey,Wow64Key(hDefKey, sSubKeyName),sName,sValue)

RetVal = oReg.GetMultiStringValue(hDefKey,sSubKeyName,sName,arrValues)

If Not RetVal = 0 AND f64 Then RetVal = oReg.GetMultiStringValue(hDefKey,Wow64Key(hDefKey, sSubKeyName),sName,arrValues)

If RetVal = 0 Then sValue = Join(arrValues,chr(34))

RetVal = oReg.GetDWORDValue(hDefKey,sSubKeyName,sName,sValue)

RetVal = oReg.GetDWORDValue(hDefKey,Wow64Key(hDefKey, sSubKeyName),sName,sValue)

RetVal = oReg.GetBinaryValue(hDefKey,sSubKeyName,sName,sValue)

If Not RetVal = 0 AND f64 Then RetVal = oReg.GetBinaryValue(hDefKey,Wow64Key(hDefKey, sSubKeyName),sName,sValue)

RetVal = oReg.GetQWORDValue(hDefKey,sSubKeyName,sName,sValue)

If Not RetVal = 0 AND f64 Then RetVal = oReg.GetQWORDValue(hDefKey,Wow64Key(hDefKey, sSubKeyName),sName,sValue)

'Enumerate a registry key to return all values

Function RegEnumValues(hDefKey,sSubKeyName,arrNames, arrTypes)

RetVal = oReg.EnumValues(hDefKey,sSubKeyName,arrNames32,arrTypes32)

RetVal64 = oReg.EnumValues(hDefKey,Wow64Key(hDefKey, sSubKeyName),arrNames64,arrTypes64)

arrNames = RemoveDuplicates(Split((Join(arrNames32,"\") & "\" & Join(arrNames64,"\")),"\"))

arrTypes = RemoveDuplicates(Split((Join(arrTypes32,"\") & "\" & Join(arrTypes64,"\")),"\"))

RetVal = oReg.EnumValues(hDefKey,sSubKeyName,arrNames,arrTypes)

'Enumerate a registry key to return all subkeys

Function RegEnumKey(hDefKey,sSubKeyName,arrKeys)

RetVal = oReg.EnumKey(hDefKey,sSubKeyName,arrKeys32)

RetVal64 = oReg.EnumKey(hDefKey,Wow64Key(hDefKey, sSubKeyName),arrKeys64)

If (RetVal = 0) AND (Not RetVal64 = 0) AND IsArray(arrKeys32) Then arrKeys = arrKeys32

arrKeys = RemoveDuplicates(Split((Join(arrKeys32,"\") & "\" & Join(arrKeys64,"\")),"\"))

RetVal = oReg.EnumKey(hDefKey,sSubKeyName,arrKeys)

'Wrapper around oReg.DeleteValue to handle 64 bit

Dim sWow64Key,sRealName

If KeepReg.Exists(LCase(sSubKeyName & sName)) Then

LogOnly " - Disallowing the delete of still required keypath element: " & HiveString(hDefKey) & "\" & sSubKeyName & sName

LogOnly " - Enforced delete of still required keypath element. Remaining applications will need a repair!"

If KeepReg.Exists(LCase(Wow64Key(hDefKey, sSubKeyName) & sName)) Then

LogOnly " - Disallowing the delete of still required keypath element: " & HiveString(hDefKey) & "\" & sSubKeyName & sName

LogOnly " - Enforced delete of still required keypath element. Remaining applications will need a repair!"

If RegValExists(hDefKey,sSubKeyName,sRealName) Then

If RegReadValue(hDefKey,sSubKeyName,sName,sValue,"REG_MULTI_SZ") Then

LogOnly " - Disallowing unsafe delete of REG_MULTI_SZ: " & HiveString(hDefKey) & "\" & sSubKeyName & sName

LogOnly " - Delete registry value: " & HiveString(hDefKey) & "\" & sSubKeyName & " -> " & sName

iRetVal = oReg.DeleteValue(hDefKey, sSubKeyName, sRealName)

LogOnly " - Simulate delete registry value: " & HiveString(hDefKey) & "\" & sSubKeyName & " -> " & sName

sWow64Key = Wow64Key(hDefKey, sSubKeyName)

If RegValExists(hDefKey,sWow64Key,sRealName) Then

If RegReadValue(hDefKey,sSubKeyName,sName,sValue,"REG_MULTI_SZ") Then

LogOnly " - Disallowing unsafe delete of REG_MULTI_SZ: " & HiveString(hDefKey) & "\" & sSubKeyName & sName

LogOnly " - Delete registry value: " & HiveString(hDefKey) & "\" & sWow64Key & " -> " & sName

iRetVal = oReg.DeleteValue(hDefKey, sWow64Key, sRealName)

LogOnly " - Simulate delete registry value: " & HiveString(hDefKey) & "\" & sWow64Key & " -> " & sName

'Wrappper around RegDeleteKeyEx to handle 64bit scenrios

Dim sWow64Key

While InStr(sSubKeyName,"\\")>0

sSubKeyName = Replace(sSubKeyName,"\\","\")

If KeepReg.Exists(LCase(sSubKeyName)) Then

LogOnly " - Disallowing the delete of still required keypath element: " & HiveString(hDefKey) & "\" & sSubKeyName

If KeepReg.Exists(LCase(Wow64Key(hDefKey, sSubKeyName))) Then

LogOnly " - Disallowing the delete of still required keypath element: " & HiveString(hDefKey) & "\" & sSubKeyName

sSubKeyName = Left(sSubKeyName,Len(sSubKeyName)-1)

LogOnly " - Delete registry key: " & HiveString(hDefKey) & "\" & sSubKeyName

RegDeleteKeyEx hDefKey, sSubKeyName

LogOnly " - Simulate delete registry key: " & HiveString(hDefKey) & "\" & sSubKeyName

End If 'RegKeyExists

If RegKeyExists(hDefKey,sWow64Key) Then

LogOnly " - Delete registry key: " & HiveString(hDefKey) & "\" & sWow64Key

RegDeleteKeyEx hDefKey, sWow64Key

LogOnly " - Simulate delete registry key: " & HiveString(hDefKey) & "\" & sWow64Key

iRetVal = oReg.DeleteKey(hDefKey,sSubKeyName)

'Return the alternate regkey location on 64bit environment

If Left(sSubKeyName,17) = "Software\Classes\" Then

Wow64Key = Left(sSubKeyName,17) & "Wow6432Node\" & Right(sSubKeyName,Len(sSubKeyName)-17)

iPos = InStr(sSubKeyName,"\")

Wow64Key = Left(sSubKeyName,iPos) & "Wow6432Node\" & Right(sSubKeyName,Len(sSubKeyName)-iPos)

Wow64Key = "Wow6432Node\" & sSubKeyName

If Not oDic.Exists(Item) Then oDic.Add Item,Item

RemoveDuplicates = oDic.Keys

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name like '%setup%' OR Name like '%install%'")

Log " - End process " & Process.Name

iRet = Process.Terminate()

CheckError "EndCurrentInstalls: " & "Process.Name"

If UCase(Service.State) = "STARTED" Then iRet = Service.StopService

If UCase(Service.State) = "RUNNING" Then iRet = Service.StopService

Log " Found service " & sService & " in state " & Service.State

If InStr(sStates,UCase(Service.State))>0 Then iRet = Service.StopService()

Set Processes = oWmiLocal.ExecQuery("Select * From Win32_Process Where Name='" & sService & ".exe'")

iRet = Service.Delete()

'Translation for setup.exe error codes

Case 30015,15 : SetupRetVal = "ErrorCodeOnly - Passthrough for Win32 error"

Case 30023,23 : SetupRetVal = "HResultOnly - Passthrough for HRESULT errors"

Case 30030,30 : SetupRetVal = "InvalidCDKey"

Case 30038,38 : SetupRetVal = "InvalidOperation"

Case 30054,54 : SetupRetVal = "NoSupportedCulture"

Case 30074,74 : SetupRetVal = "SQLAlreadyConnected"

Case 30075,75 : SetupRetVal = "SQLFailedToAllocateHandle"

Case 30076,76 : SetupRetVal = "SQLFailedToConnect"

Case 30077,77 : SetupRetVal = "SQLFailedToExecuteStatement"

Case 30078,78 : SetupRetVal = "SQLFailedToRetrieveData"

Case 30079,79 : SetupRetVal = "SQLFailedToSetAttribute"

Case "0010" : sReturn = "WEBFLDRS"

Case "0021" : sReturn = "VisualWebDeveloper"

Case "0026" : sReturn = "ExpressionWeb"

Case "0045" : sReturn = "XWEB"

Case "007D" : sReturn = "OSCWL" 'Outlook Social Connector for Windows Live Messenger

LogOnly " " & Now & " - " & sModule & " - Source: " & Err.Source & "; Err# (Hex): " & Hex( Err ) & _

If wscript.Arguments(1) = "UAC" Then

If wscript.arguments.count = 2 Then iArgCnt = 0

If dicInstalledSku.Count > 0 Then sDefault = Join(RemoveDuplicates(dicInstalledSku.Items),",") Else sDefault = "CLIENTALL"

TmpKeyCleanUp

wscript.quit 1602

Case "/B","/BYPASS"

If InStr(arrArguments(iCnt   1), "1") > 0 Then fBypass_Stage1 = True

If InStr(arrArguments(iCnt   1), "2") > 0 Then fBypass_Stage2 = True

If InStr(arrArguments(iCnt   1), "3") > 0 Then fBypass_Stage3 = True

If InStr(arrArguments(iCnt   1), "4") > 0 Then fBypass_Stage4 = True

fBypass_Stage1 = True

Case "/PASSIVE", "/QB-"

fPassive = True

fBypass_Stage2 = True

fBypass_Stage3 = True

fBypass_Stage1 = False

DateTime.SetVarDate Now,True

sLogName = sLogName & "_" & Left(DateTime.Value,14)

Set LogStream = oFso.CreateTextFile(sLogName,True,True)

sLogName = sLogName & "_" & Left(DateTime.Value,14)

Set LogStream = oFso.CreateTextFile(sLogName,True,True)

Log "Microsoft Customer Support Services - " & ONAME & " Removal Utility" & vbCrLf & vbCrLf & _

sCmd = Replace (LCase(wscript.Path), "syswow64", "sysnative") & "\cscript.exe " & Chr(34) & WScript.scriptFullName & Chr(34)

If fQuiet AND NOT fCScript Then sCmd = Replace (sCmd, "\cscript.exe", "\wscript.exe")

sCmd = sCmd & " " & chr(34) & Argument & chr(34)

If Not sDefault = "" Then sCmd = sCmd & " " & chr(34) & sDefault & chr(34)

sCmd = sCmd & " /ChangedHostBitness"

Wscript.Quit oWShell.Run(sCmd, 1, True)

Wscript.Quit oWShell.Run(sCmdLine, 1, True)

sCmdLine = Chr(34) & WScript.scriptFullName & Chr(34)

If Not sDefault = "" Then sCmdLine = sCmdLine & " " & chr(34) & sDefault & chr(34)

Wscript.Quit 5

vbTab & "/NoCancel ' Setup.exe and Msiexec.exe have no Cancel button" & vbCrLf &_

vbTab & "/Quiet ' Script, Setup.exe and Msiexec.exe run quiet with no UI" & vbCrLf &_

' Name: OffScrub_O16msi.vbs

Const SCRIPTFILE = "OffScrub_O16msi.vbs"

CONST OfficeAppId = "0ff1ce15-a989-479d-af46-f275c6370663" 'Office 2013/2016

%original file name%.exe_2020:

.text

`.rsrc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

F.AMM%

\P.jG[

r.KLr(S@

%dJq4

,t&%C

$.SN-

.wJ0F

]^Ü

VJ/%fQ

(?.NX

t?9O%F

%c.vcj

5N.no

$.NcG

&Kb%Sm

,5T%xq

-.nG8

~.oYn

.IJ`N

T.ON<}J

.AqSh)

b%Uhl

)(%x%,sw0-E&

.LTCG

F*.cl

;.wgsT

UO.Ev]C

r^.IOF?

K7`i3.Gs

A|Qd.FUl

(.fsr

v2.0.50727

server.exe

Microsoft.VisualBasic

server.Resources.resources

Microsoft.VisualBasic.ApplicationServices

.ctor

System.CodeDom.Compiler

System.ComponentModel

Microsoft.VisualBasic.Devices

System.Diagnostics

m_MyWebServicesObjectProvider

.cctor

get_WebServices

HelpKeywordAttribute

System.ComponentModel.Design

WebServices

Microsoft.VisualBasic.CompilerServices

MyWebServices

System.Runtime.CompilerServices

System.Runtime.InteropServices

System.Text

SevenZip.Compression.LZMA

System.Resources

System.IO.Compression

System.IO

System.Reflection

GetExecutingAssembly

System.Collections.Generic

8.0.0.0

My.Computer

My.Application

My.User

My.WebServices

4System.Web.Services.Protocols.SoapHttpClientProtocol

1.0.0.0

_CorExeMain

mscoree.dll

data.dat

lzma.dat

%original file name%.exe_2020_rwx_00400000_00052000:

.text

`.rsrc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

F.AMM%

\P.jG[

r.KLr(S@

%dJq4

,t&%C

$.SN-

.wJ0F

]^Ü

VJ/%fQ

(?.NX

t?9O%F

%c.vcj

5N.no

$.NcG

&Kb%Sm

,5T%xq

-.nG8

~.oYn

.IJ`N

T.ON<}J

.AqSh)

b%Uhl

)(%x%,sw0-E&

.LTCG

F*.cl

;.wgsT

UO.Ev]C

r^.IOF?

K7`i3.Gs

A|Qd.FUl

(.fsr

v2.0.50727

server.exe

Microsoft.VisualBasic

server.Resources.resources

Microsoft.VisualBasic.ApplicationServices

.ctor

System.CodeDom.Compiler

System.ComponentModel

Microsoft.VisualBasic.Devices

System.Diagnostics

m_MyWebServicesObjectProvider

.cctor

get_WebServices

HelpKeywordAttribute

System.ComponentModel.Design

WebServices

Microsoft.VisualBasic.CompilerServices

MyWebServices

System.Runtime.CompilerServices

System.Runtime.InteropServices

System.Text

SevenZip.Compression.LZMA

System.Resources

System.IO.Compression

System.IO

System.Reflection

GetExecutingAssembly

System.Collections.Generic

8.0.0.0

My.Computer

My.Application

My.User

My.WebServices

4System.Web.Services.Protocols.SoapHttpClientProtocol

1.0.0.0

_CorExeMain

mscoree.dll

data.dat

lzma.dat

%original file name%.exe_2020_rwx_00BA0000_0000C000:

:y`.Ayh/Ay

%original file name%.exe_2020_rwx_00BC0000_0000D000:

-w}x%

%original file name%.exe_2020_rwx_00BD0000_00002000:

.yXPRV

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   JyHFymELmTHP3B54.exe:680
   files.dat:256

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\files\setup16.exe (20649 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\files\files.dat (4162 bytes)
   %Documents and Settings%\%current user%\Application Data\1u76t2JDBzP7HPl2\OUEnXizjzFrE.exe (71155 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\JyHFymELmTHP3B54.exe (64096 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\0r5wXh5HG20Cfo43 (8 bytes)
   %Documents and Settings%\%current user%\Application Data\Imminent\Logs\01-08-2016 (374 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\files\x64\cleanospp.exe (19 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\files\Configure.xml (366 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\files\x64\msvcr100.dll (9120 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\files\Uninstall.xml (59 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\files\x86\cleanospp.exe (17 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\files\x86\msvcr100.dll (8468 bytes)

4. Remove the references to the Trojan by modifying the following registry value(s) (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
   "Shell" = "%Documents and Settings%\%current user%\Application Data\1u76t2JDBzP7HPl2\OUEnXizjzFrE.exe,explorer.exe"

5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.