New
#11
Also check Services (Control Panel component)
Thanks for the link, I'll run it to see what it finds.
I did check Autoruns, which led to the Registry Key: Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run & the entry (me.blueone.win) has been deleted ... multiple times.
I checked the Windows System Configuration & BlueMail is not listed under the 'Startup' tab
I checked Services & there is nothing BlueMail-related on the list
I checked Task Scheduler & BlueMail is not listed anywhere
Remember that if you reach a point where you have stopped Bluemail autostarting, and Hibit is left running and monitoring for startups, it should prompt you when any next attempt is made to set one- then you can block it and set a rule.
I don't have Services in my Control Panel. I'm still running Windows 10, is Services now in the Control Panel on Windows 11?
I ran Services as Admin from the Start Menu (Windows Key>Services.msc)
I downloaded & used the portable version of Hibit Startup Manager, but it didn't find anything w/the name BlueMail.
Remember that I said that if you can (as I think you said you did) delete something to stop it autostarting temporarily. If you manage to do that, and Hibit is running, it will let you block any new attempt to assert a startup.
What else can you do?
Uninstall Bluemail completely using e.g. Revo Uninstaller with its extra scan.
Then make sure Hibit is running, and is set to start automatically.
Then install Bluemail.
Any attempt to add a startup should be trapped.
Still problems? Get rid of Bluemail and use something more widely used.
I note it says on the Store 'parental guidance recommended'.... (!)
Last edited by dalchina; 3 Weeks Ago at 23:59.
That image is not Services. Try Win+R > services.msc.
Which is why I suggested above that it's hiding under another product name. In my past experience, such software is not to be trusted if it wants to "infect" your system by hiding under another nameI downloaded & used the portable version of Hibit Startup Manager, but it didn't find anything w/the name BlueMail.
Here's your exact answer:
I created a System Restore point and installed Bluemail with my startup monitors ready: this is what they detected:
Here's the startup in the registry:
Glary Utilities has a record of it on their site, curiously:
BlueMail - explorer.exe me.blueone.win:noopt:hidden - Startup programs - Glarysoft
BlueMail explorer.exe me.blueone.win:noopt:hidden
- and here's an extended discussion which I found for you:
https://answers.microsoft.com/en-us/...aa8f0e4?page=1
Hope that helps.
Now to uninstall it..
I know that's not Services, but you posted earlier "Also check Services (Control Panel component)". So that's why I posted my Control Panel picture.
But I do use Services.msc & run it (as both Standard & Administrator User).
HiBit is not detecting BlueMail for me, maybe because I'm using the portable version?
Blix did look into this & have a new version which addresses this problem. Going to uninstall the version I have now (w/Revo Uninstaller), restart the comfuser & double-check the Registry (Revo has missed a few keys/entries in the past).
Not sure if I'm going to install the new version of BlueMail yet.
Last edited by CJW; 3 Weeks Ago at 18:49.
Thank you for your reply.
Hibit: note I specifically referred to it detecting the startup when I installed Bluemail
I have exactly identified the registry key for you.
I have therefore given you the means to stop it autostarting permanently by at least two different methods.
And FWIW I have Hibit installed.
Note: Hibit must be running when you install Bluemail in order to detect the attempt to add the startup.
After all the work I've done for you you now have absolutely everything you need. Problem should be solved.
I never found the entry: C:\Windows\explorer.exe me.blueone.win:autolaunch.blue
The entry I found was just: me.blueone.win
So, I used Revo Uninstaller this morning to uninstall BlueMail.
I then searched the comfuser & Registries this afternoon, just in case.
Using both my Standard & Administrator Accounts:
I did searches using Windows Explorer & Everything, I did not find anything BlueMail or blueone.
I ran Regedit using my Standard Account:
Nothing named BlueMail was found & I deleted a few blueone entries.
I ran Regedit using my Standard Account as Admin & using my Administrator Account & found:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications > C:\Program Files\BlueMail\BlueMail.exe.
But when I try to delete the entry 'C:\Program Files\BlueMail\BlueMail.exe', I get the error message:
"Unable to delete all specified values."
Trying to change permissions on keys 'AllowedApplications' & 'Windows Defender Exploit Guard',
I get the error messages:
"Unable to save permission changes on AllowedApplications" & "Unable to save permission changes on Windows Defender Exploit Guard"
I tried a few solutions found on multiple sites, including using Safe Mode; but cannot delete the Registry key.
Last edited by CJW; 3 Weeks Ago at 01:34.