1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

What is WToolsA and what it is supposed to do?

Discussion in 'Security and Privacy' started by beth1949, 2004/05/04.

Thread Status:
Not open for further replies.
  1. 2004/05/04
    beth1949

    beth1949 Inactive Thread Starter

    Joined:
    2004/03/03
    Messages:
    64
    Likes Received:
    1
    Does anyone know what WToolsA is and what it is supposed to do? It inserted itself on my computer while my Zone Alarm was down for a reinstall and can't seem to get rid of it. When I disabed it in services, everything started giving me problems like sometimes web pages will load but mostly not. I have a cable connection that is properly working. Any suggestions?
     
  2. 2004/05/04
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,890
    Likes Received:
    387
    WToolsA.exe would appear to be the executable for Wintools - is Wintools loaded to your m/c?

    There is no reference on Google to WToolsA being a virus.

    For peace of mind run Ad-aware and Spybot - URL's in my sig - update their reference files first and an online trojan scan - www.trojanscan.com
     

  3. to hide this advert.

  4. 2004/05/05
    beth1949

    beth1949 Inactive Thread Starter

    Joined:
    2004/03/03
    Messages:
    64
    Likes Received:
    1
    Hi - Pete
    What is m/c? As far as I know I do not have win tools on my computer, but not exactly sure what it is or looks like. Is it something I need? It is definately not something I can uninstall. It is not listed anywhere except in startup and in running processes. I disabled it in those 2 places. I ran spybot and it did not recognize it. I also ran virus and trojan scans and although I did have a trojan, it was not WToolsA. I do not think it is doing any harm, but I just do not like having anything on my computer that I did not put there myself. Know what I mean! Thanks so much for the reply and would appreciate any other comments you might have.
     
  5. 2004/05/05
    maggie

    maggie Inactive

    Joined:
    2002/01/07
    Messages:
    420
    Likes Received:
    0
  6. 2004/05/05
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,890
    Likes Received:
    387
    beth1949
    Short for 'machine' - your PC :D

    Maggie - good find :) Must be my age, but I remember a legit program called Wintools many moons ago? Maybe not :(

    Edit - not my age :D and that's a sneaky son of a bitch!

    http://www.wintools.net/
     
  7. 2004/05/05
    beth1949

    beth1949 Inactive Thread Starter

    Joined:
    2004/03/03
    Messages:
    64
    Likes Received:
    1
    Pete and Maggie - Thanks for the help. Looks like I will be doing a little regedit tonight. Hope that will finally get rid of the thing. Pete - Don't think it can be the legit program as that looks to be something you have to deliberately download and this thing just appeared while my firewall was down. Thanks again.
     
  8. 2004/05/06
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,890
    Likes Received:
    387
    beth1949 - You're welome - keep us posted on progress, please.

    Good Luck!
     
  9. 2004/05/07
    beth1949

    beth1949 Inactive Thread Starter

    Joined:
    2004/03/03
    Messages:
    64
    Likes Received:
    1
    Well, It's been a couple of days and thanks to the help from you guys, the win tools and WToolsA have not tried to reappear on my computer. It's a sneaky little thing. It was appearing to my firewall as Internet Explorer and therefore getting premission for access. When I discovered 2 different Internet Explorer programs in Zone Alarm, I checked the properties of each and sure enough, one was win tools. This is what I did for anyone else who may have this problem. Refused access in Zone Alarm, Disabled win tools in running processes, unchecked WToolsA in startup programs, and then did a registry search for "win tools" and "WToolsA" and deleted those entries. All seems to be well now. Thanks again for all your help!
     
  10. 2004/05/07
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,890
    Likes Received:
    387
    Good news! thanks for the update and solution.
     
  11. 2004/05/20
    eemom

    eemom Inactive

    Joined:
    2004/05/20
    Messages:
    49
    Likes Received:
    0
    Wtoolsa problem on win98se

    Okay, I read all the posts from you guys on this sneaky Wtoolsa. I even went to www.wintools.net that Pete had mentioned.

    I am confused. Does wintools come on computers anyways or did it appear from a website somewhere? Do I need it?

    I tried all that Beth did, however until I understand wintools more, I was afraid to delete it from the computer. I removed wtoolsa from startup and registry, but left the wintools. The darn thing still pops up. What do I do now?

    :rolleyes:
     
  12. 2004/05/20
    sonnym2004

    sonnym2004 Inactive

    Joined:
    2004/05/20
    Messages:
    2
    Likes Received:
    0
    Wtoolsa???

    Beth,

    This is Wtoolsa is driving me crazy. :mad: :confused: This is the error message I get on my screen every 2 seconds.

    "Wtoolsa has caused an error in KERNEL32.DLL Wtoolsa will now close

    If you continue to experience problems, try restarting your computer "

    I also cannot open Internet Explorer. The computer goes into "blue screen mode" and would shut down.

    Can you help please?

    Sonny
     
  13. 2004/05/20
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,890
    Likes Received:
    387
    eemom - Welcome to the Board :)

    Yes, it's very sneaky and disguises itself as Internet Explorer to fool firewalls which would normally have permission to allow Internet Explorer.

    It's rather unlikely that you have the legit WinTools installed on your computer - even if you have it won't do any harm to uninstall it. Most likely it fooled you or your firewall by masquerading as Internet Explorer.

    Look at the thread Maggie posted - there are further posts on there now and do as Beth did to clear it. Which firewall are you using? - you will need to look in the permissions to check for two instances of Internet Explorer, identify which one is allied to wintools and deny it access.
     
  14. 2004/05/20
    eemom

    eemom Inactive

    Joined:
    2004/05/20
    Messages:
    49
    Likes Received:
    0
    Look at the thread Maggie posted - there are further posts on there now and do as Beth did to clear it. Which firewall are you using? - you will need to look in the permissions to check for two instances of Internet Explorer, identify which one is allied to wintools and deny it access.[/QUOTE]

    I am on AOL which has its own firewall they say. I don't even use Internet Explorer. And what do you mean with the permissions thing?
     
  15. 2004/05/20
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,890
    Likes Received:
    387
    sonnym2004 - Welcome to the Board :)

    I found this new reference/solution on Google .....

    http://computercops.info/modules.php?name=Forums&file=viewtopic&p=172295

    If you can't get into IE you will need access another computer to download Ad-aware, but I can't see a way of updating it on your m/c, although the reference files should be quite recent I would guess.

    Can you start in Safe Mode?
     
  16. 2004/05/20
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,890
    Likes Received:
    387
    Moving this thread to Security/Virus/Spyware
     
  17. 2004/05/20
    eemom

    eemom Inactive

    Joined:
    2004/05/20
    Messages:
    49
    Likes Received:
    0
    you will need to look in the permissions to check for two instances of Internet Explorer, identify which one is allied to wintools and deny it access.


    Maybe I am losing it. What in the world are you talking about?
     
  18. 2004/05/20
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,890
    Likes Received:
    387
    Sorry to confuse you :(

    Most standalone firewalls can be configured to allow/deny access to applications (programs) - see shot of Kerio Personal Firewall attached.

    If you run the native XP firewall somewhat more difficult - would need to research that - at length.

    If you don't have a firewall there is no way of stopping critters like that gaining access to your m/c.
     
  19. 2004/05/20
    beth1949

    beth1949 Inactive Thread Starter

    Joined:
    2004/03/03
    Messages:
    64
    Likes Received:
    1
    Sonnym - I know what you mean about it driving you crazy. The win tools associated with wtoolsa is not a legitimate program. Go to the control panel and if win tools is listed there, uninstall it. Also go back to the registry and delete the references to win tools. Another thing you can do is download the free version of zone alarm at www.zonealarm.com and and when Internet Explorer asks for permission to access the internet, give it that permission as you will not know at first which Internet explorer it is. After checking "remember this answer" and "yes" for all your programs that need to access the internet, double click on your ZA icon in the task bar. Click on "program control" and find Internet Explorer in the list. There should be 2 of them. Click once on each one and at the bottom, there will be a description. The one that is identified as win tools should be denied access by clicking once on the check marks beside it and selecting "block ". Hope this helps. After you uninstall the win tools program, you should be able to get on the internet to download Zone Alarm. Good luck.
     
  20. 2004/05/20
    anastasia

    anastasia Inactive

    Joined:
    2004/05/20
    Messages:
    1
    Likes Received:
    0
    Wtoolsa

    I have been trying to get rid of WToolsa also. I have downloaded Ad-aware and Spybot. I have tried to delete it from the ad/remove list but it won't go away. It said that other adware should be removed first. As of now I have dragged the notice to the bottom of my screen-out of sight/out of mind? Is it doing nasty things to my computer as I go on with my work?
    What should I do next?
     
  21. 2004/05/20
    maggie

    maggie Inactive

    Joined:
    2002/01/07
    Messages:
    420
    Likes Received:
    0
    I noticed that the latest Adaware update included wintools.websearch, Haven't looked at any older ones.
    A new reference file (01R306 19.05.2004) is now available.

    Here is a breakdown explaining what is included:

    New Items
    --------------------------------------------------------
    WinTools.websearch (2 variants)
    znzz.iexplore

    Updated Items
    --------------------------------------------------------
    180Solutions
    CoolWebSearch (2 variants)
    JRaun
    Netservices BV
    Rads01.Quadrogram
    Roings (5 variants)
    VX2.BetterInternet
    WebHancer
    Win32.Small.Trojan

    Reference File Details
    --------------------------------------------------------
    After updating, the detail-screen shows the following information:

    Reference Number : 01R306 19.05.2004
    Internal build : 238
    Total size : 1130501 Bytes
    Signature data size : 1111499 Bytes
    Reference data size : 18938 Bytes
    Signatures total : 24860
    Target categories : 10
    Target families : 476
     
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.