What is WToolsA and what it is supposed to do?

Help! I'm having the same problem(wtoolsa)

Okay, I have read your postings and I cannot get rid of this thing!!
I get the error "WTOOLSA caused an invalid page fault in module KERNEL32.DLL at 0167:bff7671f."

I’m running windows 98 and I’ve deleted the entry form the registry and still I get the error. I tried to remove, thru control panel, a program called win tools for internet explorer v2 but I keep getting the error “other ad-powered software installed. Please remove firstâ€

I have a folder in my hard drive that says win tools under common files…
I just want to get rid of this thing…
Please, can someone tell me what I need to do???


Thanks.
L

 

Welcome to WindowsBBS Liatris!

Download, install, immediately update and run Ad-aware. The new reference files are targeting this bug. Would you also post a before and after HijackThis log? Avalaible from the CWShredder link in my signature. Place it in a permanent folder. Open and hit scan, then save log. Once it is saved it will open in notepad. Select all from the edit button, copy and paste the results here. Don't fix anything with it yet! Thanks!

 

I was just reading an HJT log here. http://www.lavasoftsupport.com/index.php?showtopic=28013 Seems there is more than the wintools to look for. Run Adaware first though. This bugger is hitting quite a few people.

 

My experiences...

Hey people!

I took Beth's advice. I tried "diabling win tools in running processes "...which I took to mean in Task Manager (I'm running Win98 so when I pressed Ctrl-Alt-Del got "Closing Program ". Saw "Wtoolsa ". Didn't notice a "diable box" to uncheck so I just selected it and pressed "end task ". To no avail.

Then I tried her 2nd method of attack. Which was to "uncheck wintools in startup program ". Typing "msconfig" after clicking on start/run. Looked at the list of programs under the "start" tab. Found "wintools" repeated maybe 2x. Diabled it. Clicked on the "apply" button. Rebooted.

Then, ran msconfig again just to take a look. Saw "wintools" repeated 2 more times. Disabled those, pressed Apply and rebooted. No go.

So, then I ran regedit. Ran the "find" program for "wtoolsa ". First time...found wtoolsa.exe but was listed as "default ". Deleted it. Exited regedit. Returned and tried to search for wtoolsa.exe again to make sure it was gone. It wasn't. Exited regedit. Came back. Tried again. This time "wintools" file was listed as it's own file and not "default ". Under location I noticed "wtoolsa.exe" in the path. Manged to delete the file. Exited regedit. Came back and ran the find program again. It was gone! YAHOO!!

I "restarted" the system. Checked "closing programs" and "wtoolsa" was gone! So far so good. Knock on wood!

Thanks for the tips people!

 

Getting Rid of WToolsA

I had the same problem with getting rid of WToolsa from Windows XP Home! I could not delete it from the registry using "HijackThis ", it would not uninstall, Windows Task Manager could not stop it running and it kept being reactivated in msconfig. It seemed immortal!
This is what I did to get rid of it:
1. Started the PC in safe mode (to stop WToolsA running at start-up)
2. Ran HijackThis and deleted the run instruction for Wtoolsa and all other references to it
3. Deleted the wintools folder (program files/common files/wintools) and deleted it from the recycle bin
4. Restarted the PC normally and checked that Wtoolsa had was not shown in the task manager & msconfig, etc
5. Goodbye Wtoolsa!

 

Henry,
Don't forget to delete your Restore Points...or it might come back!

Johanna

 

Johanna,
Done - many thanks!

Henry

 

wtoolsa A GONNER

Yay to all of us. I followed all of your info. It is GONE.

1) I went to msconfig and unchecked wintools.
2) In safe mode I removed Wintools
3) Restarted, and poof it was GONE.

Thanks to all of you. And thank you WindowsBBS for being here. I have a new site to research.

 

WinTools (where to get it)

I don't know if this helps. I have had this thing three times and have gotten rid of it three times. I get it from news link pages at MSNBC.com. This is my normal home page ,I just go to a news story the browser will stop responding and now I have WinTools for Internet Explorer 6.This is about a 50% drive by install rate for me. I am not having any luck with prevention yet. Zone Alarm only stops out bound on this.

 

I run Adaware,Spybot,ZAPro,eTrust, Spywareblaster,Script Sentry, all kept updated. Plus I have IE locked down pretty well. Lots of scripting and activeX are either prompt or disabled. The only sites that get cookies are in my trusted. 3rd party cookies are blocked. In IE> advanced I don't enable install on demand. I haven't gotten anything in over a year since I locked down stuff. I have OutlookXP in the restricted zone.
It is a hassle if I'm all over the net, but I don't go too many places. I do run the google toolbar so I have to enable third party browser in IE to install that. I get around that by having the prompt and disable in IE.
Also keeping up with stuff on these great forums.

 

Welcome to WindowsBBS racntn

Possibly an activeX control allowing reinstallation. Care to post a HijackThis log so that we might be able to identify one? Are you current with Windows Updates?

 

Just want to say thank you very much. I've been searching for infor on this wtoolsa for days now and last night at about 1030 (uk time) I finally found you guys!! At last, someone who knows what I'm talking about.

Tried to tell you last night, but had to join up and wait for password first!

Just about to follow your advice, back soon - I hope.
Thanks again
H

 

If I'm reading this thread correctly, I should do the following:

1) Download and install Ad-aware, Spybot, and Hijack This from the links in PeteC's sig.

2) Do what Henry did. (I'm running Windows XP Home.)

What about WToolsS.exe? I saw a thread regarding this.

Does it matter that I use Mozilla as my primary Web Browser? I switched from IE to Mozilla because of the option to block pop-ups.

I'm going to be watching the Pistons game so I'll check back later to see if I missed anything. I would hate to ***** up my computer as 6 people use it for stuff, mostly Internet stuff.

 

wtoolsa problem

I don't have a firewall that I know of... we have a dial-up connection to the phone company. I did uncheck WinTools in the startup programs. How do I disable WinTools in the running processes and how do I perform a registry search to delete the WinTools and WToolsa? I have downloaded Ad-aware and have run the update. What else can I do to get rid of this Wtoolsa? Thank you in advance!

 

Welcome all!

SGP928,
I will respond to your other post shortly.

zekeburger,
Best to post a log. I or someone else will be happy to help. There may be other components left over that can still create problems or allow easy reinfection otherwise. A new thread would be best so that instructions don't get crossed.

HelenF,
Good luck to you, and feel free to post a log, preferably in a new thread.

 

wtoolsa problem

I did what DarkDTSes did and had success! By running regedit and deleting the files that came up with "wintools" and/or "wtoolsa" in the file name path, it finally went away. It took about 4 - 5 tries, though, to finally beat it.
Now, when I restart the computer, no more pesky window that says "performing an illegal operation and will be shut down "! Thank you for posting such clear instructions on how to get rid of this thing!

 

For those affected by this nasty, reading this thread and considering options for removal, if you want to do manual removal and edit the registry and take 4 or 5 stabs at it, feel free. But there are easier, safer and better ways, which will also help remove other spyware/malware/adware that is most likely on your system, at the same time, not to mention possible leftovers from manual removal that may allow for easy reinfection. Download both Spybot and Ad-aware. Links are in my signature and both are free. Install and immediately update them. Run Spybot and fix all it finds and is prechecked. Then configure Ad-aware like this, run and delete all it finds. Reboot and post a HijackThis log in a new thread here, and I or someone will give you follow-up instructions. Please make note that you have already run both programs.

 

HelenF - one of our regulars, Brett, is from your part of the world (Isle of Man). Don't think he gets to the security section often but he is around the forum in a few other sections.