PDA

View Full Version : Wtoolsa has caused an error


Jeannie
May 19th 04, 12:59 PM
i get an error message that says Wtoolsa has caused an
error in kernel32.dll. Anyone know what that is exactly
and how to stop the error message?

Mike M
May 19th 04, 03:01 PM
There have been multiple posts where users are experiencing this problem in
the last few hours and wtoolsa.exe appears to be new malware of some sort. It
certainly doesn't form a part of the Win Me operating system.

Boot to Safe Mode, open MSConfig (Start, Run, enter MSConfig in the box and
click OK), open the Startup tab and uncheck the entry being used to launch
wstoolsa.exe, possibly labelled something like WinTools.

Now reboot back into Normal Mode and check your system for commercial
parasites.

This might be a good time to download yourself a copy
of the free Ad-Aware 6.0 from Lavasoft
(http://www.lavasoftusa.com/software/adaware/) and also SpyBot
(http://www.safer-networking.org/) and scan your system for and remove all
unwanted parasites, adware and spyware that might be hiding on your PC.

I would suggest you download and run merijn's CWShredder which targets the
CoolWebSearch parasite. CWShredder can be downloaded from
(http://www.zerosrealm.com/downloads/CWShredder.zip or
http://www.spywareinfo.com/~merijn/files/cwshredder.zip). Details of the many
forms of the CoolWebSearch hijacker can be found at
http://www.spywareinfo.com/~merijn/cwschronicles.html and also
http://www.pestpatrol.com/pestinfo/c/cws.asp.
--
Mike Maltby MS-MVP



Jeannie > wrote:

> i get an error message that says Wtoolsa has caused an
> error in kernel32.dll. Anyone know what that is exactly
> and how to stop the error message?

Rick T
May 19th 04, 07:35 PM
Uninstall Hunterbar... it's Adware/Spyware.

"Donna", another victim reported that the Startup entries rechecked
themselves. I've got her retrying S&D and AdAware.

If this is a new pest variant, perhaps simply deleting WinTools
directory might do it.


Rick




Mike M wrote:
> There have been multiple posts where users are experiencing this problem in
> the last few hours and wtoolsa.exe appears to be new malware of some sort. It
> certainly doesn't form a part of the Win Me operating system.
>
> Boot to Safe Mode, open MSConfig (Start, Run, enter MSConfig in the box and
> click OK), open the Startup tab and uncheck the entry being used to launch
> wstoolsa.exe, possibly labelled something like WinTools.
>
> Now reboot back into Normal Mode and check your system for commercial
> parasites.
>
> This might be a good time to download yourself a copy
> of the free Ad-Aware 6.0 from Lavasoft
> (http://www.lavasoftusa.com/software/adaware/) and also SpyBot
> (http://www.safer-networking.org/) and scan your system for and remove all
> unwanted parasites, adware and spyware that might be hiding on your PC.
>
> I would suggest you download and run merijn's CWShredder which targets the
> CoolWebSearch parasite. CWShredder can be downloaded from
> (http://www.zerosrealm.com/downloads/CWShredder.zip or
> http://www.spywareinfo.com/~merijn/files/cwshredder.zip). Details of the many
> forms of the CoolWebSearch hijacker can be found at
> http://www.spywareinfo.com/~merijn/cwschronicles.html and also
> http://www.pestpatrol.com/pestinfo/c/cws.asp.
> --
> Mike Maltby MS-MVP
>
>
>
> Jeannie > wrote:
>
>
>>i get an error message that says Wtoolsa has caused an
>>error in kernel32.dll. Anyone know what that is exactly
>>and how to stop the error message?
>
>
>

Mike M
May 19th 04, 07:59 PM
HunterBar or HuntBar? AFAIK WinTools isn't part of HuntBar. Others have
e-mailed me saying they have had no problems in removing this pest by
following the steps I had posted. Donna seems to be the exception but then
again she's the only one to date who says they had to pay to download free
software.
--
Mike Maltby MS-MVP



Rick T > wrote:

> Uninstall Hunterbar... it's Adware/Spyware.
>
> "Donna", another victim reported that the Startup entries rechecked
> themselves. I've got her retrying S&D and AdAware.
>
> If this is a new pest variant, perhaps simply deleting WinTools
> directory might do it.
>
> Mike M wrote:
>> There have been multiple posts where users are experiencing this problem
>> in the last few hours and wtoolsa.exe appears to be new malware of some
>> sort. It certainly doesn't form a part of the Win Me operating system.
>>
>> Boot to Safe Mode, open MSConfig (Start, Run, enter MSConfig in the box
>> and click OK), open the Startup tab and uncheck the entry being used to
>> launch wstoolsa.exe, possibly labelled something like WinTools.
>>
>> Now reboot back into Normal Mode and check your system for commercial
>> parasites.
>>
>> This might be a good time to download yourself a copy
>> of the free Ad-Aware 6.0 from Lavasoft
>> (http://www.lavasoftusa.com/software/adaware/) and also SpyBot
>> (http://www.safer-networking.org/) and scan your system for and remove
>> all unwanted parasites, adware and spyware that might be hiding on your
>> PC.
>>
>> I would suggest you download and run merijn's CWShredder which targets
>> the CoolWebSearch parasite. CWShredder can be downloaded from
>> (http://www.zerosrealm.com/downloads/CWShredder.zip or
>> http://www.spywareinfo.com/~merijn/files/cwshredder.zip). Details of
>> the many forms of the CoolWebSearch hijacker can be found at
>> http://www.spywareinfo.com/~merijn/cwschronicles.html and also
>> http://www.pestpatrol.com/pestinfo/c/cws.asp.

Rick T
May 19th 04, 10:35 PM
Mike M wrote:

> HunterBar or HuntBar? AFAIK WinTools isn't part of HuntBar. Others have
> e-mailed me saying they have had no problems in removing this pest by
> following the steps I had posted. Donna seems to be the exception but then
> again she's the only one to date who says they had to pay to download free
> software.

Well all the standard stuff does have payfer options, somebody wants to
send them some $$$, more power to them.

You're right, "Huntbar" not "Hunterbar" (spyware not adware)(gotta
either start using Notepad more often or stop reading donna's typos)


Rick

Mike M
May 19th 04, 11:13 PM
> gotta either start using Notepad more often or stop reading donna's typos.

Just like I should put my specs on when reading and replying to posts - just
like I haven't in replying to yours/ :-)

Thanks for clarifying that you meant HuntBar. If so then this is a new
variant not yet covered by http://www.doxdesk.com/parasite/HuntBar.html but
doubtless they'll catch up soon. At least it doesn't appear to be a CWS
variant which makes cleaning a lot easier.
--
Mike Maltby MS-MVP



Rick T > wrote:

> Well all the standard stuff does have payfer options, somebody wants to
> send them some $$$, more power to them.
>
> You're right, "Huntbar" not "Hunterbar" (spyware not adware)(gotta
> either start using Notepad more often or stop reading donna's typos)