Error Message - Wtoolsa - Kernel32.dll

[Martin Allan]

I keep getting an error message
"Wtoolsa has caused an error in Kernel32.dll. Wtoolsa will
now close"
I click OK but it comes back again, and again, and again,
and again.

Anyone any ideas how to cure or stop this

[Mike M]

There have been multiple posts where users are experiencing this problem in
the last couple of days and wtoolsa.exe appears to be new malware of some sort
and could be a new form of the HuntBar parasite
(http://www.doxdesk.com/parasite/HuntBar.html). It certainly doesn't form a
part of the Win Me operating system.

Boot to Safe Mode, open MSConfig (Start, Run, enter MSConfig in the box and
click OK), open the Startup tab and uncheck the entry being used to launch
wstoolsa.exe, possibly labelled something like WinTools.

Now reboot back into Normal Mode and check your system for commercial
parasites. You can also delete the entire Wintools folder which is probably
located as a sub-folder in C:\Program Files\Common Files.

This might be a good time to download yourself a copy
of the free Ad-Aware 6.0 from Lavasoft
(http://www.lavasoftusa.com/software/adaware/) and also SpyBot
(http://www.safer-networking.org/) and scan your system for and remove all
unwanted parasites, adware and spyware that might be hiding on your PC.

I would suggest you download and run merijn's CWShredder which targets the
CoolWebSearch parasite. CWShredder can be downloaded from
(http://www.zerosrealm.com/downloads/CWShredder.zip or
http://www.spywareinfo.com/~merijn/files/cwshredder.zip). Details of the many
forms of the CoolWebSearch hijacker can be found at
http://www.spywareinfo.com/~merijn/cwschronicles.html and also
http://www.pestpatrol.com/pestinfo/c/cws.asp.

If all else fails, and others have managed to fix the problem using the above
suggestions, download a copy of
HijackThis from (http://www.spywareinfo.com/~merijn/downloads.html). Create a
folder called hijackthis on C: and copy the file you downloaded to that
folder. Close as many applications as you can including all instances of
Internet Explorer and then run hijackthis.exe and post back the log, provided
that it isn't too long, to this thread, otherwise to the HijackThis Forum at
http://www.spywareinfo.com/forums/ and hopefully this will enable someone to
identify the cause of your problem.
--?
Mike Maltby MS-MVP



Martin Allan > wrote:

> I keep getting an error message
> "Wtoolsa has caused an error in Kernel32.dll. Wtoolsa will
> now close"
> I click OK but it comes back again, and again, and again,
> and again.
>
> Anyone any ideas how to cure or stop this

[Joan Archer]

Courtesy of MikeM.
Joan

There have been multiple posts where users are experiencing this problem
in
the last couple of days and wtoolsa.exe appears to be new malware of some
sort
and could be a new form of the HuntBar parasite
(http://www.doxdesk.com/parasite/HuntBar.html). It certainly doesn't form
a
part of the Win Me operating system.

Boot to Safe Mode, open MSConfig (Start, Run, enter MSConfig in the box
and
click OK), open the Startup tab and uncheck the entry being used to launch
wstoolsa.exe, possibly labelled something like WinTools.

Now reboot back into Normal Mode and check your system for commercial
parasites. You can also delete the entire Wintools folder which is
probably
located as a sub-folder in C:\Program Files\Common Files.

This might be a good time to download yourself a copy
of the free Ad-Aware 6.0 from Lavasoft
(http://www.lavasoftusa.com/software/adaware/) and also SpyBot
(http://www.safer-networking.org/) and scan your system for and remove all
unwanted parasites, adware and spyware that might be hiding on your PC.

I would suggest you download and run merijn's CWShredder which targets
the
CoolWebSearch parasite. CWShredder can be downloaded from
(http://www.zerosrealm.com/downloads/CWShredder.zip or
http://www.spywareinfo.com/~merijn/files/cwshredder.zip). Details of the
many
forms of the CoolWebSearch hijacker can be found at
http://www.spywareinfo.com/~merijn/cwschronicles.html and also
http://www.pestpatrol.com/pestinfo/c/cws.asp.

If all else fails, and others have managed to fix the problem using the
above
suggestions, download a copy of
HijackThis from (http://www.spywareinfo.com/~merijn/downloads.html).
Create a
folder called hijackthis on C: and copy the file you downloaded to that
folder. Close as many applications as you can including all instances of
Internet Explorer and then run hijackthis.exe and post back the log,
provided
that it isn't too long, to this thread, otherwise to the HijackThis Forum
at
http://www.spywareinfo.com/forums/ and hopefully this will enable someone
to
identify the cause of your problem.
--?
Mike Maltby MS-MVP





Martin Allan wrote:
> I keep getting an error message
> "Wtoolsa has caused an error in Kernel32.dll. Wtoolsa will
> now close"
> I click OK but it comes back again, and again, and again,
> and again.
>
> Anyone any ideas how to cure or stop this

[stewarts]

have been going nuts
cant get it off
did you get a fix

[Rick T]

stewarts wrote:

> have been going nuts
> cant get it off
> did you get a fix

read the response to the original poster.


Rick
(or visit a porn site)

[Joan Archer]

<lol>
Joan

Rick T wrote:
> read the response to the original poster.
>
> Rick
> (or visit a porn site)