Wtoolsa

[Dale]

I am having the same problem with the WTOOLSA error
message as I see so many others have.

Would any one e mail me at if you find
the cause and solution. It is a real pain.

Thanks in Advance.

Dale

[Mike M]

Dale,

Did you read any of the many replies that have been posted to those with this
problem?

wtoolsa.exe is malware and appears to be a new member of the IBIS Toolbar
family
(http://www.pestpatrol.com/PestInfo/i/ibis_toolbar.asp) or even a variant of
the CoolWebSearch parasite. It certainly doesn't form a part of the Win Me
operating system. One install mechanism it uses is if you choose to install
the toolbar from xxx.websearch.com

Boot to Safe Mode, open MSConfig (Start, Run, enter MSConfig in the box and
click OK), open the Startup tab and uncheck the entry being used to launch
wstoolsa.exe, possibly labelled something like WinTools as well as any entries
referring to wtoolsb.dll, wsup.exe and tb_setup.exe.

Browse to and delete the contents of your C:\Windows\Temp folder and also
clear you Temporary Internet Files (Internet Options | General | Delete Files
and ensure that you check the box "Delete all offline content", then click OK
and Apply.

Now check Add/Remove Programs and uninstall any entry for WinTools.

You should also delete the entire Wintools folder which is probably
located as a sub-folder in C:\Program Files\Common Files or alternatively in
C:\Windows\System. Check for and delete all copies of wtoolsa.exe,
wtoolsb.dll, wsup.exe and tb_setup.exe.

Now reboot back into Normal Mode and check your system for commercial
parasites.

This might be a good time to download yourself a copy
of the free Ad-Aware 6.0 from Lavasoft
(http://www.lavasoftusa.com/software/adaware/) and also SpyBot
(http://www.safer-networking.org/) and scan your system for and remove all
unwanted parasites, adware and spyware that might be hiding on your PC.

I would suggest you download and run merijn's CWShredder which targets the
CoolWebSearch parasite. CWShredder can be downloaded from
(http://www.zerosrealm.com/downloads/CWShredder.zip or
http://www.spywareinfo.com/~merijn/files/cwshredder.zip). Details of the many
forms of the CoolWebSearch hijacker can be found at
http://www.spywareinfo.com/~merijn/cwschronicles.html and also
http://www.pestpatrol.com/pestinfo/c/cws.asp.

If you continue to have problems download a copy of HijackThis from
http://www.spywareinfo.com/~merijn/downloads.html). Create a folder called
hijackthis on C: and copy the file you downloaded to that folder. Close as
many applications as you can including all instances of Internet Explorer and
then run hijackthis.exe and post back the log, provided that it isn't too
long, to this thread, otherwise to the HijackThis Forum at
http://www.spywareinfo.com/forums/ and hopefully this will enable someone to
identify the cause of your problem.

Possible entries in the HiJackThis log to remove include:
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common
files\WinTools\WToolsA.exe
O4 - HKLM\..\RunServices: [WinTools] C:\Program Files\Common
files\WinTools\WToolsA.exe

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products Installer
Start) - http://imgfarm.com/images/nocache/funwe....0.0.5.cab
--?
Mike Maltby MS-MVP



Dale > wrote:

> I am having the same problem with the WTOOLSA error
> message as I see so many others have.
>
> Would any one e mail me at if you find
> the cause and solution. It is a real pain.
>
> Thanks in Advance.
>
> Dale

[Richard G. Harper]

If you can see the messages complaining of this problem you can also see the
responses to them. There are many detailed responses telling you how to rid
yourself of this pest.

It is considered impolite to ask for private assistance when posting to a
public newsgroup.

--
Richard G. Harper [MVP Win9x]
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


"Dale" > wrote in message
...
> I am having the same problem with the WTOOLSA error
> message as I see so many others have.
>
> Would any one e mail me at if you find
> the cause and solution. It is a real pain.
>
> Thanks in Advance.
>
> Dale

[tmf]

>-----Original Message-----
>I am having the same problem with the WTOOLSA error
>message as I see so many others have.
>
>Would any one e mail me at if you find
>the cause and solution. It is a real pain.
>
>Thanks in Advance.
>
>Dale
Did you find out how to get rid of this as I have it also
& cannot find how to? Thanks in advance.Sandy
>.
>

[Mike M]

Why don't _YOU_ try reading some of the hundreds of posts replying to users
reporting this problem?
--
Mike Maltby MS-MVP



tmf > wrote:

> Did you find out how to get rid of this as I have it also
> & cannot find how to? Thanks in advance.Sandy
>> .

[MowGreen [MVP]]

Answer : Microsoft CDO for Windows 2000

Using a Web-based Newsreader
http://support.microsoft.com/default.aspx?pr=newswhelp&style=toc#faq2148


MowGreen [MVP]


Mike M wrote:

> Why don't _YOU_ try reading some of the hundreds of posts replying to users
> reporting this problem?

[Mike M]

I _DO_ _KNOW_ that Mow (I colour all CDO posts so that they are immediately
recognisable) but that doesn't mean I shouldn't occasionally post what
everyone feels about such users who can't be bothered to either learn to use
the web interface or if they can check for previous replies.
--
Mike Maltby MS-MVP



MowGreen [MVP] > wrote:

> Answer : Microsoft CDO for Windows 2000
>
> Using a Web-based Newsreader
> http://support.microsoft.com/default.aspx?pr=newswhelp&style=toc#faq2148

[MowGreen [MVP]]

You are absolutely correct, Mike. It does get just a tad frustrating
when someone posts the exact same question under a well-researched
and thought out response. Was just hoping the OP just *might* read
it ... one can never give up hope ;)

MowGreen [MVP]

Mike M wrote:
> I _DO_ _KNOW_ that Mow (I colour all CDO posts so that they are immediately
> recognisable) but that doesn't mean I shouldn't occasionally post what
> everyone feels about such users who can't be bothered to either learn to use
> the web interface or if they can check for previous replies.

[Mike M]

Mow,

I'm not sure about my being correct but sometimes the frustration at trying to
help such users surfaces and I can't stop myself. <vbg>
--
Mike M


MowGreen [MVP] > wrote:

> You are absolutely correct, Mike. It does get just a tad frustrating
> when someone posts the exact same question under a well-researched
> and thought out response. Was just hoping the OP just *might* read
> it ... one can never give up hope ;)