WToolsS.exe; WToolsA.exe; WSup.exe: they won't stop running

Hi Chris19283 - Before we start, please create a dedicated folder for Hijack This on your drive and copy it across. If you leave it where it is, backups will not be created.

You also have a hijacker onboard. Close IE and all open windows and run Hijack This again. Check the below entries and click on Fix Checked.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=40

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/mo...ton/search.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dothackenemy.com/

Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/mo...ton/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com/notebooks/pavilion/e-center

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=40

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=40

R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll

O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll

O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll

O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O16 - DPF: {1C955F3B-5B32-4393-A05D-24B4970CD2A1} (Video Class) - http://spystream.babenet.com/cabs/videox.cab

O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50047/QDow.cab

O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.140/code/PWActiveXImgCtl.CAB

O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com/signuptem...iveSecurity.cab

When you have done this, boot into Safe Mode (restart your PC and tap F8 as it restarts), make sure that you can view hidden files and folders and run a search for and delete the WinTools folder. Reboot, reset your Home Page and post a new log. Also let us know if you still have a problem.

alright i fixed all the checked ones... but now i have a desktop full of backups. is this normal? im gonna go into safe mode now if i can and try and delete the wintools folder.. i tried to go into safe mode but it froze on me.. hopefully this doesnt kill my comp ><

:D It worked. Its all gone. but what do i do with all that clutter i talked about? just trash it all? it wont come back to haunt me or anything will it? :o thanks alot annmarie.

Quote:

---

please create a dedicated folder for Hijack This on your drive

---

Hi Chris19283, you are welcome. :) The reason why I mentioned the above is now apparent. No problem, go ahead and delete the backups but wait for a few days before emptying your Recycle Bin. You shouldnt have a problem but if you do, you can restore the backups.

How I have delt with the problem (please note, I have only just done this and have yet know if it will work in the long term :rolleyes: ):

I just deleted the WSup.exe, WToolsA.exe and WToolsS.exe and in their place I made some blank .txt files and named them as the .exe's. That way it thinks it's installed and working but it does nothing when it's soposed to execute. :D

A simple but (hopfuly) effective solution.

I had to go into safe mode and log on as administrator and then just delete the wintools folder in the common files folder.