WToolsS.exe; WToolsA.exe; WSup.exe: they won't stop running

WToolsS.exe; WToolsA.exe; WSup.exe: they won't stop running! I think I've been infested. I've run Norton, Spybot, and Ad-aware, nothing helps. What can I do? I'm using XP and when I push Ctrl-Alt-Del and look at Processes these files as well as WISPTIS.exe keep poping up. WToolsS.exe shows the User Name: SYSTEM. I'm on a six week work trip to New Zealand and did not get this until I started on the local dialup provider.
Usually in Myrtle Beach, SC,

Howdy:

Take a look in Control Panel/Add-remove Programs for WinTools..

If it is there, remove it.. Now, run a complete av scan ..

Murray

[Murray
Murray,
When I try to remove WinTools I get this message:
"Other ad-power software installed. Please remove it first."

What should I look for and what should I do.

Tom

Check out this thread.

Crunchie, whaddya doing? Its not the same problem.

Tom Merrell, go here and download the latest version of Hijack This to a new folder on your drive, unzip it and click on scan. Most of the files listed will be harmless and/or required so do not make any changes, just click on Save Log, copy it and post it back in this thread.

Boot into Safe Mode and remove it that wy.. then, do a search on your c: drive for those three files.. delete them !!

Murray

Murray....Wintools is malware and it cannot be removed from Add/Remove in Control Panel (as much as we all wish :rolleyes: )

Tom Merrell, if you seriously wish to get of your problem, post your Hijack This log.

Having said that, be very careful of advice offered in this forum before making any changes. From what I have seen in the last few threads, it would do you well to ask for credentials first.

AnnMarie:

WinTools is NOT necessarily malware It is a Windows optimizer that will also install thoses files!!!

http://www.wintools.net/

Tom: AS per Computing.net....

First go to add/remove programs and see if there is an entry for WinTools. If so, uninstall it.

If not then do the following (WinXP or 2000):
Go to start>Settings>Control Panel>Administrative Tools>Services Look for "WinTools for IE service" in the right pane. If you find it, right click on it. Stop it by pressing the stop button. Then disable it by clicking on the startup type drop down and selecting "Disable"

Then right click on the taskbar and open taskmanager.
Go to applications and/or processes and end task on the following (WToolsS.exe should already be stopped from the above step):
WToolsA.exe
WToolsS.exe
WSup.exe

Then delete the following files (Boot to safe mode if you have to). Just open explorer and browse to the location of the files, right click on them and delete them.

File C:\Program Files\Common files\WinTools\WToolsA.exe
File C:\Program Files\Common files\WinTools\WToolsS.exe
File C:\Program Files\Common files\WinTools\WSup.exe
Folder C:\Program Files\Common files\WinTools
File C:\WINDOWS\Belt.exe

Good luck


As for "WISPTIS.exe", it is a legit Microsoft program IF it is located in the c:\windows\System32 folder. It can be installed by either Adobe Reader or Microsft Word. In other cases, wisptis.exe is a virus, spyware, trojan or worm!

Just right click on the file C:\windows\system32\wisptis.exe, click Properties, go to the security tab and remove all permissions except for Read permissions.

Murray

Quote:

---

WinTools is NOT necessarily malware It is a Windows optimizer that will also install thoses files!!!

---

Huh? Tell me more about "Windows Optimizer's" please Murray and could you also tell me which OS will benefit the most from installing the "Windows Optimizer"? Could you also post the install log for each OS?

AnnMarie:

As per the link I gave you...

WinTools.net Professional..

A suite of tools for increasing operating system performance. WinTools.net cleanly removes unwanted software from disk drives and dead references from the Windows registry. WinTools.net puts you in control of the Windows start up process, memory monitoring and gives you the power to customize desktop and system settings to fit your needs. Adds more speed and stability for your connection. Ensures your privacy and keep sensitive information secure. WinTools.net Professional contains tools: Clean Uninstaller, Scan Files, Scan Registry, Start Up, Tweak UI, Net Tweaker,

WinTools.net Classic

A suite of tools for increasing operating system performance. WinTools.net cleanly removes unwanted software from disk drives and dead references from the Windows registry. WinTools.net puts you in control of the Windows start up process, memory monitoring and gives you the power to customize desktop and system settings to fit your needs. WinTools.net Classic contains toolsl: Clean Uninstaller, Scan Files, Scan Registry, Start Up, Tweak UI

Seeing as you are so sceptical (or am I reading your posts wrong??), why don't YOU load the program and see what happens??

Nuff said.. I've proven my point.. Up to Tom now to do as he see's fit..

Murray

Yeah, well I am also OrphanAnnie here Another WToolsA.exe Victim, Help me please

Do you still think that you know what you are talking about Murray?

The following is a very long thread, with lots of ideas, but at the bottom of page 2 are a couple of posts that seem to have gotten rid of WTools
http://www.windowsbbs.com/showthread...9&page=1&pp=15

AnnMarie--I am not able to access that link you provided--at least not before I gave up waiting.

Jim, I dont know what to say. I can open that link, no problem.

Anyone else have a problem opening the link I posted?

I was able to open and read your thread though Welshjim.

It seems that there is resistance to someone trying to help on this site. I cannot be bothered arguing any further.

Go for it guys :D

I have no problem opening the link.

Got excited for a minute and then I remembered "I'm posting on VDR"

AnnMarie:

Direct quote from your second link.. I stand by what I said and thank you for giving a post that agrees with me..

"Go to start>Settings>Control Panel>Administrative Tools>Services Look for "WinTools for IE service" in the right pane. If you find it, right click on it. Stop it by pressing the stop button. Then disable it by clicking on the startup type drop down and selecting "Disable"

Then right click on the taskbar and open taskmanager.
Go to applications and/or processes and end task on the following if they are running. There may be more than one entry of some. End them all:
WToolsA.exe
WToolsS.exe
WSup.exe

Then go to add/remove programs and see if there is an entry for WinTools. If so, uninstall it. Also uninstall SpyHunter. It is no better than the spyware it purports to clean."


If you notice, the person answering the question is telling the asker EXACTLY what I told Tom to do BEFORE he even mentioned dumping anything HiJack This found..

Once again, thank you for proving my point once again for me !!!

Murray

Ann Marie, Here it is, your help appreciated. What should I delete?
Tom

Logfile of HijackThis v1.97.7
Scan saved at 5:34:10 PM, on 5/23/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\Program Files\Norton Internet Security\ccPxySvc.exe
C:\Program Files\sony\giga pocket\shwserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Music\SSSvr.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Photo\appsrv\PhotoAppSrv.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Video\GPVSvr.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
C:\Program Files\Sony\giga pocket\RM_SV.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PowerPanel\Program\PcfMgr.exe
C:\Program Files\SigmaTel\C-Major Audio\stacmon.exe
C:\WINDOWS\System32\ICO.EXE
C:\Program Files\Sony\HotKey Utility\HKserv.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Sony\HotKey Utility\HKWnd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common files\WinTools\WSup.exe
C:\Program Files\Handspring\HOTSYNC.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\tworking\HijackThis.exe
C:\Program Files\Common files\WinTools\WToolsA.exe
C:\Program Files\Common files\WinTools\WToolsS.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=40
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=40
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=40
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\RealBar.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\RealBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SigmaTel StacMon] C:\Program Files\SigmaTel\C-Major Audio\stacmon.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Handspring\HOTSYNC.EXE
O4 - Global Startup: PowerPanel.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeup...ntent/opuc.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/31be793ab77db3c...p/RdxIE601.cab
O16 - DPF: {A8739816-022C-11D6-A85D-00C04F9AEAFB} (WebEyeControl) - http://kotelcam.virtualjerusalem.com/wg_webeye.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab

AnnMarie--Yes, I can open that link now. Must have been temporary server problems. Sorry for crying "Wolf".

I tried what Murry said and almost have it. I was able to finally delete WToolsA.exe ,WToolsS.exe ,WSup.exe but couldn't delete the folder WinTools because I get a message "Cannot delete WtoolsB.dll. Access is denied."

I can not figure out how to get into safe mode . I'm have XP Home and the instructons in Start>Help and Support> don't jive with what my does. There are no pull downs and F8 has no effect..Help!

I really appreciate all the help,

Tom

I checked with Kim K. and saw that I needed to hold down the F8, not just click it. It worked. Was able do delete the .dll files but still have one folder, Temp, that will not delete so I still have the folder, WinTools, but everything is working great. Thanks for all the help especially Murry and Ann Marie!

Hey, I've read this thread a few times, and I'm the more cautious type. I've never posted things like this before, so I'm a bit weary of these things. Yes, I am having a problem with wtoolsa, even though I've never run the program. Unless it runs in the background or something. I have a few questions I'd like to ask before I get help with this problem, if you don't mind that is.

1) Where did I get wtoolsa? Did it come with windows, or did it somehow download off the net? I don't remember installing this program.

2) Somehow, my windows install disk got dammaged. I kept it in a nice hard shell CD case along with all my other program disks, but by odd twist of fate, it was the only one dammaged. So knowing this, would deleting wtoolsa (with your help) cause my computer to completely crash?

3) My friend posted the question earlyer in another forum, and was told to scan my computer with this http://209.133.47.200/~merijn/files/HijackThis.exe Should I run this as well as follow Murray's advice of using the 'add/delete programs' tool?

I guess that's it for me,
Tsume, aka Daron

UPDATE! I think I solved my own problem, thanks to reading this thread, thanks!

This is my first time here so I hope I am doing this right. I have been following this thread because the same thing happened to me. I was able to delete

WToolsA.exe
WToolsS.exe

But I couldn't find WSup.exe or Belt.exe. I was also unable to delete WinTools.

I am having a bizzare problem thay may or maynot be related to this thread. When I am under my login and I go to Yahoo! email and try to log in it says Invaild password. When I try again it works. It didn't seem that strange at first but it is does it to all three of my email accounts. I always have to try it twice. This has been happening for a few days now so I know I am not mistyping because I am being extra careful. When I am under my husband's login I can go to Yahoo! and there are no problems loging in to the email.

Does anyone have any idea what the problem is? Is it related to the WToolsA.exe problem?

Tsume, I'm the novice but I would follow what Murry said as far as you can go. I still havent been able to delete WTools folder but everything is back in working order.

yellowsweater8, I never had (or could find) Belt.exe.

Tom

Tom, I had the same trouble deleting the wtools folder; but I eventually got rid of it in "Safe Mode" This isn't as hard as I thought it would be, or perhaps my computer wasn't so badly infected. :confused: Anyway, try Safe Mode..if you haven't already.

Though, if you computer is working fine now... "Live and let live." Heh.

Later,
Tsume

[How to] Remove WinTool WToolA.exe WToolB.exe Wsup.exe

http://www.geocities.com/flatfilsoc/remove_wintool.html

And perhaps a slightly different approach
http://www.kephyr.com/spywarescanner...ls/index.phtml
It seems to take a lot of work to get rid of this malware and I am surprised that neither this reference nor Vernon Frazee's mention the step of seeing if WinTools is in Control Panel|Add/Remove Programs and, if it is, uninstalling from there as well. (This has been suggested in one of the first steps above.) I assume, though, that the various other procedures must still be followed as well.

Tsume, After 2 times into safe mode I was able to delete. Thanks
Tom

No problem Tom.

I've found a few thing about the sourses of wtools. I heard that one of them is many of the porn sites.
I for one just found out where I got mine from. I love to put skins on my internet explorer, so I got mine from www.websearch.com It's an ok search engine, but:

DO NOT DOWNLOAD THE SKINS OR THE SARCH BAR! lol

Now I have to delete wtools again...what a pain. I guess you can't really tell where your going to get wtools from, so check you computers every once in a while ok?

Later all,
Tsume

heres the log.. Im pretty sure i would have to delete the wintoolsB.dll or whatever but im not gonna remove anything without youre 100% help saying that is the right one. i dont want my computer to crap out on me. The help is really appriciated!

Logfile of HijackThis v1.97.7
Scan saved at 10:20:16 PM, on 6/3/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\HPConfig.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\RadioSvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\S3tray2.exe
C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe
C:\Program Files\EarthLink 5.0\ConMgr.exe
C:\WINDOWS\wt\updater\wcmdmgr.exe
C:\PROGRA~1\NORTON~1\Navapw32.exe
C:\Program Files\WildTangent\Apps\GameChannel.exe
C:\WINDOWS\essspk1.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\program files\instant messenger\aim.exe
C:\Program Files\EarthLink 5.0\FastLane\ARUpld32.exe
C:\Program Files\EarthLink 5.0\Browser.exe
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\89SBCVEX\HijackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=40
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/mor...on/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dothackenemy.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/mor...on/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com/notebooks/pavilion/e-center
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=40
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=40
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [HP Display Settings] C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe /s
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O4 - HKLM\..\Run: [HPLaptopGamesActiveMenu] C:\Program Files\WildTangent\ActiveMenu\HPLaptop\Games\ActiveMenu.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\Navapw32.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WT GameChannel] C:\Program Files\WildTangent\Apps\GameChannel.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk1.exe -c
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe
O4 - HKCU\..\Run: [IM] C:\program files\instant messenger\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [AIM] C:\program files\instant messenger\aim.exe -cnetwait.odl
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com/notebooks/pavilion/e-center
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {1C955F3B-5B32-4393-A05D-24B4970CD2A1} (Video Class) - http://spystream.babenet.com/cabs/videox.cab
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50047/QDow.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com...43/yacscom.cab
O16 - DPF: {36C417C6-13C6-448B-9784-DD73A93B0582} (McAfee.com Download+Installer Class) - http://bin.mcafee.com/molbin/shared/...2/mcinsctl.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/...2/mcinsctl.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.140/code/PWActiveXImgCtl.CAB
O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com/signuptemp...veSecurity.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! WebCam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2E3460BA-9EF5-4E73-AEAF-66BC06F9CBFA}: NameServer = 207.69.188.186 207.69.188.187

Hi Chris19283 - Before we start, please create a dedicated folder for Hijack This on your drive and copy it across. If you leave it where it is, backups will not be created.

You also have a hijacker onboard. Close IE and all open windows and run Hijack This again. Check the below entries and click on Fix Checked.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=40

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/mo...ton/search.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dothackenemy.com/

Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/mo...ton/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.hp.com/notebooks/pavilion/e-center

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=40

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=40

R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll

O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll

O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll

O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O16 - DPF: {1C955F3B-5B32-4393-A05D-24B4970CD2A1} (Video Class) - http://spystream.babenet.com/cabs/videox.cab

O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50047/QDow.cab

O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.140/code/PWActiveXImgCtl.CAB

O16 - DPF: {75D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin.SecureControl) - http://secure2.comned.com/signuptem...iveSecurity.cab

When you have done this, boot into Safe Mode (restart your PC and tap F8 as it restarts), make sure that you can view hidden files and folders and run a search for and delete the WinTools folder. Reboot, reset your Home Page and post a new log. Also let us know if you still have a problem.

alright i fixed all the checked ones... but now i have a desktop full of backups. is this normal? im gonna go into safe mode now if i can and try and delete the wintools folder.. i tried to go into safe mode but it froze on me.. hopefully this doesnt kill my comp ><

:D It worked. Its all gone. but what do i do with all that clutter i talked about? just trash it all? it wont come back to haunt me or anything will it? :o thanks alot annmarie.

Quote:

---

please create a dedicated folder for Hijack This on your drive

---

Hi Chris19283, you are welcome. :) The reason why I mentioned the above is now apparent. No problem, go ahead and delete the backups but wait for a few days before emptying your Recycle Bin. You shouldnt have a problem but if you do, you can restore the backups.

How I have delt with the problem (please note, I have only just done this and have yet know if it will work in the long term :rolleyes: ):

I just deleted the WSup.exe, WToolsA.exe and WToolsS.exe and in their place I made some blank .txt files and named them as the .exe's. That way it thinks it's installed and working but it does nothing when it's soposed to execute. :D

A simple but (hopfuly) effective solution.

I had to go into safe mode and log on as administrator and then just delete the wintools folder in the common files folder.