If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
wtoolsa
I have been getting the message that wtoolsa has performed
an illegal operation, etc., on booting up the computer and when attempting to open programs. It keeps popping up when you try to close. Can anyone tell me why and how to make it stop? |
#2
|
|||
|
|||
Read he
http://www.doxdesk.com/parasite/HuntBar.html -- Richard G. Harper [MVP Win9x] * PLEASE post all messages and replies in the newsgroups * for the benefit of all. Private mail is usually not replied to. * HELP us help YOU ... http://www.dts-l.org/goodpost.htm "dottiebm" wrote in message ... I have been getting the message that wtoolsa has performed an illegal operation, etc., on booting up the computer and when attempting to open programs. It keeps popping up when you try to close. Can anyone tell me why and how to make it stop? |
#3
|
|||
|
|||
Hi,
Previously posted by Mike Maltby - MS MVP ************************************************** *********** wtoolsa.exe is malware and appears to be a new member of the IBIS Toolbar family (http://www.pestpatrol.com/PestInfo/i/ibis_toolbar.asp) or even a variant of the CoolWebSearch parasite. It certainly doesn't form a part of the Win Me operating system. One install mechanism it uses is if you choose to install the toolbar from xxx.websearch.com Boot to Safe Mode, open MSConfig (Start, Run, enter MSConfig in the box and click OK), open the Startup tab and uncheck the entry being used to launch wstoolsa.exe, possibly labelled something like WinTools as well as any entries referring to wtoolsb.dll, wsup.exe and tb_setup.exe. Browse to and delete the contents of your C:\Windows\Temp folder and also clear you Temporary Internet Files (Internet Options | General | Delete Files and ensure that you check the box "Delete all offline content", then click OK and Apply. Now check Add/Remove Programs and uninstall any entry for WinTools. You should also delete the entire Wintools folder which is probably located as a sub-folder in C:\Program Files\Common Files or alternatively in C:\Windows\System. Check for and delete all copies of wtoolsa.exe, wtoolsb.dll, wsup.exe and tb_setup.exe. Now reboot back into Normal Mode and check your system for commercial parasites. This might be a good time to download yourself a copy of the free Ad-Aware 6.0 from Lavasoft (http://www.lavasoftusa.com/software/adaware/) and also SpyBot (http://www.safer-networking.org/) and scan your system for and remove all unwanted parasites, adware and spyware that might be hiding on your PC. I would suggest you download and run merijn's CWShredder which targets the CoolWebSearch parasite. CWShredder can be downloaded from (http://www.zerosrealm.com/downloads/CWShredder.zip or http://www.spywareinfo.com/~merijn/files/cwshredder.zip). Details of the many forms of the CoolWebSearch hijacker can be found at http://www.spywareinfo.com/~merijn/cwschronicles.html and also http://www.pestpatrol.com/pestinfo/c/cws.asp. If you continue to have problems download a copy of HijackThis from http://www.spywareinfo.com/~merijn/downloads.html). Create a folder called hijackthis on C: and copy the file you downloaded to that folder. Close as many applications as you can including all instances of Internet Explorer and then run hijackthis.exe and post back the log, provided that it isn't too long, to this thread, otherwise to the HijackThis Forum at http://www.spywareinfo.com/forums/ and hopefully this will enable someone to identify the cause of your problem. Possible entries in the HiJackThis log to remove include: O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe O4 - HKLM\..\RunServices: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products Installer Start) - http://imgfarm.com/images/nocache/funwe....0.0.5.cab ************************************************** ************************* -- Regards, Bert Kinney [MS-MVP DTS] http://dts-l.org/ How to Configure Outlook Express for Internet News: http://support.microsoft.com/default.aspx?kbid=171164 "dottiebm" wrote in message ... I have been getting the message that wtoolsa has performed an illegal operation, etc., on booting up the computer and when attempting to open programs. It keeps popping up when you try to close. Can anyone tell me why and how to make it stop? |
#4
|
|||
|
|||
Thanks, I will try this. And actually, I think someone in
the family did recently download that web search toolbar. -----Original Message----- Hi, Previously posted by Mike Maltby - MS MVP ************************************************* ********* *** wtoolsa.exe is malware and appears to be a new member of the IBIS Toolbar family (http://www.pestpatrol.com/PestInfo/i/ibis_toolbar.asp) or even a variant of the CoolWebSearch parasite. It certainly doesn't form a part of the Win Me operating system. One install mechanism it uses is if you choose to install the toolbar from xxx.websearch.com Boot to Safe Mode, open MSConfig (Start, Run, enter MSConfig in the box and click OK), open the Startup tab and uncheck the entry being used to launch wstoolsa.exe, possibly labelled something like WinTools as well as any entries referring to wtoolsb.dll, wsup.exe and tb_setup.exe. Browse to and delete the contents of your C:\Windows\Temp folder and also clear you Temporary Internet Files (Internet Options | General | Delete Files and ensure that you check the box "Delete all offline content", then click OK and Apply. Now check Add/Remove Programs and uninstall any entry for WinTools. You should also delete the entire Wintools folder which is probably located as a sub-folder in C:\Program Files\Common Files or alternatively in C:\Windows\System. Check for and delete all copies of wtoolsa.exe, wtoolsb.dll, wsup.exe and tb_setup.exe. Now reboot back into Normal Mode and check your system for commercial parasites. This might be a good time to download yourself a copy of the free Ad-Aware 6.0 from Lavasoft (http://www.lavasoftusa.com/software/adaware/) and also SpyBot (http://www.safer-networking.org/) and scan your system for and remove all unwanted parasites, adware and spyware that might be hiding on your PC. I would suggest you download and run merijn's CWShredder which targets the CoolWebSearch parasite. CWShredder can be downloaded from (http://www.zerosrealm.com/downloads/CWShredder.zip or http://www.spywareinfo.com/~merijn/files/cwshredder.zip). Details of the many forms of the CoolWebSearch hijacker can be found at http://www.spywareinfo.com/~merijn/cwschronicles.html and also http://www.pestpatrol.com/pestinfo/c/cws.asp. If you continue to have problems download a copy of HijackThis from http://www.spywareinfo.com/~merijn/downloads.html). Create a folder called hijackthis on C: and copy the file you downloaded to that folder. Close as many applications as you can including all instances of Internet Explorer and then run hijackthis.exe and post back the log, provided that it isn't too long, to this thread, otherwise to the HijackThis Forum at http://www.spywareinfo.com/forums/ and hopefully this will enable someone to identify the cause of your problem. Possible entries in the HiJackThis log to remove include: O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe O4 - HKLM\..\RunServices: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products Installer Start) - http://imgfarm.com/images/nocache/funwe....0.0.5.cab ************************************************* ********* ***************** -- Regards, Bert Kinney [MS-MVP DTS] http://dts-l.org/ How to Configure Outlook Express for Internet News: http://support.microsoft.com/default.aspx?kbid=171164 "dottiebm" wrote in message ... I have been getting the message that wtoolsa has performed an illegal operation, etc., on booting up the computer and when attempting to open programs. It keeps popping up when you try to close. Can anyone tell me why and how to make it stop? . |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
wtoolsa error | Jean | Software & Applications | 7 | May 26th 04 07:58 PM |
WtoolsA Error | EDITH | General | 2 | May 24th 04 05:42 AM |
Wtoolsa Error Message | Jean-Pierre Sighe | Improving Performance | 4 | May 23rd 04 11:46 PM |
Wtoolsa Error | Steve Baron - KB3MM | Hardware | 16 | May 23rd 04 09:25 PM |
wtoolsa error | Dani McClean | Software & Applications | 1 | May 20th 04 04:30 PM |