Wtoolsa has caused an error

i get an error message that says Wtoolsa has caused an
error in kernel32.dll. Anyone know what that is exactly
and how to stop the error message?

There have been multiple posts where users are experiencing this problem in
the last few hours and wtoolsa.exe appears to be new malware of some sort. It
certainly doesn't form a part of the Win Me operating system.

Boot to Safe Mode, open MSConfig (Start, Run, enter MSConfig in the box and
click OK), open the Startup tab and uncheck the entry being used to launch
wstoolsa.exe, possibly labelled something like WinTools.

Now reboot back into Normal Mode and check your system for commercial
parasites.

This might be a good time to download yourself a copy
of the free Ad-Aware 6.0 from Lavasoft
(http://www.lavasoftusa.com/software/adaware/) and also SpyBot
(http://www.safer-networking.org/) and scan your system for and remove all
unwanted parasites, adware and spyware that might be hiding on your PC.

I would suggest you download and run merijn's CWShredder which targets the
CoolWebSearch parasite. CWShredder can be downloaded from
(http://www.zerosrealm.com/downloads/CWShredder.zip or
http://www.spywareinfo.com/~merijn/files/cwshredder.zip). Details of the many
forms of the CoolWebSearch hijacker can be found at
http://www.spywareinfo.com/~merijn/cwschronicles.html and also
http://www.pestpatrol.com/pestinfo/c/cws.asp.
--
Mike Maltby MS-MVP



Jeannie wrote:

i get an error message that says Wtoolsa has caused an
error in kernel32.dll. Anyone know what that is exactly
and how to stop the error message?

Uninstall Hunterbar... it's Adware/Spyware.

"Donna", another victim reported that the Startup entries rechecked
themselves. I've got her retrying S&D and AdAware.

If this is a new pest variant, perhaps simply deleting WinTools
directory might do it.


Rick




Mike M wrote:
There have been multiple posts where users are experiencing this problem in
the last few hours and wtoolsa.exe appears to be new malware of some sort. It
certainly doesn't form a part of the Win Me operating system.

Boot to Safe Mode, open MSConfig (Start, Run, enter MSConfig in the box and
click OK), open the Startup tab and uncheck the entry being used to launch
wstoolsa.exe, possibly labelled something like WinTools.

Now reboot back into Normal Mode and check your system for commercial
parasites.

This might be a good time to download yourself a copy
of the free Ad-Aware 6.0 from Lavasoft
(http://www.lavasoftusa.com/software/adaware/) and also SpyBot
(http://www.safer-networking.org/) and scan your system for and remove all
unwanted parasites, adware and spyware that might be hiding on your PC.

I would suggest you download and run merijn's CWShredder which targets the
CoolWebSearch parasite. CWShredder can be downloaded from
(http://www.zerosrealm.com/downloads/CWShredder.zip or
http://www.spywareinfo.com/~merijn/files/cwshredder.zip). Details of the many
forms of the CoolWebSearch hijacker can be found at
http://www.spywareinfo.com/~merijn/cwschronicles.html and also
http://www.pestpatrol.com/pestinfo/c/cws.asp.
--
Mike Maltby MS-MVP



Jeannie wrote:


i get an error message that says Wtoolsa has caused an
error in kernel32.dll. Anyone know what that is exactly
and how to stop the error message?

HunterBar or HuntBar? AFAIK WinTools isn't part of HuntBar. Others have
e-mailed me saying they have had no problems in removing this pest by
following the steps I had posted. Donna seems to be the exception but then
again she's the only one to date who says they had to pay to download free
software.
--
Mike Maltby MS-MVP



Rick T wrote:

Uninstall Hunterbar... it's Adware/Spyware.

"Donna", another victim reported that the Startup entries rechecked
themselves. I've got her retrying S&D and AdAware.

If this is a new pest variant, perhaps simply deleting WinTools
directory might do it.

Mike M wrote:
There have been multiple posts where users are experiencing this problem
in the last few hours and wtoolsa.exe appears to be new malware of some
sort. It certainly doesn't form a part of the Win Me operating system.

Boot to Safe Mode, open MSConfig (Start, Run, enter MSConfig in the box
and click OK), open the Startup tab and uncheck the entry being used to
launch wstoolsa.exe, possibly labelled something like WinTools.

Now reboot back into Normal Mode and check your system for commercial
parasites.

This might be a good time to download yourself a copy
of the free Ad-Aware 6.0 from Lavasoft
(http://www.lavasoftusa.com/software/adaware/) and also SpyBot
(http://www.safer-networking.org/) and scan your system for and remove
all unwanted parasites, adware and spyware that might be hiding on your
PC.

I would suggest you download and run merijn's CWShredder which targets
the CoolWebSearch parasite. CWShredder can be downloaded from
(http://www.zerosrealm.com/downloads/CWShredder.zip or
http://www.spywareinfo.com/~merijn/files/cwshredder.zip). Details of
the many forms of the CoolWebSearch hijacker can be found at
http://www.spywareinfo.com/~merijn/cwschronicles.html and also
http://www.pestpatrol.com/pestinfo/c/cws.asp.

Mike M wrote:

HunterBar or HuntBar? AFAIK WinTools isn't part of HuntBar. Others have
e-mailed me saying they have had no problems in removing this pest by
following the steps I had posted. Donna seems to be the exception but then
again she's the only one to date who says they had to pay to download free
software.

Well all the standard stuff does have payfer options, somebody wants to
send them some $$$, more power to them.

You're right, "Huntbar" not "Hunterbar" (spyware not adware)(gotta
either start using Notepad more often or stop reading donna's typos)


Rick

gotta either start using Notepad more often or stop reading donna's typos.

Just like I should put my specs on when reading and replying to posts - just
like I haven't in replying to yours/ :-)

Thanks for clarifying that you meant HuntBar. If so then this is a new
variant not yet covered by http://www.doxdesk.com/parasite/HuntBar.html but
doubtless they'll catch up soon. At least it doesn't appear to be a CWS
variant which makes cleaning a lot easier.
--
Mike Maltby MS-MVP



Rick T wrote:

Well all the standard stuff does have payfer options, somebody wants to
send them some $$$, more power to them.

You're right, "Huntbar" not "Hunterbar" (spyware not adware)(gotta
either start using Notepad more often or stop reading donna's typos)