can't get rid of 2 spyware programs

[Daryl]

I have tried Spybot SD and this New Microsoft scanner...
It shows up as:

WINTOOLS(Trojan) --> Severe
c:\programs files\common files\wintools
c:\programs files\common files\wintools\temp

Host file redirection of 69.20.16.183 auto.search.msn.com
It keeps showing up even though I have it remove it... I
can't even go into windows explorer and view that directory???

Any help??? thanks in Advance

D

 

[Guest]

Either the spyware is not really being cleaned or the
WinTools is being redownloaded as soon as you connect to
the Internet using your browser (through the redirection).
An easy way to block the new programs from being
downloaded is to cleanup (use Windows Explorer to delete
all the files) and then create the WinTools Folder with
Read Only permissions.

If the directory or the files do exist on your HD, you
should be able to view them in Windows Explorer. Make sure
the options under the explorer are set to show you all
floders and files (including system folders).

Good Luck. I hate this spyware shit with a passion.

-Amit

 

[Guest]

Nasty piece of .. Installs itself as a service. Here are a
couple of links that have instructions on removing it :

http://www.scanspyware.net/info/WinTools.htm

http://www.winpatrol.com/db/freesample/wtoolsa.html

 

[Spider]

The last time I ran into Wintools, I simply went to add/remove programs in
control panel and uninstalled it along with a few other programs tied to it,
and that stopped the processes from running. At that point run another
spyware scan and it will remove it completely.

 

[Steve Wechsler [MVP]]

How to Remove Win Tools
http://www.bleepingcomputer.com/forums/topict3134.html

Since this variant has morphed lately it is also sometimes necessary to
run DelDomains.inf, available here :
http://www.mvps.org/winhelp2002/DelDomains.inf

Do all the removal steps then run DelDomains.inf by right clicking it
and choosing Install.

Steve Wechsler (akaMowGreen)
MVP Windows Server
AumHa VSOP

 

[Bill Sanderson]

Can you submit a report from the infected machine?

Tools, Suspected Spyware Report.

They need data on this kind of issue.

 

[ger]

Daryl schreef:

I have tried Spybot SD and this New Microsoft scanner...
It shows up as:

WINTOOLS(Trojan) --> Severe
c:\programs files\common files\wintools
c:\programs files\common files\wintools\temp

Host file redirection of 69.20.16.183 auto.search.msn.com
It keeps showing up even though I have it remove it... I
can't even go into windows explorer and view that directory???

Any help??? thanks in Advance

D

I have a close simular setup running here.
Did you try to run a scan already.....????? Took me half a day until I
figured out that after the first scan a few malware proggies were
removed and all went ok ! ;P