IE6 - browser add ons

[Philip J. Cook]

Can anyone please help me with this one, which is really driving me nuts.

My son has downloaded some music sharing software which has caused other
problems with IE6.

1. Everytime I run IE - I get a both a add-on search bar at the top of the
screen and also an add on search screen at the bottome of screen.
2. I think something called WTools (wintools) has been added, I've tried
using various BHO's but to no avail, how can I permanently delete this thing
called Wtools.exe, I've tried starting PC in safe mode and removing it but
it still comes back. How do I get this out of the registry once and for all?
3. When I run Mozillia browser I get no probs, so obviously something is
clearly attached to IE which I want to permanently remove.

many thanks if anyone can help
phil

NB: I've also run adaware (lavasoft)

 

[Guest]

Look for software that was added in control panel. Also.. can you remove the
toolbar itself from inside of IE????

gl
--Chris

 

[Robert W.]

Can anyone please help me with this one, which is really driving me nuts.

My son has downloaded some music sharing software which has caused other
problems with IE6.

1. Everytime I run IE - I get a both a add-on search bar at the top of the
screen and also an add on search screen at the bottome of screen.
2. I think something called WTools (wintools) has been added, I've tried
using various BHO's but to no avail, how can I permanently delete this thing
called Wtools.exe, I've tried starting PC in safe mode and removing it but
it still comes back. How do I get this out of the registry once and for all?
3. When I run Mozillia browser I get no probs, so obviously something is
clearly attached to IE which I want to permanently remove.

That sounds like a browser hijacker. Try Hijackthis.


http://www.spywareinfo.com/~merijn/downloads.html

"These are some programs I wrote.

Note: You need the Visual Basic 6 runtime libraries to run any of my
programs.
Most systems already have this, but should you get an error about
MSVBVM60.DLL missing, get the libraries from Microsoft.com here.

The most popular files are available in their original form (i.e. you can
use 'Run program from this location'), as well as a zipped form. You can
open zipped files with a program like WinZip.

All my programs are compatible with all versions of Windows, unless stated
otherwise in the description.

HijackThis : A general homepage hijackers detector and remover. Initially
based on the article Hijacked!, but expanded with almost a dozen other
checks against hijacker tricks. It is continually updated to detect and
remove new hijacks. It does not target specific programs/URLs, just the
methods used by hijackers to force you onto their sites. As a result, false
positives are imminent and unless you are sure what you're doing, you should
always consult with knowledgable folks (e.g. the forums) before deleting
anything.
A rudimentary HijackThis log tutorial by me is available here.
The official HijackThis QuickStart for posting on the SpywareInfo forums is
available here.
Currently at version: 1.98.2
-> Download from ZerosRealm
-> Download from LurkHere
-> Download from Subratam
-> Download from OfficeFive
-> Download from SpywareInfo
-> Download from ComputerCops"

 

[Don Varnau]

Hi,
From Mike Maltby MS-MVP:
- - -
Boot to Safe Mode, open MSConfig (Start, Run, enter MSConfig in the box and
click OK), open the Startup tab and uncheck the entry being used to launch
wstoolsa.exe, possibly labelled something like WinTools as well as any
entries
referring to wtoolsb.dll, wsup.exe and tb_setup.exe.

Browse to and delete the contents of your C:\Windows\Temp folder and also
clear you Temporary Internet Files (Internet Options | General | Delete
Files
and ensure that you check the box "Delete all offline content", then click
OK
and Apply.

Now check Add/Remove Programs and uninstall any entry for WinTools.

You should also delete the entire Wintools folder which is probably
located as a sub-folder in C:\Program Files\Common Files or alternatively in
C:\Windows\System. Check for and delete all copies of wtoolsa.exe,
wtoolsb.dll, wsup.exe and tb_setup.exe.
- - - -
For final cleanup, go to http://www.aumha.org/a/parasite.htm Scroll down to
HijackThis. Download and run HijackThis and use it to fix entries which
obviously belong to wtools, wtoolsa, wintools. If you would like more help
with this part, go to http://www.aumha.org/a/quickfix.htm Work through steps
1-4 then post a HijackThis log (step 5.)

This thread may help: http://forum.aumha.org/viewtopic.php?t=8646

Regards,
Don

 

[Guest]

kick the kid off the machine till they learn security on a
computer connected to the net. then in a year or two then
let them surf again

 

[Jim Byrd]

Hi Phillip - Courtesy of Wesley Vogel

Wintools Removal Instructions and Help
http://www.pchell.com/support/wintools.shtml



--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[zheenma]

Your can try Browser Hijack Recover
Browser Hijack Recover(BHR) will scan your registry and fix IE
Homepage, IE Default Page, IE Search Page, BHOs, IE Menu, Internet
Options, IE Search Hooks, IE Toolbars, IE Context Menu, and registry.
Website http://www.wamasoft.com
or Download it from
http://www.download.com/Browser-Hijack-Recover/3000-8022_4-10328207.html?tag=lst-0-1