A
AndyManchesta
Hi Jim the registry line this is stopping at means you
are infected with Huntbar.Wintools is a variant of
Huntbar and i think you may have this.It would explain MS
Antispy freezing because wintools has 3 exe files running
to stop each other being deleted one part a BHO and
another running as a windows service.I will give removal
for wintools incase its that.Another of Huntbars variants
is BTIn which is what your scanner is stopping at so i
will give removal for that also:
Check add/remove screen for any of these and remove if
found:
Web Search Toolbar
Win-Tools Easy Installer
Toolbar
WinTools
WebOffer
Download this removal tool to your desktop,reboot into
safe mode and run the remover.
http://securityresponse.symantec.com/avcenter/FxWebsch.exe
Check the MS Antispy scanner again after rebooting to see
if its still freezing if it is carry on with the manual
removal
Manual removal
Download Ccleaner (Removes temp & unused files)
http://download.ccleaner.com/download119bin.asp
WinTools variant
The WinTools variant cannot be removed in the normal mode
because each of the three processes, plus a BHO,
keep each other alive when you try to stop them. So you
will need to use Safe Mode.
To get to Safe Mode, press the F8 key just as Windows is
about to boot. If you use a multiboot system, this is the
point where the boot menu appears; if not, just keep
tapping F8 as the machine boots until the menu appears.
Open the registry (click 'Start', choose 'Run',
enter 'regedit') and find the key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi
on.
Select the subkey 'Run' and delete the 'WinTools' entry
on the right. If there is a 'TB_setup' or 'TBPS'
entry here, delete that.
Next, select the subkey 'Explorer\Browser Helper
Objects', delete the whole subkey with the
name '{87766247-311C-43B4-8499-3D5FEC94A183}'.
Finally,
find the key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and
delete the WinToolsSvc subkey. Reboot normally.
Both variants
Open a DOS command prompt window (from Start->Programs-
with these copy and paste into the dos prompt screen then
press enter
For HuntBar/BTIn, enter:
cd "%WinDir%\System"
regsvr32 /u btiein.dll
For HuntBar/WinTools, enter:
cd "%WinDir%\System"
regsvr32 /u "\Program Files\Common
Files\WinTools\WToolsB.dll"
cd "%WinDir%\System"
regsvr32 /u "\Program Files\Common
Files\WinTools\btiein.dll"
cd "%WinDir%\System"
regsvr32 /u "\Program Files\Toolbar\toolbar.dll"
File deletion
Having done this you can reboot the machine and delete
the HuntBar files. Open the 'Common Files' folder inside
Program Files. For the WinTools variant
delete 'WinTools'.
Go back to the Program Files folder and delete 'Toolbar'
(WinTools variant). Finally, open the System folder
(inside the
Windows folder, called 'System32' under Windows
NT/2000/XP/2003) and delete 'btiein.dll' (BTIn variant).
Other traces
open 'Downloaded Program Files' in the
Windows folder and delete the entry '{8A05273A-2EA5-42DE-
AA75-59EA7D9D50D7}', '{59450DB0-341D-4436-B380-
B8377D8B6796}', '{D6E66235-7AA6-44ED-A06C-6F2033B1D993}'
or '{26E8361F-BCE7-4F75-A347-98C88B418322}', if you
find them
To clean up, you can also open the registry
(click 'Start', choose 'Run', enter
regedit
delete any of the subkeys
'MSIETS'
'MSIEIN'
'MSLINK'
'BTIEIN'
'BTLINK',
'Search Toolbar'
'WinTools'
in the Software subkey of
both HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER.
For WinTools, you can also delete the keys inside
HKEY_CLASSES_ROOT\CLSID with numbers
{26E8361F-BCE7-4F75-A347-98C88B418322}
and
{87067F04-DE4C-4688-BC3C-4FCF39D609E7}.
Hope this helps
Andy Manc
are infected with Huntbar.Wintools is a variant of
Huntbar and i think you may have this.It would explain MS
Antispy freezing because wintools has 3 exe files running
to stop each other being deleted one part a BHO and
another running as a windows service.I will give removal
for wintools incase its that.Another of Huntbars variants
is BTIn which is what your scanner is stopping at so i
will give removal for that also:
Check add/remove screen for any of these and remove if
found:
Web Search Toolbar
Win-Tools Easy Installer
Toolbar
WinTools
WebOffer
Download this removal tool to your desktop,reboot into
safe mode and run the remover.
http://securityresponse.symantec.com/avcenter/FxWebsch.exe
Check the MS Antispy scanner again after rebooting to see
if its still freezing if it is carry on with the manual
removal
Manual removal
Download Ccleaner (Removes temp & unused files)
http://download.ccleaner.com/download119bin.asp
WinTools variant
The WinTools variant cannot be removed in the normal mode
because each of the three processes, plus a BHO,
keep each other alive when you try to stop them. So you
will need to use Safe Mode.
To get to Safe Mode, press the F8 key just as Windows is
about to boot. If you use a multiboot system, this is the
point where the boot menu appears; if not, just keep
tapping F8 as the machine boots until the menu appears.
Open the registry (click 'Start', choose 'Run',
enter 'regedit') and find the key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi
on.
Select the subkey 'Run' and delete the 'WinTools' entry
on the right. If there is a 'TB_setup' or 'TBPS'
entry here, delete that.
Next, select the subkey 'Explorer\Browser Helper
Objects', delete the whole subkey with the
name '{87766247-311C-43B4-8499-3D5FEC94A183}'.
Finally,
find the key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and
delete the WinToolsSvc subkey. Reboot normally.
Both variants
Open a DOS command prompt window (from Start->Programs-
with these copy and paste into the dos prompt screen then
press enter
For HuntBar/BTIn, enter:
cd "%WinDir%\System"
regsvr32 /u btiein.dll
For HuntBar/WinTools, enter:
cd "%WinDir%\System"
regsvr32 /u "\Program Files\Common
Files\WinTools\WToolsB.dll"
cd "%WinDir%\System"
regsvr32 /u "\Program Files\Common
Files\WinTools\btiein.dll"
cd "%WinDir%\System"
regsvr32 /u "\Program Files\Toolbar\toolbar.dll"
File deletion
Having done this you can reboot the machine and delete
the HuntBar files. Open the 'Common Files' folder inside
Program Files. For the WinTools variant
delete 'WinTools'.
Go back to the Program Files folder and delete 'Toolbar'
(WinTools variant). Finally, open the System folder
(inside the
Windows folder, called 'System32' under Windows
NT/2000/XP/2003) and delete 'btiein.dll' (BTIn variant).
Other traces
open 'Downloaded Program Files' in the
Windows folder and delete the entry '{8A05273A-2EA5-42DE-
AA75-59EA7D9D50D7}', '{59450DB0-341D-4436-B380-
B8377D8B6796}', '{D6E66235-7AA6-44ED-A06C-6F2033B1D993}'
or '{26E8361F-BCE7-4F75-A347-98C88B418322}', if you
find them
To clean up, you can also open the registry
(click 'Start', choose 'Run', enter
regedit
delete any of the subkeys
'MSIETS'
'MSIEIN'
'MSLINK'
'BTIEIN'
'BTLINK',
'Search Toolbar'
'WinTools'
in the Software subkey of
both HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER.
For WinTools, you can also delete the keys inside
HKEY_CLASSES_ROOT\CLSID with numbers
{26E8361F-BCE7-4F75-A347-98C88B418322}
and
{87067F04-DE4C-4688-BC3C-4FCF39D609E7}.
Hope this helps
Andy Manc