Will not remove bubba.wntool trojan from IBIS

[E]

Trying to clean my mom's computer while visiting this
weekend.

It is running much better now but after multiple scans in
regular and safe mode the same problem keeps showing up.

wntools trojan

I found a site that described it as the IBIS toolbar and
its alias is Bubba.wntools

Evidently this is what it does -

Changes browser settings other than homepage, without
user permission. Silently tracks sites visited along with
identification of the user/machine by IP address, GUID
for that machine, email address, name, SSN#, phone
number, credit card info, or other identifier without
user permission.

How do I dump this. The company says you can add/remove
it - yeah right.

I did that and it says its not there anymore. However
the scan picks it up and the folders still exist. The
folders will not allow me to delete or even open them.

Any suggestions?

Thanks
E

 

[Andre Da Costa]

Did you do a deep scan in safe mode? On the Scan page choose Scan options
and check full scan.

Andre

 

[Andre Da Costa]

Also, the program is still in beta, so its always best to continue using
products such as Adaware and Spybot Search and Destroy.

Andre

 

[Guest]

As I mentioned - I've done multiple scans in both safe
and normal. Yes, these are deep scans. The other two
programs do not even pick up this problem.

Does anyone have a suggestion on how to get rid of it?

Thanks

 

[Spider]

I'm not sure if there is a morphed version of wintools out there that I am
not familiar with, but the one I am familiar with will produce the results
you are seeing until you go to Control Panel / Add Remove Programs and
uninstall it. I know those of us that remove this stuff on a regular basis
often overlook this one simple step for some spyware. Not all of it hides.
Sometimes it is listed in Add Remove Programs and should be uninstalled
before attempting removal with spyware removal software. Try it with
Wintools and see if it helps.

 

[Guest]

Thanks. I did that already as well. It showed up in
add/remove but then says it doesn't exist. I tried going
straight to the folders and it won't let me open or
delete the folders. Meanwhile it is still showing up in
scans.

 

[Steve Wechsler [MVP]]

Sounds like you're dealing with a newer variant of WinTools.
Suggest you use Task Manager to view running processes and End Process
any winxxx.exe's that are suspicious looking prior to running MSAS
(WinAdTools.exe was one of the Processes used previously )