Help with Registry Run

If you are trying to delete them manually from your registry, and you have not backed it up, nor have experience working in there, I suggest that you let someone walk you through it. One wrong move, and you could render your computer inoperable.
Many of those items can be fixed with a tool: HijackThis.
It will list legitimate items as well as malware, so download the tool and post your log here where someone can help you fix the problems.
Download HijackThis version 1.98.2:
http://www.majorgeeks.com/download3155.html
http://209.133.47.12/~merijn/files/HijackThis.exe
http://www.mjc1.com/mirror/hjt/
http://downloads.net-integration.net/HijackThis.exe
http://www.computercops.biz/downloads-file-328.html
http://www.downloads.subratam.org/hijackthis.zip
Extract the file. Do not just doubleclick on it! This opens HijackThis in a temporary folder. This would interfere with the possibility to make back-ups.
Unzip to a folder other than your Desktop or the Temp folder.
To create a folder:
Click My Computer, then C:\
In the menu bar, File->New->Folder.
That will create a folder named "New Folder", which you can rename to "HJT" or "HijackThis".
Now you have C:\HJT\ folder.
Double-click on the .exe to scan.
When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that. Save it somewhere. Do Ctrl-A to Select all, and then copy and paste.
its contents in this thread.

helpbailey,
You have several infections. Let's do a few scans. Then we can clean up the rest.
Please download CWShredder 1.59.1 from here:
http://www.pcworld.com/downloads/file_description/0,fid,23551,RSS,RSS,00.asp
Extract CWShredder to its own folder.
Reboot, into safe mode, this way:
Turn on the computer
Immediately begin tapping the F8 (or F5 on some computers) key.
Use the arrow keys to highlight Safemode and press the Enter key.
Run the program.
Click the “Fix” button and follow the instructions you will receive.
Make sure you let it fix all CWS Remnants.
Close the program, reboot.

Also run these scans:
Ad-aware *
Download Ad-aware version SE Personal 1.05 from here:
http://www.majorgeeks.com/
or http://www.computercops.biz/downloads-file-292.html
Install by double-clicking on the downloaded file.
If you have a previous version of Ad-Aware installed, during the installation of the new version you will be prompted to uninstall or keep the older version - be sure to uninstall the previous version.
After installing Ad-aware, you will be prompted to update the program and run a full scan. De-select all boxes so that it does not run.
Manually run "Ad-Aware SE Personal" and from the main screen Click on "Check for Updates Now".
Once the definitions have been updated:
Reconfigure Ad-Aware for Full Scan as per the following instructions:
-Launch the program, and click on the Gear at the top of the start screen.

-Under General Settings the following boxes should all be checked off: (Checked will be indicated by a green circle with a check mark in it, Un-Checked is a red circle with an X in it. If it is greyed out, those features are only available in the retail version.)

- Automatically save logfile"
- Automatically quarantine objects prior to removal"
- Safe Mode (always request confirmation)
- Prompt to update outdated confirmation) - Change to 7 days.
- Click the "Scanning" button (On the left side).
- Under Drives & Folders, select "Scan within Archives"
- Click "Click here to select Drives + folders" and select your installed hard drives.
- Under Memory & Registry, select all options.
- Click the "Advanced" button (On the left hand side).
- Under "Shell Integration", select "Move deleted files to Recycle Bin".
- Under "Log-file detail", select all options.
- Click on the "Defaults" button on the left.
- Type in the full url of what you want as your default homepage and searchpage e.g. http://www.google.com.
- Click the "Tweak" button (Again, on the left hand side).
- Expand "Scanning Engine" by clicking on the "+" (Plus) symbol) and select the following:
- "Unload recognized processes during scanning."
- "Obtain command line of scanned processes"
- "Scan registry for all users instead of current user only"
- Under "Cleaning Engine", select the following:
-"Automatically try to unregister objects prior to deletion."
-"During removal, unload explorer and IE if necessary"
-"Let Windows remove files in use at next reboot."
- "Delete quarantined objects after restoring"
- Click on "Safety Settings" and select "Write-protect system files after repair (Hosts file, etc)"
- Click on "Proceed" to save these Preferences.
- Click on the "Scan Now" button on the left.
- Under "Select Scan Mode, be sure to select "Use Custom Scanning Options".

- Close all programs except Ad-aware.
- Click on "Next" in the bottom right corner to start the scan.
- Run the Ad-Aware scan and allow it to remove everything it finds and then REBOOT - Even if not prompted to.
- After you log back in, Ad-Aware may run to finalize the scan and remove any locked files that it may of found. Allow it to finish.

Plug-In for Ad-Aware (VX2 Cleaner)
Download the free VX2 Cleaner
http://download.lavasoft.de.edgesuite.net/public/
If that link is unavailable go here : http://www.lavasoft.de/
Follow the link to Ad-aware Personal . On the right you will see Add-Ons. It is in there.

Close Ad-Aware SE build 1.05 and Ad-Watch (if running)
Install the VX2 Cleaner
Start Ad-Aware SE build 1.05
Go to Plug-ins
Select the VX2 Cleaner plug-in and click Run Plugin
If your computer isn’t infected, click Close.

If your computer is infected:

Select Clean System
Reboot your computer
Scan your computer with Ad-Aware
Remove any VX2 objects detected
Reboot your computer again
Run a second scan to make sure the files have been removed from your computer
Close Ad-aware, reboot your system and go on to the next step below.

**NOTE: Virus warnings while performing a scan with Ad-Aware
While performing a scan with Ad-Aware, a background antivirus monitor may issue an alert, stating that a virus has been found in the temporary directory (%temp%) for the current user. This does not necessarily mean your computer has been infected with an active virus. Most antivirus resident scanners will not scan compressed files and only monitor your memory for the sign of an active viral process.

During a scan, Ad-Aware will temporarily decompress files to scan their contents without activating the content, but in doing so, the file is noticed by the antivirus' resident scanner.

Also, some antivirus applications include an option to quarantine infected files, and when Ad-Aware decompresses these quarantined files, the antivirus background scanner detects the virus moving outside the quarantine area. To avoid this you can either remove the quarantined files via your antivirus application, or have Ad-Aware ignore the antivirus program's quarantine folders/files during a scan.

Spybot S&D*
Download Spybot S&D here: http://www.computercops.biz/downloads-file-108.html
Install by double-clicking on the downloaded file.
Run Spybot S&D from desktop icon or Start menu.
Press "Search for updates" button to get list of updates available.
Press "Download updates" button.
Close all IE windows and close & restart Spybot S&D.
Press "Check for problems" button.
Have SpyBot remove all it marks in RED by pressing "Fix selected problems".
Close Spybot S&D, reboot your system.

Online scan at Housecall: http://www.trendmicro.com/en/home/us/enterprise.htm
Or Panda: http://www.pandasoftware.com/activescan/com/activescan_principal.htm
Be sure to put a check in the box by "Auto Clean" before you do the scan. If it finds anything that it cannot clean have it delete it or make a note of the file location so you can delete it yourself.

Reboot.

Move HijackThis out of My Documents and put in a folder of its own. Name it "HJT" or whatever you like.

Otherwise all the backups that is saves will be mixed in with your other documents.
Please post a fresh HijackThis log so we can continue with more cleaning. Thanks.

I am a bit confused here?
Do you just want to find out which of these programs can be set as not to start when your system boots-up?
Is that what you are trying to do? Shut down the excess stuff that will slow you down?
If not, what are you trying to do exactly?

Steve

Ad-aware targets some versions of WinTools, so try the scans I suggested first.
If it does not fix the variant that you have, removal can be a little tricky or WinTools will return.
Do it this way:

Enable the "Show Hidden Folders" option, like this:
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden Files and Folders heading select Show Hidden Files and Folders.
Uncheck the Hide Protected Operating System Files (recommended) option.
Click Yes to confirm.
Click OK.

Next:
1. Disable System Restore:

Start>Rt.-click on My Computer>Properties>System Restore Tab
Put a check mark next to 'Disable System Restore'
Click the OK button.
You will be prompted to restart the computer. Click Yes.

2. Reboot into safe mode:
Turn on the computer
Immediately begin tapping the F8 (or F5 on some computers) key.
Use the arrow keys to highlight Safe Mode and press the Enter key.

3. Click on "Start" => "Control Panel" => "Administrative Tools" => "Services".

4. Look for a service called "Wintools for IE Service" => Double-click it to open, then click on the Stop button and change the "Startup type" to Disabled. Do not worry if the service is not listed.

5. Press Ctrl+Alt+Delete once => Click Task Manager => Click the Processes tab => Double-click the Image Name column header to alphabetically sort the processes => Scroll through the list and look for "WtoolsA.exe", "WToolsS.exe" and "WSup.exe". If you find the files, click on them, and then click End Process => Exit the Task Manager.

6. Go into "Add/Remove Programs" in the "Control Panel" and look for any Wintools entry. Uninstall it.

7. Open a command prompt by clicking on "Start" => "Run" and type in "cmd" and click on "OK". At the prompt, type regsvr32 /u /s "C:\Program Files\Toolbar\toolbar.dll" (Quotation marks must be typed in on the preceeding command) then .

8. Type exit to close the command prompt window.

9. Delete the following directories:

* C:\Program Files\Common Files\WinTools
* C:\Program Files\Toolbar

10.Scan with HJT.
Tick the following items.
Then close all other windows.
Click "Fix Checked", and reboot.

* O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
* O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common Files\WinTools\WToolsA.exe


11. Go back and enable System Restore.(shows all versions of Windows: http://www.pchell.com/virus/systemrestore.shtml)
XP:
Start>Rt-Click My Computer>Properties>System Restore Tab
Remove the check mark next to 'Disable System Restore'
Click the OK button
You will be prompted to restart the computer. Click Yes.

12. Clean the temps:
Please delete your temporary files by deleting all files and folders that are in those folders (Do not delete the temp folder itself.)
For example:
C:\WINDOWS\Temp\C:\Temp\C:\Documents and Settings\username\Local Settings\Temp\
Also delete your Temporary Internet Files, being sure to also select "Delete All Offline Content".

If you need step-by-step instructions for removing the other problems do not hesitate to let us know.

helpbailey,

If you need additional help, PM me. I'm backing out of this one.

Mike.

No need to back out, Mike. Forums are for sharing and your input is always appreciated. That's how people learn. :)

Linlay,

 

Yes you learn much when reading your posts, just exactly how full of yourself you are. Who do you think you are stomping on a persons post and telling someone to follow your advice first. Who died and made you the God Almighty Virus Wizard. It is very obvious you consider yourself better than everyone else when making such a statement, wow what an ego. Then you had the nerve to do it again and again in other threads AND then tell him he did not have to back out. Your remarks are rude and disrespectful, this place already went through a bad time with another selfcentered genius and does not need another in the likes of you. You should come down off that pedestal and hang the ego at the door before entering. I figured since you could be rude, post your opinion and not be deleted, then my post should not be deleted since it is an observation of the obvious.

 

Linda Sue

 

Message Edited by Linda Sue on 12-03-2004 09:28 AM

Linda Sue,

Where did you think anyone was rude? It looks like they were both trying to assist helpbailey.

ChrisM,

Interesting...

If repeat logs aren't requested on many of the fixes by the person taking charge, we can only assume that all problems we're fixed with the given instructions; would you 'qualify' that as being true? I'm not that good.

Since you have confidence in the quality of help the poster(s) were getting, and sure their problems are being completely addressed, I do believe that backing out on both threads was in the best interest of the original posters.

I think that's the respectful thing to do, wouldn't you agree?

Mike.

Now now children....
Let's all act like grown-ups.

I would prefer not see to any brew-ha-ha arise out of this forum.
"You know the old saying "To many cooks spoil the pot."?
"You should only take your car to one mechanic"....
I do understand what Mike is doing by bowing out.

All I can say is that based on my personal experiences in getting my system clean and running smoothly that I totally respect the knowlege that Mike has between his 2 ears.

Besides that I know for a fact that Mike is in with Santa and Santa already got me some RAM and now he is working on finding me the exact video card that I requested.

Thanks Mike and tell Santa Thanks also.


Merry Christmas and Happy Hannukah

Steve,

If you trust that 'mush', your doing better than me ... :smileyvery-happy:

Mike.

 

Mike,

You're welcome! I also thought we needed a bit of levity around here today!

Jim