Hi mate i understand your frustration but dont worry
everything can be removed once we know what it is,I think
you should also download Hijack this and then follow
these tips,Its very difficult to remove as it adds
registry values all over the place plus a folder in
c/drive program files but follow these tips and see how
you get on.
The problem is there is at least 3 different adware i
know called wintools plus a genuine program for removing
files but with you saying you cannot remove it i suspect
its this one as it has three executables running at
startup including one hidden one and one running as a
Windows service. These processes interact to stop each
other from being killed, preventing removal of the
software.
Download These :
Hijack This
http://hijackthis.clickhereformoreinfo.com/
General Tips for removing Bugs:
Turn off Windows System Restore (Start,Right
click my computer,Properties,then system restore and
disable and apply)
Next: Enable viewing of hidden files and folders and
extensions; Some programs can hide this way by not being
visible in Windows. Start Windows Explorer and click on
your main hard drive, usually c:\. Then select Tools from
the top of Windows Explorer and then Folder Options. Go
to the View tab. Scroll down to the folder icon that says
Hidden files and folders and check show hidden files and
folders. Also, right below it, uncheck the hide file
extensions for known types.
Next to boot into Safe Mode
Reboot the system and tap F8, choose Safe Mode.
Next: Delete Temp Internet files :
Open a internet browser window, click Tools then Internet
Options.
Click on the Delete Cookies and the Delete Files buttons,
then click OK and close the browser window.
Next: Delete Windows Temporary Files - (start,run then
type %temp% delete all files you can in this folder
The Windows temporary directory (usually located at
C:\windows\temp).
This is going to need some registry work but you say you
have already used this so it shouldn't be a problem for
you,Just take your time and only delete the wintools
values or TB_Setup/TBPS if you find them.
Remove the Startup Entries in the Registry
Click on Start, Run, Type REGEDIT and Click OK
Click the pluses(+) next to the following items
HKEY_LOCAL_MACHINE
Software
Microsoft
Windows
CurrentVersion
Run
Right-Click on the file WinTools and click DELETE If
there is still a 'TB_setup' or 'TBPS' entry here, delete
that too.
To clean up, delete any of the
subkeys 'MSIETS', 'MSIEIN', 'MSLINK', 'BTIEIN', 'BTLINK',
'Search Toolbar' and 'WinTools' in the Software subkey of
both HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER.
Theres more registry area's affected but dont want to
make things any harder than they already are so this is
where Hijack this comes into play.
Close REGEDIT
Run HiJackThis (while in Safe Mode) and Delete any
entries relating to WinTools including
O2 - BHO: (no name) - {87766247-311C-43B4-8499-
3D5FEC94A183}- C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-
C581AC420D41} - C:\PROGRA~1\COMMON~1\WINTOOLS\BTIEIN.DLL
Although the following entries should have been deleted,
delete these entries if they still exist.
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common
files\WinTools\WToolsA.exe
O4 - HKLM\..\RunServices: [WinTools] C:\Program
Files\Common files\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common
files\WinTools\WToolsS.exe
O4 - HKLM\..\RunServices: [WinTools] C:\Program
Files\Common files\WinTools\WToolsS.exe
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common
files\WinTools\WSup.exe
O4 - HKLM\..\RunServices: [WinTools] C:\Program
Files\Common files\WinTools\WSup.exe
3) Delete the WinTools folder and all associated files
Open My Computer, Drive C, Program Files, Common Files
Right-click on the WinTools folder (if it exists) and
Delete it
You should also delete or clean up your hosts file
Windows 95/98/Me c:\windows\hosts
Windows NT/2000/XP Pro c:\winnt\system32
\drivers\etc\hosts
Windows XP Home c:\windows\system32\drivers\etc\hosts
(If you have not added entries to the hosts file and are
not sure which to delete then id advise removing them all
except the 127.0.0.1 local host entry and the examples
above the localhost Heres a part of my hosts file:
# Additionally, comments (such as these) may be inserted
on individual
# lines or following the machine name denoted by a "#"
symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
#
127.0.0.1 localhost
You can remove the rest without it causing any problems
5) Reboot the computer in Normal Mode and run HiJackThis
again to test (Wintools should be gone)
If you are unsure of anything or cannot find any of these
registry values then its possible a different Adware
called Bubba.Wintools But this is the hardest to remove
out of them all so i assume it is this but like i say if
you are unsure just repost and i will help where i can.
Good Luck Mate Andy
Go to the custom box enter 1.5 the times of