Removing Bubba.Wintools

If Bazooka Scanner reports a system is infected with Bubba.wintools, which may be a variant of Hotbar, you can remove it by following instructions Kephyr provides at http://www.kephyr.com/spywarescanner/library/bubba.wintools or by following the instructions below. If you see a WinTools entry under "Add/Remove Programs" (Start, Settings, Control Panel, Add/Remove Programs), you can remove it that way. If you don't see any entry for Wintools under "Add/Remove Programs" or you prefer not to use the Wintools vendor's uninstall routine, you can remove it by the following steps:

  1. Download Bubba-WinTools-removal.reg and wintools-delete-files.bat.
  2. Start your computer in Safe Mode.
  3. Double-click on the Bubba-Wintools-removal file you downloaded to remove the Bubba.Wintools entries in the registry. When asked "Are you sure you want to add the information in BUBBA~1.REG to the registry?", click on "Yes". You will then see "Information in BUBBA~1.REG has been successfully entered into the registry." Click on OK

    The following registry enries, if found, will be deleted:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinTools
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87766247-311C-43B4-8499-3D5FEC94A183}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87766247-311C-43B4-8499-3D5FEC94A183}

  4. Restart your computer.
  5. Double-click on the wintools-delete-files batch file you downloaded to delete the files associated with Bubba.Wintools.
    The following files, if found, will be deleted:

    %ProgramFiles%\Common files\WinTools\WToolsA.exe
    %ProgramFiles%\Common files\WinTools\WSup.exe
    %ProgramFiles%\Common files\WinTools\WToolsS.exe
    %ProgramFiles%\Common files\WinTools\WToolsB.dll

    Note: %ProgramFiles% is a variable. By default, this is C:\Program Files.

Below is an example of what you might find in a system's registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinTools, if the system is infected with Bubba.Wintools.

A 'Run' Registry entry for Bubba.Wintools

[ Home ]