Removing Bubba.Wintools
If Bazooka Scanner reports a system is
infected with Bubba.wintools, which may be a variant of
Hotbar,
you can remove it by following instructions Kephyr provides at
http://www.kephyr.com/spywarescanner/library/bubba.wintools or by
following the instructions below. If you see
a WinTools entry under "Add/Remove Programs" (Start, Settings,
Control Panel, Add/Remove Programs), you can remove it that
way. If you don't see any entry for Wintools under "Add/Remove Programs"
or you prefer not to use the Wintools vendor's uninstall routine, you can
remove it by the following steps:
-
Download Bubba-WinTools-removal.reg and
wintools-delete-files.bat.
-
Start your computer in
Safe Mode.
- Double-click on the Bubba-Wintools-removal file you downloaded to
remove the Bubba.Wintools entries in the registry.
When asked "Are you sure you want to add the information in BUBBA~1.REG to the
registry?", click on "Yes". You will then see "Information in BUBBA~1.REG has
been successfully entered into the registry." Click on OK
The following registry enries, if found, will be deleted:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinTools
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87766247-311C-43B4-8499-3D5FEC94A183}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{87766247-311C-43B4-8499-3D5FEC94A183}
- Restart your computer.
-
Double-click on the wintools-delete-files batch file you downloaded to delete the files
associated with Bubba.Wintools.
The following files, if found, will be deleted:
%ProgramFiles%\Common files\WinTools\WToolsA.exe
%ProgramFiles%\Common files\WinTools\WSup.exe
%ProgramFiles%\Common files\WinTools\WToolsS.exe
%ProgramFiles%\Common files\WinTools\WToolsB.dll
Note: %ProgramFiles% is a
variable. By default, this is C:\Program Files.
Below is an example of what you might find in a system's registry under
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinTools, if the system is
infected with Bubba.Wintools.
[ Home ]