winmail.dat

[Guest]

-----Original Message-----
hi,

we recently upgraded some of our users to office 2003.
since then, some of their mail recepients are recieving
an attachment of winmail.dat. in researching the problem
we have changed format of the outgoing msg from html to
plain text, yet this attachment still appears. the
recepient is able to read the msg, but is constantly
prompted to open the winmail.dat file.

is there anyway to resolve this?
thanks!
Jen

I found this information at pchell.com:

Wintools Removal Instructions and Help


What is WinTools?
WinTools appears to be a variant of Huntbar. It is very
persistent and extremely difficult to remove. It creates
its own folder under Program Files/Common Files called
WinTools. All of its files appear to be contained within
this folder.

How do I Remove WinTools?

Although there are many different methods across the web
to remove this parasite, here is the most reliable way of
doing this.

1) While online, download the popular HiJackThis program
for Spywareinfo.com. You may want to read through the
HiJackThis tutorial as well.

2) Reboot your computer into Safe Mode, you may want to
also Turn off System Restore in Windows XP/ME as well to
remove any backups of the files you are about to delete.

3) Remove the Startup Entries in the Registry

Click on Start, Run, Type REGEDIT and Click OK

Click the pluses(+) next to the following items
HKEY_LOCAL_MACHINE
Software
Microsoft
Windows
CurrentVersion
Run

Right-Click on the file WinTools and click DELETE

Click the pluses(+) next to the following items
HKEY_LOCAL_MACHINE
Software
Microsoft
Windows
CurrentVersion
RunServices

Right-Click on the file WinTools and click DELETE

Close REGEDIT
3) Run HiJackThis (while in Safe Mode) and Delete any
entries relating to WinTools including

O2 - BHO: (no name) - {87766247-311C-43B4-8499-
3D5FEC94A183}- C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-
C581AC420D41} - C:\PROGRA~1\COMMON~1\WINTOOLS\BTIEIN.DLL

Although the following entries should have been deleted in
Step 2, delete these entries if they still exist.

O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common
files\WinTools\WToolsA.exe
O4 - HKLM\..\RunServices: [WinTools] C:\Program
Files\Common files\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common
files\WinTools\WToolsS.exe
O4 - HKLM\..\RunServices: [WinTools] C:\Program
Files\Common files\WinTools\WToolsS.exe
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common
files\WinTools\WSup.exe
O4 - HKLM\..\RunServices: [WinTools] C:\Program
Files\Common files\WinTools\WSup.exe

3) Delete the WinTools folder and all associated files

Open My Computer, Drive C, Program Files, Common Files
Right-click on the WinTools folder (if it exists) and
Delete it
4) You should also delete or clean up your hosts file

Windows 95/98/Me c:\windows\hosts
Windows NT/2000/XP Pro c:\winnt\system32
\drivers\etc\hosts
Windows XP Home c:\windows\system32\drivers\etc\hosts


5) Reboot the computer in Normal Mode and run HiJackThis
again to test (Wintools should be gone)

 

[Lanwench [MVP - Exchange]]

I found this information at pchell.com:

What leads you to believe this is a spyware/malware issue?

Note that HijackThis is a useful tool, but can be *very* dangerous if people
don't know what they're doing in their registry. I don't recommend it unless
no other utility (Spybot, AdAware, CWShredder) will work.

And I don't believe this will apply to the OP's question/problem anyway....

Wintools Removal Instructions and Help


What is WinTools?
WinTools appears to be a variant of Huntbar. It is very
persistent and extremely difficult to remove. It creates
its own folder under Program Files/Common Files called
WinTools. All of its files appear to be contained within
this folder.

How do I Remove WinTools?

Although there are many different methods across the web
to remove this parasite, here is the most reliable way of
doing this.

1) While online, download the popular HiJackThis program
for Spywareinfo.com. You may want to read through the
HiJackThis tutorial as well.

2) Reboot your computer into Safe Mode, you may want to
also Turn off System Restore in Windows XP/ME as well to
remove any backups of the files you are about to delete.

3) Remove the Startup Entries in the Registry

Click on Start, Run, Type REGEDIT and Click OK

Click the pluses(+) next to the following items
HKEY_LOCAL_MACHINE
Software
Microsoft
Windows
CurrentVersion
Run

Right-Click on the file WinTools and click DELETE

Click the pluses(+) next to the following items
HKEY_LOCAL_MACHINE
Software
Microsoft
Windows
CurrentVersion
RunServices

Right-Click on the file WinTools and click DELETE

Close REGEDIT
3) Run HiJackThis (while in Safe Mode) and Delete any
entries relating to WinTools including

O2 - BHO: (no name) - {87766247-311C-43B4-8499-
3D5FEC94A183}- C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-
C581AC420D41} - C:\PROGRA~1\COMMON~1\WINTOOLS\BTIEIN.DLL

Although the following entries should have been deleted in
Step 2, delete these entries if they still exist.

O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common
files\WinTools\WToolsA.exe
O4 - HKLM\..\RunServices: [WinTools] C:\Program
Files\Common files\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common
files\WinTools\WToolsS.exe
O4 - HKLM\..\RunServices: [WinTools] C:\Program
Files\Common files\WinTools\WToolsS.exe
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common
files\WinTools\WSup.exe
O4 - HKLM\..\RunServices: [WinTools] C:\Program
Files\Common files\WinTools\WSup.exe

3) Delete the WinTools folder and all associated files

Open My Computer, Drive C, Program Files, Common Files
Right-click on the WinTools folder (if it exists) and
Delete it
4) You should also delete or clean up your hosts file

Windows 95/98/Me c:\windows\hosts
Windows NT/2000/XP Pro c:\winnt\system32
\drivers\etc\hosts
Windows XP Home c:\windows\system32\drivers\etc\hosts


5) Reboot the computer in Normal Mode and run HiJackThis
again to test (Wintools should be gone)

.