These files are apparently part of WinTools a homepage hijacker etc. Also possibly installed - wtoolsb.exe, wtoolss.exe and wtoolsb.dll. Check for each of these processes running on the system and kill them all - if TSKIll (or task manager) fails then try SuperKil (on the download page of thethin). Once the processes have all been stopped, Check add/remove for WinTools and if there remove it, then double check the files are gone and if not then delete the executables. -----Original Message----- From: John Arena [mailto:arena.ihs@xxxxxxx] Sent: 24 September 2004 11:50 To: thin@xxxxxxxxxxxxx Subject: [THIN] Wtoolsa.exe Wsup.exe these processes are killing my terminal server. I have tried a few spam removal tools and disabled the services and the still load up any suggestions. ******************************************************** This Weeks Sponsor RTO Software Do you know which applications are abusing your CPU and memory? Would you like to learn? -- Free for a limited time! Get the RTO Performance Analyzer to quickly learn the applications, users, and time of day possible problems exist. http://www.rtosoft.com/enter.asp?id=320 ********************************************************** Useful Thin Client Computing Links are available at: http://thin.net/links.cfm *********************************************************** For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode use the below link: http://thin.net/citrixlist.cfm ******************************************************** This Weeks Sponsor RTO Software Do you know which applications are abusing your CPU and memory? Would you like to learn? -- Free for a limited time! Get the RTO Performance Analyzer to quickly learn the applications, users, and time of day possible problems exist. http://www.rtosoft.com/enter.asp?id=320 ********************************************************** Useful Thin Client Computing Links are available at: http://thin.net/links.cfm *********************************************************** For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode use the below link: http://thin.net/citrixlist.cfm