Thinkpoint virus

Forums › Microsoft Windows › Thinkpoint virus

kewefella

36 posts

Geek

#73326 11-Dec-2010 20:58

Hi

Have a customers computer I'm trying to fix. It has the thinkpoint virus which I have managed to remove. Only problem left now is to get it to allow certain exe's to run. At the moment things like firefox, word etc work fine but their McAfee, Adaware and task manager won't.

If I use the system restore to return the pc to a point before it was infected(assuming there is one) will it change these exe's to allow them to run again or is there something I have missed or able to do other than this. I would hate to restore it and be back where I started with a reinfected pc.

The main problem is the pc is still at their house so when I return I want to be prepared for all outcomes.

Thanks

heretohelp

360 posts

Ultimate Geek

#418213 16-Dec-2010 18:45

This virus is going around i have fixed a couple of computer now with that on well 3. the first = easy. logged into admin account from safe mode removed hotfix.exe (this is the main part of the virus) then proceded to clean out th emain account.

number 2 wouldnt let me load to choose the accounts just poped right up b4 i had a chance. Had to boot to command prompt only, remove the hotfix.exe then load the explorer shell continue to proceeed.the clean out process requried windows repair after this as well

the third on ei cleaned out today. ended up facotry renewing it had been on the pc for a frigen long time + mulitple other bits of crap. adwarealeart, registry cleaners im talkin the works. oh yea and they hadnt had an uptodate antiviurs for 3 years.

To me it sounds like you havent got it all out. this virus infects the master boot record, so a fix mbr is required b4 and after you clean it out.

personally wouldnt use Adaware or mcafee,
What other tools did you use sounds like you left somthing behined somthin still starting up thats killing the taskmanager. There is a registry fix out there to sort that if it is just the after effects of think point.

as for mcafee flag that crap and if they want free go avast.

I woudl personally turn the system restore off as its only infected anyway.

really need to know what method you used to clean this, I know from personal experince its dam nasty, if you dont get everything your had it, if you have then its just a mater of fixing the parts of windows that are scrwd.

Personally wouldnt of left them with a machine thats not working as if it is still infected the more they use it the worse its going to become,

All just my opinion of corse.

Hu? did i do that?
16Mb (EDO RAM), K6-II processor, 2Mb of onboard graphics. 32k dial up modem. 12 speed CD ROM. 5¼-inch floppy drive. 500Mb HDD.

heretohelp

360 posts

Ultimate Geek

#418215 16-Dec-2010 18:47

http://www.kellys-korner-xp.com/xp_tweaks.htm this is the task manager tweak. run it then reboot should enable the task manager again, asuming you are fixing an xp machine

Hu? did i do that?
16Mb (EDO RAM), K6-II processor, 2Mb of onboard graphics. 32k dial up modem. 12 speed CD ROM. 5¼-inch floppy drive. 500Mb HDD.

animebuster

86 posts

Master Geek

#418324 17-Dec-2010 05:17

I just recently fixed a friends laptop that had this virus on it. I just Used my Eset system rescue boot disc to clean most of the viruses off (the laptop had 76 Viruses XD mainly trojans etc) Then I logged into his account (Hotfix.exe tried to run again showing a fake scan) Ended hotfix.exe from taskmanager (Task manager got re enabled after running my eset boot disc which deleted the main viruses) and started explorer.exe from taskmanager as hotfix.exe had ended it. I then Proceeded to delete hotfix.exe and any other left over files. Thinkpoint was a bit of a pain at first though as It had blocked access to everything... Thats why I ended up being lazy and using the boot disc XD A good anti virus boot disc solves all problems :D

kewefella

36 posts

Geek

#418669 17-Dec-2010 21:56

Cheers for the info, got it all sorted, missed the RKill step which knocked out the last of the virus, plus found a couple of other trojans, after that the virus scanner fired up and all things started to work again.