Please help me remove ThinkPoint!

My computer couldn't open RKill - it calls it a screensaver? I am not sure what to do to open. I give it permission to run, but then nothing happens.

Below are the results from the Malwarebytes scan. It says no viruses were found, but I'm sure there is still something wrong. My computer is running very slowly.

I also tried to delete some symantec files, and the computer froze.

Not sure what to do...

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Database version: 5348

Windows 6.0.6000
Internet Explorer 7.0.6000.17037

12/18/2010 12:49:18 PM
mbam-log-2010-12-18 (12-49-18).txt

Scan type: Quick scan
Objects scanned: 147359
Time elapsed: 22 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Hi hsdoyle,

but I'm sure there is still something wrong. My computer is running very slowly.

Do you still have any of the symptoms of ThinkPoint?

ESET online scannner

• Please go Here then click on:
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:

• Scan for potentially unwanted applications
  
• Scan for potentially unsafe applications
• Enable Anti-Stealth Technology


• Now click on:
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on:
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6415
# api_version=3.0.2
# EOSSerial=0c89d25f327f564e953cdaa43392ca9a
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-12-19 01:16:09
# local_time=2010-12-18 08:16:09 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=258 16776894 0 4 0 9519288 0 0
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=2560 16777191 100 0 0 0 0 0
# compatibility_mode=5892 16776574 100 95 107196936 129313124 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=179194
# found=2
# cleaned=0
# scan_time=15777
C:\ProgramData\AOL Downloads\triton_suite_install\6.1.41.2\setup.exe probably a variant of Win32/Agent.HZHBURL trojan (unable to clean) 00000000000000000000000000000000 I
C:\Users\All Users\AOL Downloads\triton_suite_install\6.1.41.2\setup.exe probably a variant of Win32/Agent.HZHBURL trojan (unable to clean) 00000000000000000000000000000000 I

Hi hsdoyle,

Run OTL Script

• Double-click OTL.exe to start the program.
• Copy and Paste the following code into the textbox. Do not include the word Code
  

  
  
  :reg
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
  
  "AutoUpdateDisableNotify" = 0
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
  
  "DisableMonitoring" = 0
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
  
  "DisableMonitoring" = 0
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
  
  "DisableMonitoring" = 0
  
  :files
  
  C:\ProgramData\AOL Downloads\triton_suite_install\6.1.41.2\setup.exe
  
  C:\Users\All Users\AOL Downloads\triton_suite_install\6.1.41.2\setup.exe
  
  :commands
  
  [EMPTYTEMP]
  
  [REBOOT]
  
  

• Then click the Run Fix button at the top.
• Click .
• OTL may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

Please let me know what symptoms (other than slowness) the computer is now showing.

The computer will be slow until we fully remove the second antivirus program. Please let me know the history of the Symantec install, who installed it and when?

Hi deltalima,

I tried to run the OTL scan, but each time I clicked 'Run Fix' the program froze. I tried to restart the computer and do it again, but it happened again - the program 'Not Responding.' :'( Not sure what to do...

The obvious symptoms of the original virus are gone (my desktop disappeared and instead a ThinkPoint image would show up on my screen, until I ran explorer.exe to get it back) - I used internet help sites to delete 'ThinkPoint' and its 'hotfix.exe' components in the places it said it would be. But I couldn't find everything. And I worry now the virus has spread somehow, is it possible it's spread into Symantec? Clearly I'm not computer-proficient, and do not know how viruses work exactly. I had problems completely deleting Norton Antivirus as well, error messages would occur and make it impossible to uninstall.

I downloaded Symantec Antivirus maybe 3 years ago from my university's computer department, and downloaded it again after seeking help from them. They recommended I download Spybot and Symantec and run those scans.

I'm not sure what to do. Does this information give you any idea of what's happening?

There's slowness, and problems with the programs I've been trying to run that you gave me - sometimes they will not download, or errors occur, or they freeze. My internet is working fine it seems. But besides that, there's general slowness and the other issues I mentioned.

Thank you so so much for your help. This is terrible!

Hi hsdoyle,

The obvious symptoms of the original virus are gone

That's good. There are no signs of a current active infection but there are remnants from a previous infection.

I downloaded Symantec Antivirus maybe 3 years ago from my university's computer department, and downloaded it again after seeking help from them. They recommended I download Spybot and Symantec and run those scans.

The symptoms you currently have are all consistent with an incompatibility between the two antivirus programs that are installed, we really do need to fully remove Symantec before we continue.

Do you still have access to the University IT department who may be able to help with the removal?

If not, do you have the resources necessary to reformat the computer and reinstall Windows afresh?

Hi Deltalima,

The university's IT department is on holiday now, but I could try contacting them by email. What would it require to reformat the computer, and then reinstall Windows?

I will use this website to help me uninstall Symantec: http://www.symantec.com/business/suppor ... cale=en_US.

Also, why did the OTL scan not work? It seemed to have picked up on some possible malware.

Thank you!

Hi hsdoyle,

What would it require to reformat the computer, and then reinstall Windows?

On most modern computers there is an option at start up to return the computer to the state it was when it shipped from the factory, if not then you would need the original Windows Vista CD

I will use this website to help me uninstall Symantec: http://www.symantec.com/business/suppor ... cale=en_US

That is quite a long complicated procedure but if you follow it and remove Symantec that would be great. Let me know any problems that you run into.

Also, why did the OTL scan not work?

It's hard to tell, we need to eliminate the second antivirus program and try again, if it still fails we need to investigate further.

Please let me know how the Symantec removal goes and then we will continue the cleanup with OTL.

Hey Deltalima,

I started working on deleting symantec from the registry, doing what they recommend, and it was very difficult and took too much time. I think I may bring my computer into a computer store soon. What are your thoughts?

Thank you so much!

Hi hsdoyle,

I started working on deleting symantec from the registry, doing what they recommend, and it was very difficult and took too much time.

It is a very long and complex process.

I think I may bring my computer into a computer store soon. What are your thoughts?

Realistically, considering that the Windows version you have is now unsupported by Microsoft (Vista needs to be updated to Service Pack 2) and that Symantec is proving difficult to remove then the quickest way to resolve the problems would be to take the computer to a store and have then reinstall Windows.

If you do then please make sure that you backup all your data to removable media so that you can restore to the repaired computer and then install one antivirus program once the computer is fixed.

If you have any questions then please ask.

As it appears this issue will be resolved by other means, this topic is now closed.

You can help support this site from this link :
Donations For Malware Removal