[bamakodaker]

Hello,

Is there a way to determine the type of bug one has? Think Point - I don't see it addressed here yet. I was going to help someone who was infected by it but I don't find anything about it here yet. I just wondered if there were generic categories these might fall in. As in all redirects could be dealt with this way . .

Think Point really takes over. She says Win 98 computer keeps going into Safe Mode. I'll check Geeks in morning before I go over there but at this point I'm hoping the scan from SUPERAntiSpyware.com will provide what I need.

Thanks for any info.
bamakodaker

[Advertisements]

Probably not going to be in time but I found a site
http://www.2-viruses...move-thinkpoint

that claims it's two files:

%UserProfile%\Application Data\hotfix.exe
%UserProfile%\Application Data\thinkpoint.exe


The tricky part is it is run by the shell value in HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon. This should normally be: explorer.exe

It also has an entry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run which runs thinkpoint.exe

Windows won't mind if you delete thinkpoint.exe. Probably an error message after logon but if you delete hotfix.exe you probably won't have a desktop.

Since it's win98 this should be easy to fix. Boot into DOS (Edit \autoexec.bat and put a REM or # in front of win then save and reboot. To get back into windows just type win and you should be able to edit autoexec.bat again.)
and then locate the two files and then copy the explorer.exe onto them.

cd %UserProfile%\Application Data
dir
(make sure you see the bad guys)
copy \windows\explorer.exe hotfix.exe
copy \windows\explorer.exe thinkpoint.exe

I would think Hijackthis should see and let you fix fix both registry entries but you may need to find an older version to get it to work with 98.

Ron

[RKinner]

Probably not going to be in time but I found a site
http://www.2-viruses...move-thinkpoint

that claims it's two files:

%UserProfile%\Application Data\hotfix.exe
%UserProfile%\Application Data\thinkpoint.exe


The tricky part is it is run by the shell value in HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon. This should normally be: explorer.exe

It also has an entry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run which runs thinkpoint.exe

Windows won't mind if you delete thinkpoint.exe. Probably an error message after logon but if you delete hotfix.exe you probably won't have a desktop.

Since it's win98 this should be easy to fix. Boot into DOS (Edit \autoexec.bat and put a REM or # in front of win then save and reboot. To get back into windows just type win and you should be able to edit autoexec.bat again.)
and then locate the two files and then copy the explorer.exe onto them.

cd %UserProfile%\Application Data
dir
(make sure you see the bad guys)
copy \windows\explorer.exe hotfix.exe
copy \windows\explorer.exe thinkpoint.exe

I would think Hijackthis should see and let you fix fix both registry entries but you may need to find an older version to get it to work with 98.

Ron