ThinkPoint Removal Help

Good. If no issues left, it's time to secure your system to prevent against further intrusions.


THESE STEPS ARE VERY IMPORTANT

Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis


Now lets uninstall ComboFix:
  • Click START then RUN
  • Now copy-paste Combofix /uninstall in the runbox and click OK


  • Double-click OTL.exe.
  • Click the CleanUp! button.
  • Select Yes when the
    Begin cleanup Process?
    prompt appears.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes, if not delete it by yourself.

Note: If you receive a warning from your firewall or other security programs regarding OTL attempting to contact the internet, please allow it to do so.


UPDATING WINDOWS AND INTERNET EXPLORER

IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.


Make your Internet Explorer more secure

This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.



The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.

  • Download and run Secunia Personal Software Inspector (PSI) and fix its findings.
  • Get Anti Virus Software and keep it updated - Most AVs will update automatically, but if not I would recommend making updating the AV the first job every time the PC is connected to the internet. An AV that is using defs that are seven days old is not going to be much protection. If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out. Good free antivirus programs are:
    Antivir
    Avast!
    Good commercial ones are from:
    Kaspersky and
    ESET
  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For more info, check this webpage out.
    If you don't have a 3rd party firewall or a router behind NAT then I recommend getting one. I recommend either Online Armor Free or Comodo Firewall Pro (If you choose Comodo: Uncheck during installation Install Comodo HopSurf.., Make Comodo my default search provider and Make Comodo Search my homepage and install firewall ONLY!). Both providers have support forums that help with configuration related questions.


Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.


Once again, please post and tell me how things are going with your system... problems etc.

Have a great day,
Blade :cool:
 
System Restore and Spybot

When I tried to turn off my system restore, the box to turn it on and off is completely gray. When I click it nothing happens.

Also, I have spybot installed an used teatimer for virus and spyware. Should I discontinue using this and use what you have listed?
 
Boot

Also, my computer has never booted up like this but I just realized it because the screen is up for 3 seconds. When Windows is about to load up it gives me 3 options and here is the log for it.

[boot loader]
timeout=3
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptOut
 
Hi,

When I tried to turn off my system restore, the box to turn it on and off is completely gray. When I click it nothing happens.
Click to expand...
Could you post a screenshot of that, please?

Also, I have spybot installed an used teatimer for virus and spyware. Should I discontinue using this and use what you have listed?
Click to expand...
You can still continue using Spybot. It's antispyware tool, not antivirus program, though. That's why you need to get antivirus program too.

Also, my computer has never booted up like this but I just realized it because the screen is up for 3 seconds. When Windows is about to load up it gives me 3 options and here is the log for it.
Click to expand...
Yep, recovery console was installed by ComboFix (before it got jammed). It's recommended you leave recovery console installed there.
 
Screenshot of System Restore

I know how to take a screenshot of the image but could not figure out how to paste it in the message section so I saved it and attached it to this reply. Let me know if there is a way I can paste it if necessary.
 
Hi,

1. Click Start, Run and type gpedit.msc

2. Navigate to this path:
-> Computer Configuration
--> Administrative Templates
---> System
----> System Restore

3. Set Turn off System Restore to Not Configured.

4. Set Turn off Configuration to Not Configured.

Open system restore tab in system properties. Is that check box still in the same state?
 
Let's try this:
1. In My Computer, click the Tools menu -> Folder Options.
2. On the View tab, make sure to check the option "Hide extensions for known file types".
3. Click OK.
4. Click the Start menu -> Run. Type: " %windir%\inf " (Without quotation
marks) in the Open field. Click OK.
5. Locate and select the file " sr.inf ". Right-click it and then click Install.
 
Screenshot of SN.INF file

I was unsuccessful trying to install the sn.inf file. It asked me to put in the Windows XP Service Pack 3 disk. I save a screen shot and have attached it for you.
 
Hi,

As prompt says, you need XP Professional cd for that.
 
Windows XP

Does it matter what Windows XP service pack I get? It looks like I could cut cost by buying a Windows XP Service pack 1 or 2.
 
Hi,

Needed sr.sys file can be get by downloading service pack 3, extracting sr.sy_ and expanding it to sr.sys. To shorten the task, I've attached the file in this post. Please download it, extract to your desktop and place extracted sr.sys file into c:\windows\system32 folder. Then try to run sr.inf again as instructed in previous post.
 
Zip File

I saved the file and extracted and moved it to the system32 folder. It still asked me for a installation disk. Any other ideas?
 
That probably leaves no other option than get hands on proper XP Professional cd then.
 
Some Success

So I tried the install again. I realized it was asking me for where the file is at. It continued the install but got stopped again with a different file. I don't mean to be a pain in your butt, but do you think there is a way to find this file as well?
 
Hi,

Open notepad and then copy and paste the bolded lines below into it. Go to File > save as and name the file fixes.bat, change the Save as type to all files and save it to your desktop.
@ECHO OFF
dir /s/a c:\filelist.xml >Log.txt
dir /s/a c:\filelist.xm_ >>Log.txt
START Log.txt
DEL %0

Double-click on fixes.bat file to execute it. Notepad should open up. Post back its contents, please.

Also, please download earlier mentioned service pack 3 to your desktop but don't run it.
 
Log

Downloaded Service Pack 3 and here is the log from the fix

Volume in drive C has no label.
Volume Serial Number is 74AE-B903

Directory of c:\WINDOWS\system32\Restore

04/14/2008 06:00 AM 19,569 filelist.xml
1 File(s) 19,569 bytes

Total Files Listed:
1 File(s) 19,569 bytes
0 Dir(s) 49,461,993,472 bytes free
Volume in drive C has no label.
Volume Serial Number is 74AE-B903
 
Hi,

Download and install IZArc here. Don't install any toolbars or other bundled stuff if offered.

When installed, start IZArc and then:
1. Click File->Open archive.
2. In Open archive dialog browse to downloaded service pack 3 file and double click it. Treeview should open with i386 folder there.
3. Click Extract icon and select suitable folder (for example c:\sp3files).
4. Let options checkboxes be with their default values and click Extract button.
5. Wait until extracting is finished.

After that you should have service pack 3 files in i386 subfolder of above chosen location (in this example c:\sp3files). When you try sr.inf install again and it asks for file location you should be able to point to that i386 folder.
 
Fixed The Issue!!!!!!!!!!!!!!!!!

So I followed all of your instructions for placing the i386 folder in an sp3files folder. I went through the installation but I got an error message again. However, I went through windows/system32 to find the spframe file and the installation worked. That still did not fix the issue. I went back and changed the "Not Configured" system restore options to enabled and then back to not configured and I was able to access the system restore. I turned it off and then back on. Before I moved on to uninstalling combofix I wanted to make sure I did not need to take any additional steps.

Thanks :bigthumb:
 
You must log in or register to reply here.
Back
Top