Remove Thinkpoint Virus – Removal Security Microsoft Windows
In few days, computer user at US attack from fake ThinkPoint anti-spyware application. What is Thinkpoint ?. ThinkPoint virus masquerades as a legitimate security product from Microsoft called Microsoft Security Essentials. Once installed on your computer, it will list numerous problems and claim that you should fix them immediately.
ThinkPoint associated files and registry values. ThinkPoint will state that you need a heuristic program to fix the problems and it even offers to sell one for $99.90. Please don’t purchase Think Point. This program is fake. It won’t fix your computer because there actually are no problems except the ThinkPoint itself. If you are reading this article then you probably got infected with this malware.
ThinkPoint removal instructions:
1. Restart your computer. Once the ThinkPoint window comes press Ctrl+Alt+Delete or Ctrl+Shift+Escape. You should now see the Windows Task Manager screen as shown in the image below.
Click on the Processes tab. Then click and highlight hotfix.exe and click End Task. If it asks you “Are you sure you want to terminate the process?” click yes. This will close the ThinkPoint program.
2. While in Windows Task Manager, click the File -> “New Task (Run…)” button on the bottom right. Type in explorer.exe and click OK. Your desktop and icons should start up as normal.
NOTE: if you got an error message “Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access them”, then please run this command first:
cacls “C:\Windows\explorer.exe” /G Everyone:F
A new windows will come up asking “Are you sure?” Type Y and press enter.
Now run explorer.exe again.
3. Download the following file to your Desktop: windows-shell.reg. Double-click to run it. Click “Yes” when it asks if you want to add the information to the registry. This file will fix the Windows Shell entry. This step is important because if you won’t fix this entry, then your Windows Desktop will not be displayed the next time you reboot. Once the new registry value has been added, you can delete the file from your computer.
4. Run Internet Explorer or any other browser and download free anti-malware software from the list below:
Run a full system scan and remove ThinkPoint from your computer.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator.
5. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET Smart Security.
ThinkPoint associated files and registry values:
For Windows XP users:
- C:\Documents and Settings\[User Name]\Application Data\hotfix.exe
- C:\Documents and Settings\[User Name]\Application Data\[SET OF RANDOM CHARACTERS].bat
For Windows Vista and Windows 7 users:
- C:\Users\[User Name]\AppData\Roaming\hotfix.exe
- C:\Users\[User Name]\AppData\Roaming\[SET OF RANDOM CHARACTERS].bat
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = “0″
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnOnPostRedirect” = “0″
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell” = “%AppData%\hotfix.exe”