ThinkPoint is a rogue (fake) antivirus program that is distributed through the use of Microsoft Security Essentials Alert trojan. Important to know, the program is unable to detect or rid your system of parasites nor will be protect you from legitimate future threats. You need to remove ThinkPoint from your computer as quickly as possible!
When started, this malware configures itself to start automatically every time, when your computer loads. Immediately after launch, ThinkPoint starts scanning your computer and list a lot of infections to trick you into thinking your PC in danger. It will report that was able to clean the majority of infected files, but was not able to cure a few important Windows files, such as firefox.exe, taskmgr.exe, iexplore.exe and offer to purchase its full version to clean them. However, the scan results is a scam, because the program can`t detect any infections. So, you may easily ignore all that ThinkPoint will display you.
What is more, while ThinkPoint is running, it will hide your desktop, Start button and Windows taskbar. Moreover, the rogue will also block Windows Task Manager. When you try to run it, this malware will display a security alert that states:
The application taskmgr.exe was launched successfully but it was forced to shut down due to security reasons.
This happened because the application was infected by a malicious program which might pose a threat for the OS.
It is highly recommended to install the necessary heuristic module and perform a full scan of your computer to exterminate malicious programs from it.
As you can see, ThinkPoint is a totally scam, which created with one purpose to scare you into purchasing so-called “full” version of the program. Most important do not purchase it! Please use the removal guide below in order to remove ThinkPoint and any associated malware from your computer for free.
More screen shoots of ThinkPoint
Use the following instructions to remove ThinkPoint
Step 1. Stop ThinkPoint process
Once Windows loaded you will see a window similar to the one below.
Now press CTRL + ALT + DEL. It will open Windows Task manager. Select hotfix.exe process as shown in the screen below.
Click “End Process” button. It will close ThinkPoint.
Now click File, New Task. Type explorer and press Enter. It will back the Start button and task bar.
Step 2. Remove ThinkPoint associated malware
Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.
Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded you will see window similar to the one below.
Malwarebytes Anti-Malware Window
Select Perform Quick Scan, then click Scan, it will start scanning your computer for ThinkPoint infection. This procedure can take some time, so please be patient.
When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.
Malwarebytes Anti-malware, list of infected items
Make sure all entries have a checkmark at their far left and click “Remove Selected” button to remove ThinkPoint. MalwareBytes Anti-malware will now remove all of associated ThinkPoint files and registry keys and add them to the programs’ quarantine. When MalwareBytes Anti-malware has finished removing the infection, a log will open in Notepad and you may be prompted to Restart.
ThinkPoint removal notes
Note 1: if you can not download, install, run or update Malwarebytes Anti-malware, then follow the steps: Malwarebytes won`t install, run or update – How to fix it.
Note 2: if you need help with the instructions, then post your questions in our Spyware Removal forum.
Note 3: your current antispyware and antivirus software let the infection through ? Then you may want to consider purchasing the FULL version of MalwareBytes Anti-malware to protect your computer in the future.
ThinkPoint creates the following files and folders
%AppData%\hotfix.exe
%AppData%\{RANDOM}.bat
ThinkPoint creates the following registry keys and values
HKEY_CURRENT_USER\Software\PAV
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings | “WarnonBadCertRecving” = “0”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings | “WarnOnPostRedirect” = “0”
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon | “Shell” = “%AppData%\hotfix.exe”
I performed the quick scan, 4 items were detected but when I restarted my comp, thinkpoint was still there 🙁 is there anything I can do? It’s so annoying!!!
i dont have this thing but that video is wery helpful than who is not watched try to watch and try to remove this beast s
DId not work
this worked great but after i went to the process and restarted my computer the think point icon still shows on my desktop? does this mean its still infected?
Erik, probably your computer is infected with a new/updated version of this malware. Start a new topic in our Spyware removal forum. I will help you to remove the rogue.
Tom, ask for help in our Spyware removal forum.
so I’ve downloaded this software put it on a usb and then tried to load it on the infected computer. A long error dialog box popped up refusing me access.
let me add, thinkquest is denying me access to fire fox, task manager and internet explorer. unable to d/l from that computer.
not sure if the disc option still works.
also believe there is other malware/spyware on computer.
Followed your instructions but PC Tools Spyware Doctor downloaded — NOT Malwarebytes even though I typed that in the address bar. What happened.
MR
Brilliant! I knew this thing was a virus the moment it popped up, but there was nothing I could do to shut it down. Thank you for the web site and the step by step explanation. You guys rock!
Hi Patrik! Any idea on how to fix my issue?? I posted my scenario a couple of days ago. Thank you so much for your assistance!!
oy i fixed this a week ago then today it just pops back up. how do i permantley get rid of it?
oh oh oh godddddd you fucker thank you very muchhhhhhhhhhhhhhh
OMG! Thank you so much! Your tutorial was so clear that a fifteen year old could follow it! I am fiftenen btw!
I need help removing UCD.exe off of my computer. When I run a search for it and delete it, and the .pf file that accompanies it, the file only comes back another 30 minutes or so later. There must be another file the reinstalls ucd.exe. This virus eats up processor capacity and seems to download or open ads–often in the form audio files.
The reason I bring this up here is that it infected my computer at the same time or perhaps due to a Thinkpoint infection–one which I have removed. But UCD.exe seems to be a lasting side effect. Thank you very much for all the help already, and thank you even more if you can help me remove this annoying bit of malware permanently. Norton identifies but can’t remove it and SpywareDoctor crashes when I try to run a file scan.
Thank you, by the looks of everyone’s comments, this has been a great help.
it stil didnt work? i ran the program like you said for me to do then i deleted the infected viruses, but i restarted the computer and it still started with thinkpoint?
Thank you for sharing the fix.
CC and Jane, probably your PC also infected with a trojan that reinstalls the rogue. Start a new topic in our Spyware removal forum. I will help you.
Alex, you don`t need to purchase anything. Try update Malwarebytes and perform a fresh scan.
Anonymous, stop hotfix.exe process, run explorer.exe, scan with Malwarebytes. Once completed, scan your computer with Kaspersky virus removal tool.
Do u not know that thinkpoint disables task manager it says it was not allowed to open task manager even before i hit safe startup please help can i dl the file thorugh usb then find it on my computer please helpp
1. boot your computer in Safe mode with command prompt.
2. Once Windows loaded, you will see a black window – command prompt.
3. Type
cd %APPDATA%
Press Enter.
4. Type
del hotfix.exe
Press Enter.
5. Reboot computer.
6. Once Windows loaded, download Malwarebytes and perform a scan.
I FINALLY READ THAT JUST AFTER I DEL HOTFIX.EXE IT BOOTED NORMAL THEN I DOWNLOADED MALWARE N THEN IT WORKED. DELETED 17 NOT JUST THE 3 OR 4 TY SOO MUCH IN A MATTER OF MINS AFTER DAYS OF TRYING…
I’m having the same problem as Jane. I took Think Point off my computer and even went to the control panel and deleted it from my computer however each time I restart my computer, it keeps coming back. I dont know how to open a new topic in the Spyware Removal Forum so I was hoping you could post instructions on how to permanently delete this on here.
Omgosh! you are my hero! i thought i was going to have to reset to factory thank you SOSOSOSOSOSOSOSOSOOOOOOOOOOOO much! i would have lost SO much important info on my pc!!
This was a quick and easy fix. Thank you very much for posting it.
It worked guys…, I was unable to start the Task manager even after CTRL + ALT + DEL therefor loged in to the PC with an another administrative usser account to delete the hotfix.exe and install your Malwarebytes Anti-malware It’s so simple no need to call an expert.
works perfectly. thanks
This information was very well documented. I would like to point out that after reading several posts elsewhere that if you remove the files and the registry entries then you do not need to run any anti-spyware tools unless you want too. Removing the registryu entries and the files located in the application data directory removes the entire thinkpoint. Thanks for posting this. Great Job!
I went to task manager and tried to end hotfix, but nothing happens and task manager freezes. What else can I do?