• Downloads
  • Threats
    • Adware
    • Browser Hijacking
    • Phishing
    • Ransomware
  • Questions and Answers
  • Recover Encrypted Files
  • Free Malware Removal Tools

MyAntiSpyware

Menu
  • Downloads
  • Threats
    • Adware
    • Browser Hijacking
    • Phishing
    • Ransomware
  • Questions and Answers
  • Recover Encrypted Files
  • Free Malware Removal Tools

How to remove ThinkPoint (Uninstall instructions)

Myantispyware team October 18, 2010    

ThinkPoint is a rogue (fake) antivirus program that is distributed through the use of Microsoft Security Essentials Alert trojan. Important to know, the program is unable to detect or rid your system of parasites nor will be protect you from legitimate future threats. You need to remove ThinkPoint from your computer as quickly as possible!

When started, this malware configures itself to start automatically every time, when your computer loads. Immediately after launch, ThinkPoint starts scanning your computer and list a lot of infections to trick you into thinking your PC in danger. It will report that was able to clean the majority of infected files, but was not able to cure a few important Windows files, such as firefox.exe, taskmgr.exe, iexplore.exe and offer to purchase its full version to clean them. However, the scan results is a scam, because the program can`t detect any infections. So, you may easily ignore all that ThinkPoint will display you.

What is more, while ThinkPoint is running, it will hide your desktop, Start button and Windows taskbar. Moreover, the rogue will also block Windows Task Manager. When you try to run it, this malware will display a security alert that states:

The application taskmgr.exe was launched successfully but it was forced to shut down due to security reasons.
This happened because the application was infected by a malicious program which might pose a threat for the OS.
It is highly recommended to install the necessary heuristic module and perform a full scan of your computer to exterminate malicious programs from it.

As you can see, ThinkPoint is a totally scam, which created with one purpose to scare you into purchasing so-called “full” version of the program. Most important do not purchase it! Please use the removal guide below in order to remove ThinkPoint and any associated malware from your computer for free.

More screen shoots of ThinkPoint



Use the following instructions to remove ThinkPoint

Step 1. Stop ThinkPoint process

Once Windows loaded you will see a window similar to the one below.


ThinkPoint screen

Now press CTRL + ALT + DEL. It will open Windows Task manager. Select hotfix.exe process as shown in the screen below.


Windows Task manager

Click “End Process” button. It will close ThinkPoint.

Now click File, New Task. Type explorer and press Enter. It will back the Start button and task bar.

Step 2. Remove ThinkPoint associated malware

Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.

Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

Once the program has loaded you will see window similar to the one below.

malwarebytes-antimalware1
Malwarebytes Anti-Malware Window

Select Perform Quick Scan, then click Scan, it will start scanning your computer for ThinkPoint infection. This procedure can take some time, so please be patient.

When the scan is complete, click OK, then Show Results to view the results. You will see a list of infected items similar as shown below. Note: list of infected items may be different than what is shown in the image below.


Malwarebytes Anti-malware, list of infected items

Make sure all entries have a checkmark at their far left and click “Remove Selected” button to remove ThinkPoint. MalwareBytes Anti-malware will now remove all of associated ThinkPoint files and registry keys and add them to the programs’ quarantine. When MalwareBytes Anti-malware has finished removing the infection, a log will open in Notepad and you may be prompted to Restart.

ThinkPoint removal notes

Note 1: if you can not download, install, run or update Malwarebytes Anti-malware, then follow the steps: Malwarebytes won`t install, run or update – How to fix it.

Note 2: if you need help with the instructions, then post your questions in our Spyware Removal forum.

Note 3: your current antispyware and antivirus software let the infection through ? Then you may want to consider purchasing the FULL version of MalwareBytes Anti-malware to protect your computer in the future.

ThinkPoint creates the following files and folders

%AppData%\hotfix.exe
%AppData%\{RANDOM}.bat

ThinkPoint creates the following registry keys and values

HKEY_CURRENT_USER\Software\PAV
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings | “WarnonBadCertRecving” = “0”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings | “WarnOnPostRedirect” = “0”
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon | “Shell” = “%AppData%\hotfix.exe”

ThinkPoint removal – Video guide

Malware removal Rogue Anti Spyware

 Previous Post

How to remove antispytag.com browser hijacker

Next Post 

Remove antispyway.com hijacker and Antivirus Action malware

Author: Myantispyware team

Myantispyware is an information security website created in 2004. Our content is written in collaboration with Cyber Security specialists, IT experts, under the direction of Patrik Holder and Valeri Tchmych, founders of Myantispyware.com.

348 Comments

  1. Joel
    ― November 1, 2010 - 2:34 pm  Reply

    Even if you stop the process hotfix.exe most will not know how to run anything when the taskbar and desktop icons are missing.

    The horrible English displayed in the program is suspiciously similar to that of the author of this article.

    Just got rid of it on my wife’s laptop. Even if you start in safemode the program will start up and run. Let it run, close it out, then you’ll need to change the permissions of hotfix.exe in the users/xxxxx/appdata folder (win 7). You need to make all its permissions “deny” and then restart the system. Upon restart this file can no longer run. Now you can delete the file, run malwarebytes again, open web browsers etc.

  2. hafiz
    ― November 1, 2010 - 3:11 pm  Reply

    very working for my laptop..i can remove immediately using antispyware..thanks a lot..

  3. PLEASE HELP ME!!!!!!!!!!!
    ― November 1, 2010 - 4:34 pm  Reply

    HELPPP!!!!!!! PLEASE EMAIL ME IF KNOW WHAT I SHOULD DO, THINKPOINT IS STILL THERE!! EVEN THOUGH I SCANNED MY COMPUTER USING MALWARE, BUT THERE WAS AN ERROR DURING THE UPDATE, I THINK MAYBE THAT MAY WHY IT’S NOT WORKING. PLEASE EMAIL ME AT janekate2 AT gmail DOT com

  4. Anthonie
    ― November 1, 2010 - 6:46 pm  Reply

    Hi there, I have doen everything in the manuel and also did the thingy with the shell.reg. and removed all the malware using malwarebytes in the safe mode. Everything workes like a charm except when i try to start my comp. All goes well the Bios and the windows logo screen until the screen which should give me the opportunity to enter my password, but the screen stays black. When i enter pass and press enter i hear windows starting and in like 3 min i see my desktop background, onle nothing else loads and also ctrl+alt+del and everything i press doesnt work.
    Anyone know what to do?

  5. Patrik
    ― November 1, 2010 - 10:06 pm  Reply

    Damon and Jesse, probably your computer is infected with a trojan that reinstalls the rogue. Open a new topic in our Spyware removal forum. I will help you to remove this malware.

  6. Patrik
    ― November 1, 2010 - 10:13 pm  Reply

    Chuckm, ask for help in our Spyware removal forum.

  7. Patrik
    ― November 1, 2010 - 10:16 pm  Reply

    Diana, follow the instructions.

  8. Anthonie
    ― November 2, 2010 - 4:10 am  Reply

    Oh and another thing when i wait for like 10 min in the screen which should give me the opportunity to enter password, there appears the windows logo jumping around, think this is the screensaver here.

  9. Jacey
    ― November 2, 2010 - 10:42 am  Reply

    Thank you so much!!!!!!!!!! This helped tons and tons!

  10. Tisha M
    ― November 2, 2010 - 4:45 pm  Reply

    I want to say THANK YOU THANK YOU THANK YOU, I thought I was doomed with this THINKPOINT GARBAGE but you truly saved the day. You are a GODSEND!!!! THANKS!!!!

  11. sam
    ― November 2, 2010 - 5:33 pm  Reply

    thanks alot!!! this is fantastic!! i fought i had to buy a new pc at 1st!!!

  12. Patrik
    ― November 3, 2010 - 10:28 am  Reply

    Audrey, try the following.
    Once Windows loaded and you see the ThinkPoint screen. Click Safe startup. Wait while this malware loading. Once completed, give it a chance to scan your PC. Once scan is done, click Continue unprotected. Now in ThinkPoint click to Settings menu. Uncheck Safe Startup. Save settings and CLOSE ThinkPoint. It will back your desktop and task bar. Next download Malwarebytes and perform a scan. Remove what it found.

  13. Patrik
    ― November 3, 2010 - 10:31 am  Reply

    “PLEASE HELP ME”, begin a new topic in our Spyware removal forum. I will help you to remove this malware.

  14. Patrik
    ― November 3, 2010 - 10:32 am  Reply

    Anthonie, this problem only in Normal mode ? Safe mode is ok ?

  15. robin
    ― November 3, 2010 - 6:08 pm  Reply

    how do i fix a windows could not start because the following files are missing or corrupt \windows/system32/config\ on an acer laptop that does not have disc capabilities?

  16. Patrik
    ― November 4, 2010 - 3:03 am  Reply

    robin, looks like Windows system registry is broken. Try boot your computer in Last good configuration.

  17. Mary
    ― November 4, 2010 - 7:14 pm  Reply

    Hey I have Windows 7 will this work the same? Also I followed all the instructions but I’m still nervous about using my computer. I do alot of online bill paying is it really safe for me to do this now. What can i do to stop this from reoccuring? Am I really safe?

  18. lindsay
    ― November 4, 2010 - 7:34 pm  Reply

    Ok. I can’t even open up my task manager bar. My computer is stuck on this thinkpoint crap. It won’t even do it when I press alt cntrl delete… as u directed in step 1….so fustrating pls help I’m confused as to what to do
    Thanks
    LB

  19. Danny
    ― November 5, 2010 - 3:06 am  Reply

    thanks!it works.

  20. Patrik
    ― November 5, 2010 - 9:48 am  Reply

    Mary, the instructions for Win7 too. Once completed, update your antivirus and perform a full scan.

  21. Patrik
    ― November 5, 2010 - 9:50 am  Reply

    lindsay, try the following steps:
    1. Click Start, Type in search field
    %APPDATA%
    Press Enter.
    2. It will open contents of a folder. Locate and rename hotfix to hotfix1
    3. Reboot computer.
    4. Once Windows loaded, download Malwarebytes and perform a scan.

  22. debbie
    ― November 6, 2010 - 11:25 am  Reply

    FYI, this might help. I tried all the instructions above after i ran misc virus scan, did some clean up and nothing work. Found this site and did all that it said and still nothing wk. what i had to do was restore my computer which didn’t erase any of my files to last time i had internet. thinpoint came up again, but when i followed the instructions this time without doing what i had done before it worked. but you must following bleepingcomputer.com/virus-removal/remove-thinkpoint (i hope this isnt a nono) similar to iamcomputer.

  23. Htet Htet
    ― November 6, 2010 - 5:36 pm  Reply

    Thanks a million….

  24. Yvonne
    ― November 6, 2010 - 7:38 pm  Reply

    Thank you so much!!

  25. Dave
    ― November 6, 2010 - 10:12 pm  Reply

    This does not work. Hitting control+alt+del brings up a MODIFIED version of the task manager and hotfix.exe does not appear in the list of processes. thinkpoint apparently has now changed the process list of the task manager.

    We had to log into the guest account and download another virus checker program (avast), install it and run a boot scan. We were very fortunate that the attack only attacked the main user account.
    We’re using windows vista which really sucks.

  26. Mike wright
    ― November 7, 2010 - 9:21 am  Reply

    Fabulous step by step instructions!Way to go guys can’t thank u enough!

  27. Pam
    ― November 7, 2010 - 2:17 pm  Reply

    Wow! Great help – thanks! Out of nowhere my daughter picked this crap thinkpoint up from a site her professor sent her to for research!

  28. Rachel
    ― November 7, 2010 - 3:54 pm  Reply

    This was a super help! Saved me a lot of trouble! Thanks!

  29. Danny
    ― November 8, 2010 - 4:17 pm  Reply

    HELP – I thought this was working, I removed the virus using malbytes or so I thought, at first when I rebooted thinkpoint was gone, but now when I start my computer it just freezes on the desktop. It’s like the virus has morphed into something else. Now I literally can’t do anything.

  30. Patrik
    ― November 9, 2010 - 4:46 am  Reply

    Danny, can you boot your PC in Safe mode ?

« Previous 1 … 3 4 5 6 7 … 12 Next »

Leave a Reply to jeliarra Cancel reply

New Guides

scam alert
Remove Searchernow.com Redirect: Chrome, Edge, Firefox
Avoid the ExLig.com Bitcoin Scam: Insights on Promo Code Frauds
scam alert
Denwex.com Review: Bitcoin Promo Codes as a Scam
scam alert
CEFOLEX.com Review: A Closer Look at the Bitcoin Promo Code Scam
The Bigexcoin.com Bitcoin Promo Code Scam: How to Stay Safe

Follow Us

Search

Useful Guides

remove android virus
How to remove virus from Android phone
This setting is enforced by your administrator (Removal guide)
browser redirect virus
How to remove Browser redirect virus [Chrome, Firefox, IE, Edge]
adwcleaner
AdwCleaner – Review, How to use, Comments
Malwarebytes won’t install, run or update – How to fix it

Recent Guides

How to remove antispytag.com browser hijacker
How to remove System Defragmenter (Uninstall instructions)
How to remove Smart Engine (Uninstall instructions)
How to remove Antivirus Action (Uninstall instructions)
How to remove IronProtector (Uninstall instructions)

Myantispyware.com

Myantispyware has been a trusted source for computer security and technology advice since 2004. Our mission is to provide reliable tech guidance and expert, practical solutions to help you stay safe online and protect your digital life.

Social Links

Pages

About Us
Contact Us
Privacy Policy

Copyright © 2004 - 2024 MASW - Myantispyware.com.