Win32 Virus Removal

How To: Remove ThinkPoint (Virus Removal Guide) – Free PC Guides

December 3rd, 2010 | Author: admin

Posted on 03. Dec, 2010 by mumu in Virus Removal Guides

Before we get to removing ThinkPoint, first of all you should know what ThinkPoint is. ThinkPoint is one of many malicious computer security tools that are being promoted via fake Microsoft Security Essentials Alert. What it does : everytime you start your PC it pops up a security window that will scan for viruses on itself, overriding your initial antivirus. Once the scan is complete, you will realize that your PC is full of viruses, trojans and spyware. The next logical step would be cleaning/deleting of all of the above, but wait… you need to buy the full version. This is where the scam sets in, all the infiltrations that ThinkPoint found in your system were fakes, meant to scare you into buying the full version.

What people hate the most about ThinkPoint is the fact that it stops your computer from working until you buy the full version. This is because at startup, the first screen you see is the ThinkPoint startup screen, so Windows desktop and Windows task manager are out of use, closing the infiltrator becoming impossible for some of the more inexperienced users. If you try to close the ThinkPoint program it will state that “Current settings don`t allow unprotected startup. Please check your settings.”

To get rid of all of these annoyances you must chop off its head, and for that you will need a decent anti-malware program to detect and remove ThinkPoint from your computer. We are going to use Malwarebytes’ Anti-Malware tool, but first you need to know how to close ThinkPoint to access your desktop. Here is where the How To part starts.

Step1. We recommend that you print these documents, or write them down on a piece of paper, as we will need to close every window later on.
Step2. For this to work you will need to download files from the internet. Sometimes, the infection prevents users from downloading, in which case you will need to download the required files from another PC and transfer them to your own(CD/DVD, USB flash drive).
Step3. When prompted with the ThinkPoint startup screen, don’t click on any of the two buttons, and hit instead Ctrl+Alt+Delete (Hold Ctrl and Alt at the same time then press Delete). This will bring up the Windows Task Manager.
Step4. With the Task Manager on screen, click on the tab named Processes. Search through the list for the process called hotfix.exe and once highlighted click on End Process and then click Yes.
Step5. After closing the ThinkPoint process you now need to start Windows. From Task Manager click File – New Task(Run…). When the pop-up appears to ask for a new task name type explorer.exe and then press OK. After a while you should be back to your Windows Desktop.
Step6. Now for the harder part of our How To. Pay attention. The first thing we need to do is fix your Windows Registry Shell value. For this to work you will need to download Shel.reg from here, and save it on your desktop. When download is finished run it and allow the data to be merged.
Step7. Before moving on, we should end all other infections that came with ThinkPoint so that they don’t bother us with the cleaning procedure. This time you will need to download rkill.com from here.
Step8. Once rkill is downloaded, double click and sit back while it runs a thorough scan of your PC to determine if any processes associated with ThinkPoint are running. If you get any message saying Rkill is a threat or an infection ignore it. The message is just a fake warning given by ThinkPoint when any process associated with it is removed. If you run into any such warnings, the trick is leaving them untouched. Minimize them or simply ignore them and run Rkill once again, this allows Rkill to bypass ThinkPoint`s self protection and cut deeper and deeper. The point is to run Rkill until the malware is no longer running. If you keep encountering problems when running rkill.com you can try downloading from the rkill download page iExplore or eXplorer.exe. Both are renamed copies of rkill.com. Do not, under any circumstances, reboot your computer, otherwise the malware will start again.
Step9. Now download Malwarebytes’ Anti-Malware, or MBAM, from www.malwarebytes.org, and save it to your desktop. Once downloaded, close all programs and windows on your computer and run mbam-setup.exe from your desktop. This will install MBAM on your PC. Once the download begins, keep following the obvious course until it is completed. Keep to the default options during install and make sure to leave both Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware checked in the end. If prompted for a reboot skip it.
Step10. After the setup is completed MBAM will automatically start and will ask for update. MBAM automatically updates itself after installation so you can press the OK button to close the message. Now click on the Scanner tab and make sure that you select Perform full scan and then click Scan.
Step11. The scanning will take quite a long time, but after its done click OK on the notification pop-up and proceed with the removal of ThinkPoint. After the scan is complete, click Show Results and then another click on Remove Selected and allow MBAM to delete all of the files and registry keys and/or add them to the quarantine list. It will most likely prompt you for a reboot and you can now allow it.
Step12. Once back from the well deserved reboot, your PC is breathing a bit easier and we can continue with the next steps. Step13 is up to you. You are now free of ThinkPoint. Make sure to pay closer attention to what you download, what websites you visit, what adds you click. Get yourself a good anti-virus and try to run MBAM once a week to prevent any further threats. Our recommendation is to purchase the PRO version of Malwarebytes’ Anti-Malware as it is one of the best anti-malware tools on the market.

Cheers and please tell us if it worked.