Written by Tomas Meskauskas
Damage level: High
What is ThinkPoint and how to remove it?
This unwanted program will try to fool you into buying it and the software employs various methods in which to do so. It uses a fake virus scan and displays fake alerts indicating that your computer is infected. After the fake security scan, the rogue program will notify you that C:\Program Files\Messenger\msmsgs.exe is infected. You will then be asked to reboot your computer. This program is capable of blocking execution of legitimate Windows programs, thus making its removal more complicated. It is important to understand that ThinkPoint is a rogue program that should not be trusted. When installed on your computer, this bogus program will imitate a computer security scan and will attempt to trick you into believing that your PC is infected with critical risk security threats. Examples of fake security alerts might look like this:
“Microsoft Security Essentials detected potential threats that might compromise your privacy or damage your computer. Your access to these items may be suspended until you take action.”
“Unable to remove threat. Click ‘Scan online’ to remove this threat” or “The application iexplore.exe was launched successfully but was forced to shut down due to security reasons. This happened because the application was infected by a malicious program that might pose a threat to the OS. It is highly recommended that you install the necessary heuristic module and perform a full scan of your computer to exterminate malicious programs.”
ThinkPoint is mostly propagated via e-mail phishing and p2p downloads. Do not buy this program, it is a scam. Internet criminals created this program to scare you into believing that your computer is highly infected with spyware in an attempt to sell you the ThinkPoint license. The program states that it could remove the detected security issues if you pay for the license. Do not trust ThinkPoint. It is a rogue program that does not actually scan your computer, but ‘detects’ non-existent spyware and malware on your computer and then encourages you to purchase the program to remove these supposed threats. To further scare you into believing that your PC is at risk, your desktop will be flooded with security warning messages stating that viruses are trying to attack your computer. Ignore all ThinkPoint security scans and warning messages. ThinkPoint is a scam that should be removed from your computer. Use the information provided to remove this bogus program. Screenshot of a fake antivirus program "ThinkPoint":
1. Press ctrl+alt+del (or ctrl+shift+esc) to enter the Task Manager. Select the "Processes" tab.
2. Search for the hotfix.exe tmp.exe and thinkpoint.exe processes. Select each and press "End task". When you are asked if you are sure, click "Yes".
3. When you have terminated the hotfix process, you will see a blank screen. In the Task Manager, click "File", select "New task", and in an opened window type explore.exe and click "OK".
4. After this procedure you should be able to access your desktop. You should now download legitimate anti-spyware software to fully remove ThinkPoint from your computer.
5. After downloading anti-spyware software, install it, update it, and then run a full system scan. Remove all infections found.
Some malicious software modifies browser settings and disables downloads of spyware and virus removal software. If you have problems downloading anti-spyware software with Internet Explorer, try downloading with an alternative browser, such as Chrome, Firefox, Opera, etc.
If you are unable to remove ThinkPoint, you can use these manual removal instructions. Use them at your own risk, since if you do not have strong computer knowledge, you could harm your operating system. Use them only if you are an experienced computer user. (Instructions on how to end processes, remove registry entries...)
End these ThinkPoint processes:
Remove these ThinkPoint registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell” = “%Documents and Settings%\[UserName]\Application Data\hotfix.exe”
Delete these ThinkPoint files: