ThinkPoint - Fake Microsoft Security Essentials Alert

What is ThinkPoint?

ThinkPoint is a malicious computer security tool that is being promoted via fake Microsoft Security Essentials Alert. Previously, this alert is endorsing only five (5) application but recently it included Think Point as an addition to the family. To get users attention, this unwanted program will pop-up a security window and scan viruses on itself instead of your legally installed AV program. After that, several dozens of Trojans, viruses and spyware will be displayed attempting to scare computer users. This is an attempt to persuade the into obtaining the registered version of ThinkPoint Antivirus.

To get rid of annoyances brought about by this fake AV software, you must first remove ThinkPoint itself. Only an effective anti-malware program can detect and remove compromised files from the computer and totally render it clean and bring back to its previous normal working state. Just follow the remove procedure stated below and remove ThinkPoint completely.

Type	Rogue
Sub-Type	FakeAV
Aliases
OS Affected	Windows
Detected By	MalwareBytes

What are the Symptoms of ThinkPoint Infection?

It will modify Windows Registry and add the following entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell” = “%Documents and Settings%\[UserName]\Application Data\hotfix.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “tmp”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce “SelfdelNT”
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell” = “%UserProfile%\Application Data\thinkpoint.exe”

The threat will drop the following malicious files:
%UserProfile%\Application Data\hotfix.exe
%UserProfile%\Application Data\thinkpoint.exe
%UserProfile%\Application Data\tmp.exe
%UserProfile%\Application Data\thinkpoint.exe
%UserProfile%\Local Settings\Temp\[random]

How to Remove ThinkPoint Manually

1. Restart your computer in SafeMode
- After Power-On the computer, just before Windows start, press F8- From the selections, Select SafeMode

2. End ThinkPoint Process
- Press Ctrl+Alt+Del from the keyboard to open Task Manager
- Go to process Tab
- Select ‘hotfix.exe’ and click on End Process
- Close Task Manager

3. Remove Registry entries that the threat added. You MUST BACKUP YOUR REGISTRY FIRST.
- Click Start > Run
- Type in the field, regedit
- Navigate and look for the registry entries mentioned above and delete if necessary

4. Delete malicious files that the threat added:
- Base on the given location above, browse and delete the file
- If no location is given, click Start>Search> and search for the files.
- If cannot be deleted, press Ctrl+Alt+Del to access Task Manager, see if the file is running in the process. If it is, select the file and click End Process. Perform file delete again.

5. Scan computer with Antivirus Program
- Update antivirus program
- Scan computer and delete all detected threats.

Automatic Removal of ThinkPoint

1. Download and run MalwareBytes AntiMalware to remove this computer threat.