Think Point

Think Point, which is also known as ThinkPoint virus is part of a fake Microsoft Security Essentials Alert. Think Point is being advertised as one of the five removal tool that may get rid of any infection found on computer. Initial infection will result to malfunction of Windows desktop, removing all icons and displaying nothing but fake alert message stating virus presence. An attempt to clean this malware will open up a new window displaying multiple virus scanners but only five rogue programs are able to identify the infection, and that includes Think Point.

Executing any of the endorsed rogue product will allow itself to be installed on the system. Having it on the PC will provide various annoyances including blocked Internet access, browser hijacking and system malfunction. It’s hard to believe that this destructive virus also obstruct Safe Mode start-up. Trying to run any installed applications will be blocked by Think Point and instead it releases warning message stating that executable file is already compromised. It appears like there is no other way to get rid of ThinkPoint at this moment.  All of these displeasure carried out on the computer aims to persuade users into getting the licensed version of useless software called Think Point.

Screenshot Image:

ThinkPoint Installer Image

If you see the introduction window. Do not click on “Safe Startup” to prevent installation of Think Point. Restart Windows immediately and perform a virus scan.

Image of Think Point

Alias: ThinkPoint Virus

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Malware Behavior
Think Point will prevent all applications from running. Any attempts to run a program will pop-up a window containing this message:

The application file.exe was launched successfully but it was forced to shut down due to security reasons.
This happened because the application was infected by a malicious program which might pose a threat for the OS.
It is highly recommended to install the necessary heuristic module and perform a full scan of your computer to exterminate malicious programs from it.

[cf]regis[/cf] [cf]files[/cf]

How to Remove Think Point

Think Point Removal Tool

This guide requires a tool called Malwarebytes' Anti-Malware. It is a free tool designed to eradicate various computer infections. MBAM scanner is distributed for free.

1. Download Malwarebytes’ Anti-Malware. Save the file on your Desktop or any desired location as long as it is accessible to you.
2. When finish downloading, double-click on the file mbam-setup.exe to install the application.
3. Follow the prompts and install with default configuration.
4. Before the installation completes, you need to update the database.

5. Click Finish. Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
6. When update is finished please exit MBAM. We have to reboot your computer in Safe Mode.
- Press F8 repeatedly on your keyboard right before Windows logo begins to load.
- Windows Advanced Options menu will appear.
- Select Safe Mode.

7. If Windows is already on Safe Mode. Locate Malwarebytes' Anti-Malware icon and run. Select Perform full scan to check your computer thoroughly.
8. When scanning is finished click on Show Results.
9. Make sure that all detected threats are checked, click on Remove Selected. This will delete all files and registry entries that belongs to Think Point.
10. Restart your computer.

Note: If Think Point prevents mbam-setup.exe from downloading. Download the software from another computer. Renaming it to something like 'anything.exe' can help elude the malware.

Alternative Removal Method for Think Point

Option 1 : Use Windows System Restore to return Windows to previous state

If Think Point enters the computer, there is a big chance that Windows files, registry entries and other essential components are also infected. System Restore can reinstate clean system files by restoring the configuration to an earlier date. The method also replaces compromised files with a clean version. If you have a saved restore point before Think Point infiltrates the PC, we highly encourage you to execute this procedure if none of the above works. You may proceed with Windows System Restore, click here to see the full procedure.

Option 2 : Think Point manual uninstall guide

IMPORTANT! Manual removal of Think Point requires technical skills. Deleting system files and registry entries by mistake may result to total disability of Windows system. We advise you to perform a backup of registry before proceeding with this guide.

1. Kill any running process that belongs to Think Point.
- Press Ctrl+Alt+Del on your keyboard.
- When Windows Task Manager appears, look for Think Point files (refer to Technical Reference) and click End Process.

End Task

2. Delete all registry entries that belong to this malware.
- Press [Windows Key]+R on your keyboard.
- In the 'Open' dialog box, type regedit and press Enter. This will open registry editor.
- Find and delete registry entries as mentioned in Technical Reference section below.
- Close registry editor. Changes made will be save automatically.

Run Regedit

3. Scan the computer with antivirus program.
- Connect to Internet and open your antivirus software. Please update to obtain the latest database and necessary files.
- Restart the computer in Safe Mode.
- Just before Windows logo begins to load press F8 on your keyboard.
- On Windows Advanced Boot Options, select Safe Mode and press Enter.

4. Delete all files dropped by Think Point.
- While still in Safe Mode, search and delete malicious files. Please refer to 'Technical Reference'. Make sure that you execute 'End Task' first before deleting the file. Otherwise, the system will not let you perform this action.

Technical Reference

Associated Files and Folders:Added Registry Entries:

Comments and Suggestions

On this area you can find Visitor's personal suggestions. We cannot control and evaluate each recommended procedure from visitors so please use it at your own risks. If your inquiry pertains to Think Point payment refund or lost serial key, kindly check the FAQ for rogue program first.

432 Comments

  1. Linda
    Oct 18, 2010 @ 17:23:51

    I need a solution for removing Think Point virus other than what was offered on the posts because I can’t reboot computer at all; that is to say, when I attempt to turn it on, eithere in safe mode or normal,the think Point screen comes up and if i click start, it begins installing weird looking files before the computer starts. How do I reboot the computer without deleting the os, and without the virus controlling the start up? I have Windows Vista. I am using a different computer now.

    Thank you,
    Linda

  2. Matthew
    Oct 18, 2010 @ 17:32:43

    I got the ThinkPoint fake-antivirus just from searching some “Google images” (not going to say which ones, some people might actually try to look them up themselves, curiosity killed the cat :b) so this virus is definitely out there and wide spread. To anyone that can’t understand or still needs help, all you have to do to remove it is download the “Malwarebytes Anti-Malware from http://www.precisesecurity.com/tools-resources/adware-tools/malwarebytes-anti-malware and run a full scan, and delete all of the infected programs. If you’re having trouble with the “black screen of death” (I’m so clever…) hit [CTRL]+[ALT]+[DEL] and open up the task manager. From there, delete “hotfix.exe” from the processes and then go to “new task.” Type in “Explorer.exe” and from here, just open internet explorer (if you can’t, run “iExplorer.exe”) and download the above software.

    If you cannot end “hotfix.exe” using the task manager for some reason, just run “rkill.exe” on the SOB and it’ll kill it. Hope this helped someone :)

  3. Matthew
    Oct 18, 2010 @ 17:36:50

    Linda, I wish I would’ve read your comment before I posted that. If you absolutely can’t get around it, the best thing to do is, although a little more time consuming, let it run it’s fake scan and when it’s done, it will ask you to buy some software. Click accept and when you get to the payment options, there should be a “fun free trial” mode, but I can’t remember where. After that, just continue on and download the Malware link and you should be set.

  4. james_x64
    Oct 18, 2010 @ 23:49:54

    Linda, Yes you are right. It seems to have lock the desktop. First solution is not possible but second works fine. With Kaspersky bootable I was able to delete viruses and so as ThinkPoint. Though it will require you to create a boot drive using a flash drive. It works though.

  5. B
    Oct 18, 2010 @ 23:57:01

    When the think point screen pops. Dont not click anything. Hit ctrl-atl-del and then open the task manager. With the task manager open. Click file and then new task. Type in explorer.exe and then end the think point process. that should work to get you into windows

  6. Chris OShaunnessy
    Oct 19, 2010 @ 01:30:58

    OK – I am running Vista and I had the same problem as Linda. Totally locked up. I read through these suggestions (thanks!!!) and this is how I by-passed it. I opened Task Manager (didn’t click the Think Point Start in Safe Mode). Then I saw that it doesn’t appear in Applications…it appears in Processes as “hotfix.exe”. I selected that process and clicked “end process”. Then I clicked “new task”. I typed in explorer.exe and was able to get to my desktop and start running Malwarebytes Anti Malware. Wow. This is a nasty little booger. Good luck everybody! And thanks again! PS… it helped that I had a laptop to jump on to look all of this up…

  7. greg
    Oct 19, 2010 @ 02:23:15

    Deel e4300 laptop running XP.

    None of the solutions in the article or in these posts work. Cant get past the Think Point graphic–not in safe mode…nothing. Cntrl+Alt+Del calls up the task mgr but I cannot interact with it–it is below the Think Point graphic.

    Went to a different computer and tried following the instructions to make the Kapersky bootable USB solution but unlike the article above…

    1) the program does not try to install itself to my USB drive by default and…

    2) when I select the USB device as the destination and it goes to look for the files for “Kaspersky Rescue Disk 10″ it is unable to find them anywhere even when I point it to the location of the downloaded files.

    Net, net–cant make the bootable flash device.

    Thoughts?

  8. Kyle
    Oct 19, 2010 @ 03:58:48

    There is no option to do the “fun free trial”

    The trojan has also disabled the ability to use system restore and other system tools.

  9. dude
    Oct 19, 2010 @ 04:10:35

    Thank you B!!!
    Your solution worked perfectly on Vista when I had the same problem as Linda.

    @Greg – is there any way you can change your screen resolution or plug in a second monitor without clicking the thinkpoint options? Maybe that way you can find a way to move task manager screen to the side enough to make it work even behind the thinkpoint screen. Just an idea, no promises.

  10. RaXica
    Oct 19, 2010 @ 04:18:18

    Wow this virus is scary, I followed the instrustion Chris S gave and got online less than a couple of minutes. I was looking up fresh spring rolls, an ad poped up and next thing I am stuck with this threat of no choice but to go to another computer. thanks everyone and especially Chris

  11. james_x64
    Oct 19, 2010 @ 05:28:57

    @Greg, Kaspersky Rescue Disk 10 is a program you downloaded that is a large file. the filename is “kav_rescue_10.” An ISO file. It contains all the necessary files to create a bootable drive. Please carefully follow the procedures on creating the boot drive.

  12. Whrsdfyr
    Oct 19, 2010 @ 09:29:29

    On a lighter note, is this legal? Can you imagine all the time lost to this illegal intrusion? Can someone be sued for all these B&E (breaking and entering). It is still against the law. I have not accomplished anything all night. I could not go online. Why is this allowed to happen?

  13. K
    Oct 19, 2010 @ 10:33:31

    @Whrsdfyr

    Of course it isn’t legal. But it’s not like any of us would be able to find the person who wrote the virus and then drag them to court. Honestly, I’d love to beat the crap outta whoever created it. I’m picturing some fat SOB with no life wearing a McDonald’s stained T-shirt sitting in a dingy basement laughing about his virus. >_>

  14. Alissa
    Oct 19, 2010 @ 12:20:58

    I ran Malwarebytes AND Avira and it detects nothing and the thinkpoint virus remains…

  15. jamie
    Oct 19, 2010 @ 13:14:00

    Cheers Matthew. That was a nightmare. What a**holes make a living from ding that to people?

  16. Dana B
    Oct 19, 2010 @ 14:11:14

    I felt like I was in Linda’s situation, but did as Matthew directed in comment #2 and it worked great! Thanks!!

    If you bring up your computer and can’t turn it off and ctrl-alt-del doesn’t bring up task manager, then turn off again and when it comes back up with the ThinkPoint virus screen, don’t click anything on the screen and try ctrl-alt-del again. I was able to get task manager at this point and then follow comment #2 instructions. Good luck!!

  17. Michael Feldman
    Oct 19, 2010 @ 14:28:01

    I went through this horror show last night. I finally got rid of it thanks to my son who on his laptop found the solution and downloaded the malwarebytes etc software and e-mailed it to me. However, before going to my son, I clicked “safe startup” and it started it’s scan/scam. When I tried aborting it after 10 minutes, I came to the “register and pay me” window which I of course ignored. My question: Am I home free or by doing the scan did I do screw up?

  18. greg
    Oct 19, 2010 @ 16:02:51

    My Bad. I wasnt able to create the bootable USB device–did not work per the instructions linked to in the article–but I was able to get start up into “safe mode with network connections” and, when the image of think point presented itself, hit ctrl+alt+del and interact with the task mgr. From there I was able to find and disable the HotFix files which gave me back control of the desktop. From there (still in safe mode) I was able to find and delete the hotfix files and that did solve the problem. It screwed up a Service Host Win32 file but I was able to debug and reboot and now everything is good.

    My mistake was in assuming that, since I couldnt access task mgr in normal windows mode (it came up under the Think Point graphic) that I also would not be able to access it in Safe Mode with Network Connections. Oops.

    Greg
    Dell e4300 running XP srvce pack 2.

  19. greg
    Oct 19, 2010 @ 16:04:24

    I meant “find and disable the hotfix processes”.

  20. Semra
    Oct 19, 2010 @ 16:15:20

    Hi Guys.. I got this virus and I tried to do the things above. The problem is than when I finally get my desktop working again, and are just about to log in to the Internet to download the anti-malware software, a blue screen appears. I have tried a lot of times and it’s the same every time. So, what can I do about the blue screen?? Plz help me get rid of this virus!!

  21. Alissa
    Oct 19, 2010 @ 17:28:59

    I have successfully gotten around thinkpoint to run malwarebytes and avira but when i run the programs they do not pick up thinkpoint. Any suggestions?

  22. Les
    Oct 19, 2010 @ 18:24:59

    I found the thinkpoint files in the application files under documents and settings. I renamed them, neutralized the “hotfix” settings in regedit and rebooted. After this I was able to delete the files. Took a couple of hours, all told but virus gone now!

  23. Pat
    Oct 19, 2010 @ 22:10:27

    Thank you Matthew!

    I had not clicked on the “safe install” button for Think Point, so took my laptop to the library and found your advice. I did the control-alt-delete bit, got into Task Manager, deleted hotfix.exe followed your tips on opening IE.

    Since I never “installed” Think Point, am I OK from this point? Noting named hotfix comes up when I do a search.

  24. Cyndi
    Oct 19, 2010 @ 23:14:33

    Thank you so much Matthew!!! (Comment #2)….

    I rebooted the computer and when the thinkpoint screen came up, I did CTL ALT DEL and then was able to click on Taskmanager. Under processes I deleted hotfix.exe, then added explorer.exe. I was then able to get online, and went to the link in comment #2 and did a full scan and deleted the infected files. Took me a couple of hours total, but it worked.

    THANK YOU!!

  25. Zach
    Oct 19, 2010 @ 23:16:49

    I got to the part where I should download the Malware protection bu t the virus keeps me from downloading it. what should I do?

  26. Suzanne
    Oct 20, 2010 @ 00:50:37

    This virus is wicked! I have a Dell Laptop with Windows Vista on it. I spent over $300.00 back in April securing my PC with Anit-virus software. I am not software or hardaware literate and can’t afford to spend more money on this virus infection. I now have this Think Point virus. When I push control, alt, delete, It just takes me to the screen that ask if I want to switch users. If I push it again, I brings me back to the think point graphic. I tried running the Virus Scan that it offered and it brought me to a payment screen… When I clicked out of it and shut down Windows, It started all over again.. Please help! My children need the Dell PC for homework tonight…. Help!

  27. Mapg1rl
    Oct 20, 2010 @ 00:52:50

    Thanks all for the advice. I got it off readily. Just ended process on task manager and now running malware bytes!

  28. David
    Oct 20, 2010 @ 10:43:19

    Help. I have tried the advice on here, run a scan from Avirs (system antivirus) and the downloadable Kaperski one but each time I reboot ThinkPoint appears.

    I tried the boot disk link from this iste and that won’t boot.

    Can anyone provide step by step advice and is there a way of creating a boot disk to get back in control?

    Help Please!

  29. Whrsdfyr
    Oct 20, 2010 @ 11:33:48

    I used my Apple laptop to download Malwarebytes AntiMalware, of course it will not run on Apple systems, but I copied it to a USB flash drive, attached it to my now useless Dell desktop and ran the Installation from the flash drive successfully. Scanned my Dell 2 times and restarted each time. It worked. I am still apprehensive because Malwarebytes still could not remove some supposedly stubborn intrusions and virus, but I was able to go online and get on with life. I still think we can find the SOB, somebody must have paid his RANSOM.

  30. Gary
    Oct 20, 2010 @ 11:36:33

    Like Suzanne, I have a Dell Laptop with Windows Vista on it and the same thing happens to me when I click control, alt delete.
    Would be extremely for any simple but effective advice (I am not very computer literate. Many thanks.

  31. Gary
    Oct 20, 2010 @ 11:37:30

    Oops. Missed out the word “grateful” after extremely! Thanks again.

  32. chas
    Oct 20, 2010 @ 16:11:34

    Hey Linda,

    just open the task manager (CTRL + ALT + DEL), select new task and type in C:, it should give you several folder options. Just pick any random folder to open it (the virus is quite obnoxious and won’t let you start explorer.exe to get to your normal desktop). Navigate to the browser of your choice’s folder and simply follow the instructions on this site.

  33. David
    Oct 20, 2010 @ 16:30:01

    Hi guys, I have faught with this thing all day and seem to have finally removed it.
    None of the solutions on here would work, for example the MalwareBytes software would load but not deploy and none of the boot-disks woud boot at all.
    In the end I managed to start in Safe Mode and open Task Manager and close the Hotfix file as described above. Then open Explorer and on the Kapersky website in the Downloads section there is a virus removal tool at the bottom of the list. When I ran this it failed the first time because I forgot to tick ALL the boxes.
    Having let it run for 6 hours my system still wouldn’t start (black screen)but this time when I started in Safe Mode I was able to perform a system restore which does seem to have worked. I haven’t tried closing down again yet because it is such a delight to see my system up and running. My antivirus is running right now.
    My big concern is that some of the virus files reside in Documents and Outlook and I worry that the restore may have preserved them. I will post again if there’s a problem.
    Good luck!

  34. Buzz
    Oct 20, 2010 @ 16:36:25

    I tried all of the above as as Greg to no avail. I wnet back to a a recent restore point prior to picking up the virus and that got rid of both the Think Point Graphic and the Antimalware software. Back up and running again.

  35. Dillon
    Oct 20, 2010 @ 17:42:33

    Went to a website that was recommended as a codec for my new cam. Turns out they’ve been invaded (but fixed it since then). Currently building the USB drive and I’ll try that. I also have an older version of BSD Rescue, but I really don’t know BSD well enough to try.

    This is the only machine that doesn’t dual boot with Linux.

    K May I join you? From a movie (Segal? Bronson?) “Don’t worry, I won’t kill you. No matter how much you beg.” :-) for the “humor” impaired.

    Pat You don’t have to install it. It does so on its own. It is a truly nasty piece of work.

    I think the Kaspersky disk will work the best, since Windows never even starts. Hopefully the USB disk will work because otherwise I’ll have to download and ISO burner.

  36. ben
    Oct 20, 2010 @ 18:47:34

    Hey guys! don’t know if some1 posted this b4…

    but i found out that at the beginning, b4 the scan begins, u can still enter the Task Manager via ctrl+alt+del
    when ur there just close “hotfix.com” and run “explorer”.
    that will start up the desktop and allow u 2 enter the web and download malwarebytes…

    and then continue with the rest of the instructions.

    good luck all!

  37. Dillon
    Oct 20, 2010 @ 19:47:30

    Well, didn’t need the USB disk. Seems when I pulled the plug, Windows decided it was FUBAR. So the boot didn’t get far enough to start Thinkpoint and it loaded my last checkpoint, which was from last Friday. The only software I had loaded since then was a JRE update and a Quicktime update. No data lost, no pain other than the three or so hours it took.

    I’m burning a CD right now to make the recovery quicker, since I don’t need to change the boot sequence.

    So, if nothing else is working and you think you have a recent enough checkpoint, when you get the little “Windows is starting” thing at the bottom with the back&forth bar, pull the plug. Literally. Windows should try to repair it.

  38. Ryan
    Oct 20, 2010 @ 23:00:07

    i have done the control alt delete and removed the hot thing. But when i try to access explorer it says i do have permission. then the screen goes black

  39. anonymous
    Oct 21, 2010 @ 03:56:15

    I need to know the name of the program file, and where it is located in the computer, my anti-virus is not working to kill it off, I have to go in and manually delete it, please someone tell me!

  40. Leandro (Brazil)
    Oct 21, 2010 @ 06:44:16

    Hello friends! I’m from Brazil and I had problems with this virus.
    I would like to thank the tips past, especially to Matthew. Bad problem with this virus was solved following the steps. Use the XP pack 3.
    Thanks again same!!
    God bless!

  41. Alex
    Oct 21, 2010 @ 06:47:24

    Is it the right thing I’m downloading here? It’s called stopzilla and apparently it’ll run a
    scan, but to remove infections I have to pay 24 quid. Please help, trying to remove it
    since yesterday

  42. Leandro (Brazil)
    Oct 21, 2010 @ 06:48:20

    anonymous 41:
    Follow the steps indicated by Matthew! It works perfectly! Hope this helps … Good Luck!!

  43. Alex
    Oct 21, 2010 @ 06:53:28

    I’m following, got the point where I need to download the malware program to run a scan. This is stopzilla, is it the right one? It’s running a scan now, but it says it’ll only detect infections and not remove them.

  44. Leandro (Brazil)
    Oct 21, 2010 @ 06:56:36

    Alex
    This was not the softwear that I used. The solution is free.
    Search for the item of Article 01, has a link under “Malwarebytes’ Anti-Malware”. This program must be installed on your desktop.
    Notice the comment Matthew therefore has no error.
    Hope this helps, my English is not the best, but I’m on line if needed. I just do the cleaning and it worked, ok?

  45. mat
    Oct 21, 2010 @ 10:16:20

    ok i deleted hotfix but when i try to run explorer or IE (eventhrough browse) it says “these files cant be opened, your internet security settings prevented one or more files from being opened”
    i have windows 7

  46. max
    Oct 21, 2010 @ 11:11:07

    Ok guys, i’ve been having trouble with this all night! I can open up task manager but can’t do anything on it. when i try and delete the hotfix.exe process it doesn’t let me. also can’t open any other programs!I’ve ran malwarebytes spydoctor etc. from my guest setting and its found things, i’ve also ran perfect uninstaller and removed the actual hotfix program but its still there!!?!? any help would be much appreciated!

  47. ruairi
    Oct 21, 2010 @ 11:19:54

    i fellowed matthews steps. I downloaded the software, installed it and ran the scan in safe mode and removed the infected files which it found. Once i restarted my computer I had a black screen again but nothing came up about think point. Could anyone help me thanks. I have windows vista.

  48. Nabs
    Oct 21, 2010 @ 11:25:55

    So I tried following the directions given above but when I try to start a new task it says I don’t have appropriate permissions. Why is this? Does this mean I need to boot from a flash drive?

  49. Alex
    Oct 21, 2010 @ 11:51:31

    Thank you Leandro. I give up though, can’t sort it out at all! It won’t let me install it. I’m not good at this, so will bring my laptop to some sort of computer geek shop, I can’t manage. Damn the people who developed this crap thinkcrappoint!

  50. Glor
    Oct 21, 2010 @ 13:05:12

    I got past the main screen by using task manager, but when I try to download the malware above I get this message: “FilesCrunch.com will be here soon
    Windows & Mac OS downloads and drivers”

    Has anyone else been getting this message?

  51. Dj_Adamix
    Oct 21, 2010 @ 13:12:22

    Linda, if you cant get it to turn on, while your system reboots and thinkpoint is about to start a scan, go to task manager (alt+crtl+del) kill hotfix.exe, or any other random looking process that originates in temp or app data folder. Then in task manager go to file (or one of those upper options) and start… type in explorer.exe, your comp should start running, then delete hotfix.exe from appdata/roaming and appdata/local. You have to remember that that program originates from a trojan horse, so even if you delete it it will come back, so go to windows/temp and delete all those loose files on the bottom. those are most likely trojan viruses, or preform a full comp scan with your antivirus.
    Hope it helps.
    Adam

  52. Brad
    Oct 21, 2010 @ 13:59:57

    I just removed this from a client yesterday. In safe mode it would also give me the ThinkPoint screen where you couldnt do anything. I ran the latest Kaspersky boot CD, that removed 7 infected files. I then was able to get into safe mode and install Malwarebytes. I took the most updated reference files from a clean pc and transfered them to the infected as I was not able to do safemode with networking. Ran malwarebytes and it found 9 more infected files. Rebooted and all was fine. I ran a few more scans for good measure and nothing has popped up since.

  53. Tran
    Oct 21, 2010 @ 15:43:17

    I just received the virus and just spent a whole lot of time trying to get it off, I think I finally got it down.

    You must get the entirety of the virus off manually, except the registry files, leave that up to malware remover.

    I use:
    SuperAntiSpyware
    and
    Malwarebyte’s Anti-Malware
    programs.

    Step 1. If you can’t get past the thinkpoint screen, press ALT + CTRL + DELETE to get to your task manager, end process of hotfix.exe, and there’s another program that is set for your start-up that prevents a lot of programs from being run, I believe it’s bluebox program that the process name is a set of 5-6 numbers, 9 something. End that process as well and you’ll be running your system like new.
    After you’ve successfully logged onto your computer, run SuperAntispyware and Malwarebyte’s, in my case, Superantispyware was extremely helpful. Once Superantispyware finds all it’s files that are infect, click next, and stay at that screen. Look at ALL the “Files” that have been corrupted, find them in windows explorer and delete them. One of them should be found in your C:Users/Windows/Starup, etc… (i know that’s not the right command, but Antispyware will tell you where it’s at.) Once you’ve deleted ALL of the malicious FILES, then click next so malware can delete the registry bugs themselves.

    WHEN YOU DELETE, press SHIFT + Delete so it’ll delete it permanently instead of recycle bin. Good luck everyone.

  54. Sudheesh.K.S
    Oct 21, 2010 @ 17:09:00

    Manual removal:

    Stop these ThinkPoint processes:
    %UserProfile%\Application Data\hotfix.exe
    %UserProfile%\Application Data\thinkpoint.exe

    Remove these ThinkPoint Registry Entries:
    HKEY_CURRENT_USER\Software\PAV
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “thinkpoint”
    HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell” = “%Documents and Settings%\[UserName]\Application Data\hotfix.exe”

    Remove these ThinkPoint files:
    %UserProfile%\Application Data\hotfix.exe
    %UserProfile%\Application Data\thinkpoint.exe

  55. Mark
    Oct 21, 2010 @ 17:35:36

    Hi guys, fro some reason when I get to run any app specifically kaspersky I get a box thta comes up saying Windows Security These files cant be opened. Your internet security settings prevented one or more files from being opened.
    This virus/mailware is a pain in the a**. Thanks for all the advice on this site

  56. Geri
    Oct 21, 2010 @ 18:54:12

    CTRL+ALT+DEL – task manager- delete hotfix.exe- go to new task- type Explorer.exe and download both SuperAntiSpyware (http://www.precisesecurity.com/tools-resources/free-antispyware/superantispyware-free-edition) & Malwarebyte’s Anti-Malware (http://www.precisesecurity.com/tools-resources/adware-tools/malwarebytes-flash-scanner/)
    Scan & Clean (3 hours and you’ll recover)

  57. Dave
    Oct 21, 2010 @ 19:43:04

    In safe mode Vista x64.
    On the machine I worked on, in process there was *explorer.exe. when I killed the “*explore.exe”, that got rid of the Thinkpoint screen.
    Then in “new task” typed in explorer.exe. That got the normal desktop in safe mode. I then was able to load Malwarebytes, update and scanned, (199 infected files, most were tracking cookies that must already been on the machine, rebooted and scanned again. All clear.
    If your having trouble getting passed the Thinkpoint screen, try loading one of the Rkill programs http:// www . bleepingcomputer .com/forums/topic308364.html
    seem to work about 60% to 70% of the time.

  58. Mike
    Oct 21, 2010 @ 20:06:33

    If you can’t boot into Windows or Safe Mode and you are using Vista and have a reinstall disk, boot from that disk. After you get to the Language screen which is the first screen of the Vista install, there is a link to Repair Your Computer. Click on Repair… and it will take you to a screen with 5-6 options (system restore, etc). At the bottom is a link for Command Prompt. Click that, it will take you to a prompt for something like X:\source. Type C: so you will be in the C: drive. Type dir to see what is on the root of C. One of the files should be hotfix.exe. If it is there, at the C: prompt, type del hotfix.exe and hit enter. That will delete hotfix.exe which is the problem file in all this. The PC should now reboot into Windows. Of course, this works for XP, but the boot disk will not give you a command prompt the same way as Vista or Win7 disks. If you are using XP and only have an XP disc, you can basically do the same procedure if you go to Recovery Console. A bit more involved though.

  59. Waxzman
    Oct 21, 2010 @ 22:18:14

    Guys the best solution for this is login as a local admin and see if that account infected too. And if it is then only one solution if you don’t want to spend soo much time troubleshooting it is to re-image your system. Just make sure to back up your data first by eithere transfering to thumb drive or external HDD. And if you the local admin is not infected the best solution for this to re-create the profile. Then after that just transfer your data back to that profile you created. PROBLEM SOLVE.

  60. raffi
    Oct 21, 2010 @ 23:03:29

    hey
    i know u got tons of these question! but i just can’t do! go to taskmanager but can’t open any file or anything! so can’t get to my desktop! is there any other way? like download it on a other computer and get it on a usb stick or something like that?!
    thanks a lot for your help!!

  61. Waxzman
    Oct 21, 2010 @ 23:42:58

    @raffi the solution for your ploblem is remove that hard drive and use a sata/ide cable. And if you dont know what is that, it act as a external HDD once you plug that cable to other PC. And you can just buy this at any computer store like fry’s electronic, micro center, or you just go to amazon, or new egg and buy from there. It’s not that expensive and its not that difficult to use. I hope that help your issue.

    Happy hacking.

  62. Ali
    Oct 22, 2010 @ 01:23:53

    If you cant get to your internet, when the think point screen comes up press ctrl alt delete. go to task manager stop the process that is called helix or something close to that. then file start new task and type in explorer.exe

  63. sTEFAN
    Oct 22, 2010 @ 01:24:49

    raffi & the rest:

    if you have 2 PCs at home and an external enclosure for the HDD which got infected. I have an elegant solution for you ‘n will take you only minutes:
    Take out your infected HDD and hook it up externally to your other PC. In Explorer find App Data folder and from both roaming and local directories delete hotfix.exe.
    From the folder windows/temp delete the loose files, since it’s trojan it has to sit somewhere.
    Download SuperAntiSpyware ‘n Malwarebyte’s Anti-Malware instal and run on your externally connected hdd.
    This should help and will not get you frustrated how to pass the windows initial screen blocked by ThinkPoint graphics.

  64. sTEFAN
    Oct 22, 2010 @ 01:55:52

    Also, remove any .exe files from you App Data folder. I found a few related to this ThinkPoint hotfix.exe file in the \AppData\Local\Temp\Low

  65. Evan
    Oct 22, 2010 @ 03:22:46

    Matthew’s solution method actually worked on my pc with vista. I scanned my pc with Malwarebytes; but make sure use Perform quick scan instead of perform full scan. When I first used perform full scan, Malwarebytes was forced to close down; then I tried Perform quick scan. AND IT WORKED. I got rid of that hotfix.exe files and related files.
    Thank you so much, Matthews. :D

  66. Mark
    Oct 22, 2010 @ 11:01:46

    Mike thanks for tips. Running W7 and got to comd prom but hotfix is not found? Any ideas thanks this is driving me mad now 24 hours latter

  67. raffi
    Oct 22, 2010 @ 11:20:07

    thanks stefan! but for me it’s not possible to do this i think! mikes way is a safe one? i don’t wanna lose all my stuff! thanks

  68. raffi
    Oct 22, 2010 @ 11:53:13

    yeh, same with me, hotfix isn’t found!

  69. james
    Oct 22, 2010 @ 12:01:32

    this is my problem: when i try to open explorer.exe or mbam.exe it says i don’t have the authority to do it. somehow explorer poped up even though it didn’t allow it, but now i can’t get the antispywear thing going. im on a vista btw does anyone know what to do?

  70. Mark
    Oct 22, 2010 @ 13:05:28

    Guys, just did a system restore in W7 by pressing f8 when booting laptop. The gave me 7 options one of which was to go to a restore point. It did a scan and showed the thinkpoint having been instaleed would b removed. It seems to have worked. Done a full scan and cant find hotfix. Running Kaspersky and not found anything eithere. Scanned on other pc and found 3 so a neat piece of freeware. thanks Matthew and everybody else for commenting.

    Linda hope you got fixed :-)

  71. ajk
    Oct 22, 2010 @ 15:36:52

    I turned my computer on this morning and found ThinkPoint virus. Here is what I did:

    1. Pressed Ctrl+Shift+Esc, clicked processes and ended the process.
    2. Restarted.
    3. Made a new user account with administrator priveleges
    4. Copied all my old files which I KNOW are safe
    5. Deleted my old account
    6. Will go and buy some more protective anti-virus software

    Try these steps, they seemed to work for me

  72. Karen
    Oct 22, 2010 @ 16:39:20

    Thanks Chris OShaunnessy, you saved my computer! I have been going nuts since last night and everything you said to do worked.

  73. Prabhu
    Oct 22, 2010 @ 18:04:31

    I’ve the same problem as Linda (Comment1) and i tried the following as suggested by Comment 2

    hit [CTRL]+[ALT]+[DEL] and opened the task manager.
    From there, deleted “hotfix.exe” from the processes and then went to “new task.”
    Typed “Explorer.exe” when i hit enter i’ve got the following message
    in a window

    “Windows cannot access the specified device, path or file.
    You may not have appropriate permissions to access the item.”

    I ended up an admin issue here and need to fix this before i get my ‘Explorer’

    I’m unable proceed furthere. Can any one pls help?

    My laptop is Windows Vista (Dell) and i’m using my desktop for this.

  74. voulis
    Oct 22, 2010 @ 20:58:55

    hello.i got think point too and can’t get rid of it.when the logo showed up i tried to reboot my pc but did not work.anyway because i had to go i turned it off holding the power button for some seconds..when i started the pc the other day the pc run good for a while and sudenly there was a black screen and i can’t do anything to go on..what can i do?sorry for the lenght of the comment

  75. ric
    Oct 22, 2010 @ 21:29:16

    I got scammed by a company named Retail Software, I called them ask for my money back!

  76. Babiegurl
    Oct 22, 2010 @ 22:12:38

    Matthew.. You are friggin awesome! I couldn’t get past that friggin blue screen and was on the verge of tears! I’m glad I stumbled upon this site! I love all of you!

  77. Farrah
    Oct 22, 2010 @ 22:52:05

    Hello everyone, i got this ridiculous virus and i was able to fix one of my computers but for the other one, i can’t even get it to start in Safe Mode so i can follow the same steps for the one i fixed can anyone help me? when do click on safe mode it does a few lines of codes then just stops and when i load it normally it just goes to a black screen and can’t do anything. Please Please Help thank you

  78. Jason
    Oct 22, 2010 @ 23:00:14

    Hey guys, just fixed my virus by following the website posted by Matthew( the second post). Matthew, thanks a lot!

  79. Kimmie
    Oct 23, 2010 @ 04:14:16

    Hello everyone. I ended the process “hotfix” and then type in “explorer.exe” and nothing happens. I don’t know what to do next. This virus is really starting to piss me off. Some feedback would be greatly appreciated. I have windows 7.

  80. kim
    Oct 23, 2010 @ 04:49:14

    I am so happy I found this site. I was playing a Disney game with my nephew when think point came up. Luckily he was sitting beside me using another computer and I followed the early suggestions and so far I don’t have any problems. I looked in the registry keys and didn’t see anything. I looked in my documents and don’t see anything. I can’t find documents and settings for windows 7. Sorry to the ones who are having difficulty removing this nasty mess.

  81. lisa
    Oct 23, 2010 @ 05:14:19

    Wow, this is difficult. never happened to me before. Somehow I followed Matthew’s instructions. and deleted the file in task manager. now i have internet explorer up. i am going to do norton power eraser. wish me luck

  82. Nick
    Oct 23, 2010 @ 07:33:40

    Yes,

    This helped. Deleted all files from the app folder and ctrl alt del to stop it.
    Then reboot, and runt de malware byte scanner.

    Thnx!

    (thank god, i’m on a mac. Hopefully my dad will switch to now:))

  83. James
    Oct 23, 2010 @ 08:01:30

    okey so i did the steps ( instalf malmwearbytes and scanned my pc and got rid of the infected files) but now when i’m on my computer this message come up saying i dont have access same thing when i try to restore my comp. this happening to anyone els?

  84. raffi
    Oct 23, 2010 @ 11:08:26

    yeess, I made it!
    so I deleted the think point in the task manager, but I couldn’t do the explorer.exe! so there was the bar with the different things on my screen, so I clicked on security(the lock simbol) and there on the e for internet! then I could do it like matthew told us!

    thanks a lot guys!!!

  85. sharman1234
    Oct 23, 2010 @ 15:08:34

    I got suscpicious when it said that it needs to install some software to remove the Trojan. Checked it on another laptop and it came up as a virus. Didn’t let me bring up the task manager. I disabled the wireless internet connection and did a forced reboot. When the laptop started it showed the Thinkpoint screen and I let it do whatever scanning it was doing. I was able to get the regular desktop after setting up Thinkpoint to do some scans regularly. Once on my desktop I was able to do a system restore to two weeks back and everything is fine now.

  86. Angel123
    Oct 23, 2010 @ 18:01:15

    Hmmmm….I have read through all of these suggestions, and quite frankly, a several of them don’t work. I run window’s XP on an IBM Thinkcenter and run Norton2010 as my anti virus. Never open Emails from ppl I don’t know, never accept fr req from ppl I don’t know, hadn’t downloaded anything in several days and never go to untrusted sites because Norton doesn’t let me. Somehow still, I had contracted the Thinkpoint virus. Came home from work two days ago, turned on the computer, and bam…kept getting a cascade of messages from something called thinkpoint from Microsoft Essentials and my Norton kept popping up and saying it was blocking a virus and my system was secure. I kept trying to kill the error boxes by clicking the x at the top right corner of them without clicking on anything else because I didn’t want to accidentally trigger anything. Every time I did I got another error message. Figured it was a cascade virus of some kind at first. Disconnected from my modem right off. Tried to run Norton to search for the virus so i could go into my machine and find/kill it. Couldn’t. Decided to reboot and when I did, there was Thinkpoint. Had taken over my desktop. Wouldn’t let me do anything but run the fake scan everyone is talking about. When it was done, it gave me two options. One was to buy the fake full version of the program by entering my cc (which I was in no way stupid enough to do). The other was to continue unprotected. I clicked continue unprotected and it said it could not continue unprotected (so you really couldn’t get onto the net to download malwarebytes or anything to kill the virus, would have to have done it from a different clean PC…but even then, with the way Thinkpoint behaved, I don’t think loading it into my computer from a different one would have worked anyway) leaving my only option of entering my cc to buy the fake full version of Thinkpoint. I tried to reboot again in safe mode thinking I would run Norton from safe mode and search for and kill the virus, but Thinkpoint was there too. Same results as above. Could not continue unprotected. No choice but to purchase the full version of Thinkpoint. At this point, I shut down Windows and unplugged it entirely. Whatever it was, I didn’t want it to furthere damage my PC until I found a fix. We tried repairing Windows but at that point it was too far gone. We wound up having to wipe the drive and rebuild the OS. Since I had all my data backed up on a portable hard drive, I figured what the hell. I felt safer that way, at least I would know it was dead. Seriously though, this virus did that much damage in less than three minutes time. Scary. Especially since I have no clue where I got it. The first poster here said he got it from Google images which is scary because that shows you how easy it is to get this thing. It’s out there. Please be informed and safe.

  87. Zach
    Oct 23, 2010 @ 18:18:56

    Thanks mat you are a life saver!

  88. Anomonys
    Oct 23, 2010 @ 19:38:10

    If you get a black screen with the think point picture on it and no bar at the bottom you ca still open the internet. Just click ctrl+alt+delete to open task manager and select new task. Then click browse and select a program you want to run. Unfortunately the think point will still be there in front of programs so you’ll need to work around it.

  89. charlie b
    Oct 23, 2010 @ 20:32:51

    Chris O,your solution worked on my Vista. I already had the freebie version of Mbam so when I ended the hotfix process I went to the program file on new task and clicked on it then ran it with a fresh update. You are right, this is a nasty.

    charles

  90. jammer
    Oct 23, 2010 @ 22:57:16

    What should you do if your computer will not start because Thinkpoint is on your screen? pleas answer this urgent message

  91. jammer
    Oct 23, 2010 @ 23:20:54

    anonymous i did your solution but my mthere canot pull up the antivirus to get rid of it i really need a solution if anyone knows what to do please please tell me cuz this is just about killing my mother

  92. chris t
    Oct 23, 2010 @ 23:46:12

    will system restore do the trick?

  93. Beti13
    Oct 24, 2010 @ 01:01:51

    I wish I read your comments before, like angela123 I bought the full version of thinkpoint and I’m afraid now it might harm my PC and steal personal data from it. What u think i should do with this virus?

  94. Jordan
    Oct 24, 2010 @ 01:38:08

    guys,
    if none of the above don’t work the way i got rid of it was, launching the internet and going to “http://www.superantispyware.com/” and clicking on the free edition download from the main screen,
    then it runs and bypasses the thinkpoints ‘internet security settings’.

    p.s. seems like some of you are having troubles with geting the intenet up, another way of doing it is:
    1) ctrl+alt+del
    2) go to the file menu, press run
    3) click on the drop down menu, there are usually lots on internet address’ there :).

    Thats how i got my thinksmart away :D!

  95. Ed
    Oct 24, 2010 @ 02:33:01

    Hey…..Thanks for the great info. I followed the original suggestion after ending the “hotfix.exe” process and starting explore.exe. Got a browser, downloaded MalwareBytes, ran the program and UREKA…It worked. Thaks a million. This was done on a Dell Inspiron running Windows Vista Home.

    Ed Allen

  96. JC
    Oct 24, 2010 @ 05:14:24

    I could kiss you! Thanks for the help.

  97. uhoh
    Oct 24, 2010 @ 05:55:33

    Hey guys!!
    How could I stop hotfix? I pulled up task manager by ctrl+Alt+Del and tried to stop it but it just doesn’t work. Nothing is happening except error message!!
    Please help!!

  98. fresh
    Oct 24, 2010 @ 06:10:30

    press ctrl atl del and from task man. close process HOTFIX and it should close the think point then to start windows just go to run from task man and type in “explorer” without the “s and it should open windows

  99. uhoh
    Oct 24, 2010 @ 06:22:42

    Fresh! Thank you for your answer but it doens’t do anything even I highlighted hotfix and clicked the End Process.
    Can you tell me more on this? I am using XP home edition.
    Thax!

  100. Orlando
    Oct 24, 2010 @ 06:31:22

    It worked. followed the above instruction ref the original Chris or Matt! Boy i am lucky to have two computers. I thought i was done for and there was my term report gone. Thanks guys.

  101. jick
    Oct 24, 2010 @ 09:34:20

    Always make sure you have a second windows account. I was able to use the second account just fine while the other was locked by thinkpoint.

  102. Avii
    Oct 24, 2010 @ 10:17:08

    I recently was infected with this virus while researching anatomy reference (I’m an Art Major) on Google Images. I never realized it had affected my computer until I turned it on next. My first thought, as I’m not tech-savy, was that I should scan. I did, almost 6 times. Stupid huh? Anyway. After freaking out thinking my files would be lost forever, I had my gamer-boyfriend help me. All of this is credit to him! I Googled from my phone the virus and people were ONLY giving solutions for what to do BEFORE it officially settles in. I was way past that point, as it seems a lot of you are! So hopefully this helps. Thank God for nerd boyfriends!
    Click the menu button, right click command prompt and run as administrator.
    Type in tasklist /fi “cputime gt 00:00:00”
    A list should come up of a ton of different programs. You’re going to want to find hotfix.exe.
    Find the PID address (should be listed to the right of it, it’s just 4 numbers) . It’s best to write all of this down. I’ll use the PID address I got as an example.
    Then in the command prompt type in: taskkill / pid 2884 ( IE whatever the PID number is)
    This will send a termination signal to the virus. Type in
    If “Error: the process with PID 2884 could not be terminated. Reason: access denied.” Comes up, that’s because you didn’t open command prompt as an administrator. So no big worry.
    Type in tasklist / fi “cputime gt 00:00:00” again (quotation marks included!) and see if hotfix.exe is gone. If so, you’re one step closer to finishing! Now, at this point, you should be able to start the task manager (yay!) and the annoying pop up should go away. ALL annoying pop-ups. You’ll want to sort the tasks in the task manager by the highest to lowest CPU, by just clicking the “CPU” letters until the highest number is on the top. Only takes a few tries. Don’t worry if it’s flickering back and forth. Go to my computer, and click eithere “ C:\ ” or just “ OS (C:\) ” . Click it once, so it’s highlighted in blue but not opened. If this works for you (it didn’t for me) press Ctrl+F, go through the advanced search, and try to click the little box to the left that should say “search un-indexed”. That didn’t work for me, what I had to do was search “ search-ms: ” (colon included, no quotation marks), then a small bar came up asking me if I wanted to include un-indexed. Click it, then click yes, and search that again. It adds the table that has pre-organized names already in it. After this, you’re going to want to search “ search-ms: “ in the advanced search. If nothing comes up and it takes you back to the open folder”, then in my computer, search in the search bar to the top right “hotfix.exe” . Give it about a minute to load up, 3 files showed up for me. Once they’ve all loaded into the search results, right click whichever one of the files you want to locate first, and click “Open file location”. This way you can delete the file exactly where it saved itself, instead of it’s shortcut. Viruses are like bugs, they want to hide in very sneaky places. (mine hid in an old photoshop program!) Wherever it wanted to hide itself, it means that it’s a basic virus and installed itself as a normal startup file. Hence how it’s able to control a lot of what you can and can not do. The next and final step is to open all the file locations. Click the file, only once. The press Shft+Del on each. You should be good to go now! To make sure it’s working though search the hotfix.exe files again a few minutes later the same way you found them. After this you should be fine! I also suggest erasing your recent history up to a month, just to be safe from virus. I hope this helps!

  103. Patti139
    Oct 24, 2010 @ 12:58:26

    Thank you for all your help. I found hot fix in the processes under task manager and was able to access explorer and download malware. After running this cleaner I had 29 infected objects but was able to fix and reboot. System now seems fine, but I am running the program again to check. I appreciate all of your help.

  104. tee
    Oct 24, 2010 @ 15:04:30

    I had this problem last night & I followed all the instructions. I went to the task manager, downloaded Malwarebytes, did the scan & removed the infected files, but when I restart it again, the thinkpoint STILL shows up, and when I run the Malwarebytes, no files are infected. HELP!

  105. James Gallagher
    Oct 24, 2010 @ 15:27:03

    B Thank you! The task manager worked perfectly. Had a hard time finding the Think Point process, it was listed as HotFix

  106. James Gallagher
    Oct 24, 2010 @ 15:28:17

    B Thank you the task manger worked perfectlt think point was listed in processes as hotfix

  107. James Gallagher
    Oct 24, 2010 @ 15:30:28

    you really need to follow B’s way of gettig rid of Think Point to the letter.Follow it 100% as he states it it works

  108. jamessj52
    Oct 24, 2010 @ 15:32:09

    Do not buy the full version follow B’s instruction

  109. chris
    Oct 24, 2010 @ 16:00:26

    none of this worked…………at all!!!!! please some body come up with something for the computer illerite!!!

  110. Gary Manley
    Oct 24, 2010 @ 17:58:09

    @MATTHEW ..#2 POST.

    Thanks so much, your info got me out of alot of crap.
    It WORKED!!!

  111. Buzzkill
    Oct 24, 2010 @ 18:20:32

    For those suffering with complete lock up, I got past it by inserting windows xp disc and choosing repair/restore mode. that got me into windows and from there I was able to access task manager and turn off hotfix.exe. then i ran avira scan which did a good job but there was still a residual browser hijacker so you’ll still have to run malwarebytes but so far, so good….Good Luck!

  112. jamessj52
    Oct 24, 2010 @ 18:22:32

    Chris

    click on cntl bar open up task manager. click file on top left drop down opens click new task when box opens type in box explorer.exe hit enter windows should open click on processes in task manager find hotfix and end

  113. DaveH
    Oct 24, 2010 @ 19:06:25

    Pesky… Pesky… irritating virus!! Thanks for this website because I’d still be dealing with this irritating virus without it. Fortunately, with Malwarebytes, I was able to get rid of it… and, it really was simple too!

  114. Tara
    Oct 24, 2010 @ 19:16:07

    HOLY CRAP!! This is a nasty, nasty bug!!! Thank you so much for all your help! I’m running the anti malware now, and its found 195 infected objects…so far! Its not even done! I’m hoping this is the end of this crap, but its nice to know there are so many people out there willing to help! THANKS!

  115. hank
    Oct 24, 2010 @ 22:30:54

    IF NOTHING HERE IS WORKING YOU MAY WANT TO TRY MY SUGGESTION. I was unable to access the internet via icons;however, if you have google earth on your computer get on it now. Then zoom in to a resort or business which has an attachment to its website. Then you are on the internet and just seach for google and that will allow you to use the internet until you can have a professional look at it.

  116. rob
    Oct 24, 2010 @ 23:16:05

    The Think Point virus got on my laptop and the TP safe startup was run. I used some advice and got the PC running then tried to do system restore to remove the virus. Now all I get is a black screen when I start Windows up (can’t get to internet). I have F2 and F12 options at start up, but I’m an illiterate and at a loss of what to do next…. Please help…

  117. LJ SMI
    Oct 25, 2010 @ 00:51:31

    Chris OShaunnessy is awesome. His plan worked and I was able to get this little bas tard of a virus off. Thanks Chris!!

  118. Virginia
    Oct 25, 2010 @ 01:11:35

    Plz help!!! I can’t open explorer to download any anti-virus program. I gives me black screen and nothing else. Did he ctr+alt+del and run explorer.exe and it cannot find. How cam I open explorer to download anything.

  119. tash
    Oct 25, 2010 @ 03:20:03

    hey i got this virus..but it wont let me download malwarebytes nd i cant find a way to get around it.. anyone got any tips?

  120. Abby
    Oct 25, 2010 @ 03:26:12

    So, I did all the task manager stuff and when I typed in explorer.exe my computers saying I don’t have the proper authority to do it.. Help!

  121. Kevy Rae
    Oct 25, 2010 @ 05:05:39

    I just a helped a friend over the phone with this thing. Thanks for the tips here, the task manager trick helped.

    I first had her try to boot into the “safe mode with networking” and the darn virus still popped up! After reading here, I had her go ahead and reboot the same way, not touch the Think Point window, and go to Task Manager. I had her end the “hotfix.exe” process. After that, she could see her desktop and use Internet Explorer. I walked her through downloading, installing and running Malwarebytes. It found 12 infected items, removed them, and now her PC is fixed!

    Abby, you may not need to type “explorer.exe”.. This step was not needed for my friend. Ending the “hotfix.exe” process in Task Manager stopped the virus from running, so she was able to open her web browser normally from the desktop. Try that! If you can open your borwser, google “Malwarebytes download” and go from there!

  122. JD
    Oct 25, 2010 @ 15:18:07

    I have installed malwarebytes on my computer and I have run it. There are 3 things that wont go away.

    Registry Values Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Delete on reboot.

    Registry Data Items Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    They say there were deleted, but on reboot they are still there. If I run malwarebytes again the same 3 always come up. I tried going in and manually removing them, but when I try to delete them it gives me a message that says Unable to delete all specified values. Anyone know what I can do?

  123. Joey
    Oct 25, 2010 @ 17:08:16

    Thanx so much this virus was crazy , i just followed matthews 2nd comment and i just downloaded the free version of that malware program up top and it worked just fine. Im Glad this was the first page i looked at got and had it fixed in about an hour.

  124. Annie
    Oct 25, 2010 @ 17:12:30

    I’m using spyware doctor instead of Malwarebytes. It doesn’t seem to be detecting the think point virus.
    Has anyone been able to remove thinkpoint usig spyware doctor?

  125. Dan
    Oct 25, 2010 @ 17:56:03

    What happens if you click on Think Point start up safe mode?, and let it complete its scan?

  126. Kat
    Oct 25, 2010 @ 18:12:12

    Okay, Ive done everything up to installing and DLing Malewarebytes onto my desktop but when I click ‘run’ it doesnt do anything. No messages no errors, nothin. Im currently running Win7 on my Desktop which is having this issue but another odd thing is, Im not getting the Thinkpoint windows every log in(I just get the Black Screen of Death). I got a bunch of tiny windows before my comp crashed and rebooted by itself, which led me here. If anyone can help I’ve more than had my fair share of this virus. Please please help D:

  127. Splinta
    Oct 25, 2010 @ 19:07:02

    Excellent advise with the Malwarebytes pro. !!! worked for me no problem

  128. revealed by unknown
    Oct 26, 2010 @ 00:28:33

    read a book called The black book of viruses it explains that the people that make these are working for the anti virus company’s on the black market

  129. JAmesw
    Oct 26, 2010 @ 03:21:48

    wow – what a pain…

    Thanks everyone!!!!!

  130. Brad
    Oct 26, 2010 @ 03:40:36

    Matt, Thank you for all the info, it worked great. Been working on this virus all day. With your info fixed in about an hour. Thanks again

  131. sharongoers
    Oct 26, 2010 @ 12:48:43

    Thank you so much I got this think point on my computer, luckly I had an extra laptop to get into this site my other desktop is now working. I am very computer stupid so this was very easy to understand and I think I fixed it myself. Again, Matthew thank you, it saved me a trip to the repair guy.

    Sharon

  132. LB
    Oct 26, 2010 @ 12:52:30

    Matt – you rock!! Thanks for the instructions – worked like a charm last night on my dell laptop. Last virus cost me $200 to remove at the Geek Squad and got terrible service! I was so happy to be able to take care of this one without the Geeks at Best Buy :)

  133. Justin
    Oct 26, 2010 @ 12:53:53

    Hi All,

    I have tried removing this but no luck thus far. Now when I restart the computer in safe mode with networking & try to log in it wont allow me & returns back to the log in screen. Any help would be greatly appreciated. Cheers.

  134. Andrew
    Oct 26, 2010 @ 13:11:13

    MATTHEW IS A BEAST. THANKS MAN

  135. Justin
    Oct 26, 2010 @ 14:00:29

    Just a follow up from my previous post. Apparently my problem is a reboot loop from this ‘thinkpoint’ virus. Will downloading and running Kaspersky Rescue Disk 10 stop this reboot loop?

    Please help

    Justin

  136. Linda2
    Oct 26, 2010 @ 16:26:38

    I was not able to find the hotfix.exe process that everyone was saying to kill. Maybe it was because my computer was never completely taken over and never rebooted. It did have the multiple ThinkPoint virus pop-ups though and I could not see behind them. I already had MalwareBytes and I was able to update it and run it but when it finished I was not able to get it to show the results so I could not complete the final stage of deleting the virus and corrupted files. I read what Tran said about another process whose name was a string of numbers, so to get rid of the ThinkPoint pop-ups I did this: press ALT + CTRL + DELETE then I clicked “Task Manager”, I found the process that was a string of numbers and I clicked “End Process”. The ThinkPoint pop-ups disappeared immediately and I was able to click the “Show Results” button on MalwareBytes and delete the currupted files. I ran Malwarebytes again after I deleted the bad files and it did not find any other problems.

  137. Josh
    Oct 26, 2010 @ 17:35:56

    go to start, run, on the dropdown select regedit, then click shell and change what is currently there to explorer.exe and you will get your internet back

  138. Tim Koenig
    Oct 26, 2010 @ 17:55:54

    What you need to do is get into the task manager and end the process “HotFix.exe”
    If you are unable to get into Task Manager hardboot the computer into safe mode with networking. Task Manager should work then.
    Then download Malwarebytes, update it and run a full scan.

  139. Lisa
    Oct 26, 2010 @ 18:24:14

    I cannot get into safemode with networking. Was able to get into teg safe mode and do a scan with housecall but it came up with nothing… Any suggestions?

  140. Rachel
    Oct 26, 2010 @ 18:56:23

    OK, so an employee fell for it here at the office. Gave our credit card to these viral people. What now? Does anyone know if they actually have the capability of charging this or using the company credit card info? Do I need to cancel my card ASAP?

  141. JD
    Oct 26, 2010 @ 19:21:20

    Anyone have any ideas on what I can do? Original post 124.

  142. Leeroy
    Oct 26, 2010 @ 20:03:04

    What I had to do to help an end user at work with this problem:

    1. Have the afflicted user log in.
    2. When the Think Point menu appears, press ctrl alt delete, then open task manager.
    3. End the process hotfix.exe.
    4. The PC should load to the desktop as normal; if not, in the task manager select file > run, then enter explorer, as others have mentioned.
    5. Open My Computer, then go to the C drive.
    6. Click on the search button, then select all files and folders; search for hotfix.exe
    7. You should find hotfix.exe itself in the Application Data folder within the infected user profile, as well as a file in C:\Windows\Prefetch. Delete both.
    8. Log off, then have the afflicted user log back on. The malware should be gone.

    Hope this helps, and sorry if it’s beating a dead horse (aka others have already mentioned this). Just looking to lend a hand. :)

  143. Christine
    Oct 26, 2010 @ 20:05:55

    I actually signed up for the Think Point anti virus, my credit card was charged. What can I expect now?

  144. noob_smasher
    Oct 27, 2010 @ 00:35:44

    I got it about 20 minutes ago and removed it myself with malbyte. You will have to go into c:/users/yourusername/appdata to remove it

    Make sure you use folder options in the top and show hidden folders and files. It will be under a file named called hotfix.exe . there is another program called install you can use file asassin through malbyte malware also. You need to turn your internet off when this happens. I also went back and created those same files hotfix.exe and install to create future conflicts if this tries to sneak back on me. Made new rulesets in firewall for the new “fake” clone files I made. A very sneaky piece of rogueware. I am very thrilled at the chance to smash another attempt to noob :)

  145. Hevelin
    Oct 27, 2010 @ 01:27:58

    Id like to thank everybody for the answers, it truly helped me regain control of my computer!
    1. gotta love google!
    2. gotta hate hackers!
    3. Thank you all!

    I got rid of the think point screen by ending process in task manager hotfix or some random numbers then i managed to run malwarebytes!

    Running the full scan now… wish me luck!

  146. Dave
    Oct 27, 2010 @ 02:12:07

    What I really want to do is punch someone in the nose, preferably the person(s) that put this crap virus togethere. Now wasn’t that nice!

    ps. Thanks for the help all.

  147. Lynda
    Oct 27, 2010 @ 03:05:40

    All I can say is “THANK YOU MATT!” I was able to successfully remove that horrible annoying virus by following Matt’s advice (top of the page). I suggest try using Matt’s directions first, it could save you a lot of time. Thanks again Matt… you are awesome! Lynda

  148. Sarah
    Oct 27, 2010 @ 05:50:49

    so my question is: If we’ve had the computer techs in to run the malware bytes and apparently removed it, does the virus do any damage to any existing files or anything? I’ve heard something about it damaging the svchost file. Our system is running super slow since all the scans have been done. Not cool.

  149. Richard
    Oct 27, 2010 @ 11:52:59

    Matthew, thank you! Your solution did the trick.

  150. Robin
    Oct 27, 2010 @ 12:33:31

    I think its wrong that virus and pop ups can attach to your computer making internet and all your components not work claiming this and that. If you do not know technical aspects and viruses, well thinking that you have to buy their program to make your PC run right. Well I think there should be some kind of a way to be able to say no without blocking you from getting any where on your own system. I also would like to ask if anyone knows how to get a refund and to report on things like this. I work to hard for my money to be rip off like this and I would like to report and get my money back. Thanks, Robin McDowell

  151. mike
    Oct 27, 2010 @ 13:39:14

    Thanks for the help. This is why my new computer is a mac.

  152. Jeff
    Oct 27, 2010 @ 14:17:20

    I manage a 250+ node network and 2 of the machines have got this in the past 2 days. I have been dealing with crap like this for a while and the easiest way for me to get rid of them is to remotely kill the processes that don’t belong, then log into the affected machine and manually clean the Thinkpoint from the machine. My users are pretty well trained to not click on pop ups and such, but every once in a while they don’t listen. The machine I worked on this morning had a Microsoft Security Essentials alert on it saying the machine was affected. I took over the user’s machine and it really did look like a real Microsoft message…until it wanted to do an online scan. I killed the hotfix.exe as well as mstsc.exe which was dumped on the user’s desktop along with a batch file to run hotfix.exe. I deleted those files as well as hotfix.exe which was located in the user’s ‘application data’ directory (Document and settings\%username\Application Data, there is also a file just named ‘install that must be deleted as well. Once you kill the 2 processes above you will be able to do the cleanup.

    I have been doing this for over 20 yrs now so I will manually remove the spyware and registry entries myself because I can do it quicker than the malware scanners can. Well I’ve probably confused most of you by now so I will stop…sorry.

  153. Dave H.
    Oct 27, 2010 @ 14:30:15

    Glad I had a laptop web access when my desk top got infected. This site helped tremendously; thank you all. What I did was:

    a. Shut down / turn off all power, then power up again. This at least stopped the think point crap from telling me that I had to run that before doing anything else. I was able to see my icons, but anything I clicked on was still under the think point screen.

    b. No matter; doing the “cntl-alt-del” allowed me access to windows task manager.

    c. From there, I clicked on the “processes” tab, scrolled down and found “hotfix.exe”, clicked on that and then clicked on “end process”.

    The above process in itself seemed to take care of things. Yay!; I had my desk top back, but wasn’t sure if I needed to do anything else, since instructions above says to download the precise security program. I did not do so; I probably would have, but since I do have McAfee, I contacted them. They sent me an e-mail with an advanced scan program. After it gets through running, I am supposed to reboot.

    Good luck everyone.

  154. didier
    Oct 27, 2010 @ 14:45:29

    depuis quelques jours quand jallume mon ecran il apparait le site THINK POINT et je ne plus rien faire avec mon ordi quelqun peut il m adait s il vous plait merci a bientot

  155. Dan
    Oct 27, 2010 @ 16:55:05

    Unable to access Task Manager.When I turn on the cp, think Point pops up on the screen, when I click on Ctrl-Alt-Delete 11 Task Manager windows pop up informing me that Task Manager has been disabled. This is as far as I can go. What next??
    Again what happens if you were to click on the Think Point Safe start in the Think Point window & let it run it’s course??
    Then it ask for money Click cancel {or try to pay with Gold!}

    Dan

  156. Dave H.
    Oct 27, 2010 @ 17:08:47

    See 156. When I went to reboot after McAfee scan, whiuch said I was ok, think point came up again.

  157. NOOB BRAD
    Oct 27, 2010 @ 17:28:27

    PROBLEM

    Thinkpoint has completely shut down my internet. Cannot get online to download MAlWARE BYTES…. Please help.

    ( I cannot run a system restore eithere )

  158. She
    Oct 27, 2010 @ 20:56:51

    Thanks for all the help. Worked like a charm!

    Noob Brad, have you tried pressing alt ctrl delete as soon as the Think Point window pops up? If you can get into task manager and close out hotfix and then go to File > New Task and type in explorer.exe it should take you back to your desktop and let you onto the internet. From there you just have to download the program to get rid it.

  159. Peggy
    Oct 27, 2010 @ 20:59:54

    HELP!!! I’ve got the virus too on my desktop! After opening in safe mode, tried to find files in task manager but couldn’t. After reading some of the above comments, again tried to open in safe mode, but computer will only do a reboot loop and not allow any safe mode entry. What’s my next step??? Any help would be appreciated!

  160. NOOB BRAD
    Oct 27, 2010 @ 21:26:47

    SHE

    Yes…. ive done that. I can get to the desktop but Thinkpoint shut down my network…. Cant get on the internet

  161. Danie
    Oct 27, 2010 @ 22:54:13

    Thank you! Chris your solution worked perfectly! I was losing my mind working on this all day! I never would have figured it out on my own!
    Thank you again!!

  162. Bill
    Oct 28, 2010 @ 02:27:36

    These miserable scum bags have a 1-800-760-0917 number. They play terrible music for a couple of minutes. Then a middle eastern witch answeres the phone. Since my wife was out I had the opportunity to really let loose. Also, it was raining so I called several time.

  163. Erika
    Oct 28, 2010 @ 02:51:39

    I saw the Thinkpoint Virus and not knowing it was a virus I ran the software I regularly use that was already installed and see if I had any viruses. I removed some spyware entries and restarted my PC (since you are unable to do anything with the Thinkpoint Virus) and now my system won’t even boot up to the start menu for me to remove this virus! Help!!

  164. H
    Oct 28, 2010 @ 04:21:24

    hehe i just found a way to get into some windows, currently i have thinkpoint virus, i left clicked mozilla firefox/internet explorer and clicked scan with Norton thing, and then you click how to find product key, internet explorer/mozilla firefox will explain it with a page and then u can just go on any other website ^.^

  165. herman
    Oct 28, 2010 @ 04:23:31

    to get out of the think point safe mode, find a setting and check the box that says allow unprotected use or something

  166. Tony
    Oct 28, 2010 @ 13:47:00

    Thank you Mathew for your quick advice… you are correct with solution you explained to Linda… I got hit with the same malicious virus & I quickly used another computer to search for solution & yours was the one that save me. Thanks again…

  167. Jody
    Oct 28, 2010 @ 18:11:06

    I caught this too. It was keeping me out of IE, Task Manager, System Restore … anything that would help facilitate the removal of it. While messing around with Safe Mode starts etc I got into Task Manager (via CTRL/ALT/DEL) during it’s “scan” of my system shortly after power up…. I evidently found a vulnerable spot in its routine. I was able to kill it in Task Mgr and then imediatly did a System Restore … so far so good !

    Good luck.

  168. Tee Tee
    Oct 28, 2010 @ 19:11:53

    @Avii Thank You so much! Your instructions were perfect and I got rid of it. Thank You to your boyfriend as well.

  169. Laura
    Oct 28, 2010 @ 19:53:56

    OMG what a pain! I could not turnoff hotfix.exe through task manager, but since I have another computer I was able to follow the instructions for the Kaspersky Bootable USB Flash Drive. That did the trick!

  170. Tommy B
    Oct 28, 2010 @ 20:45:48

    This virus is a very EASY virus to get rid of. CTRL ALT DEL open task manager… delete the think point exe. file in Processes, named “hotfix.exe.” Once the processes deleted or ended.. Click on the “new” tab, click the option RUN

    type in the white area, “explorer.exe” press enter. That will give you your task bar and you can run a virus program if you have one.. If you don’t have one down load Malware bytes, if it doesn’t let you online. Go to another computer put the program on a USB Flash drive, and download it that way. If you keep running into any more issues, read above on the reg edit fixes that work..

    Probably the easiest virus that has been created out there that has already made 650,000 dollars in profit.. Equallying the best scam of 2010…

  171. Nikki
    Oct 28, 2010 @ 22:37:53

    Thank you Mathew that worked great malware bytes has saved me more than once I was able to get into my task manager thank you you saved the day and the toshiba

  172. Jackson
    Oct 29, 2010 @ 06:34:53

    Hey everyone, I got this virus from frostwire, I had only just gotten the program, the first item I downloaded contained this virus. I luckily have 3 user accounts on my laptop for the rest of my family, and only mine was infected with the virus, it had gotten to the point where not even task manager would function. I downloaded a virus removal program (I’m not sure about the name) and it scanned the computer for about an hour, and found 68 viruses! Im very thankful for the fact that I have an iPod touch to google it :D
    I hate people that waste their live making viruses. I hate them with a passion, and if I ever meet one, I will, for every person who has been affected by a virus, punch them right between the eyes

  173. Peggy
    Oct 29, 2010 @ 15:20:10

    OK, folks – downloaded Kapersky rescue disk file (had to visit a friend who had faster download than my dial up as it is a HUGE file) but when I tried the application to download it to my flashdrive, it came up with an error stating that the file was corrupted. Do I have to spend tlhree more hours at my friend’s house to re-download? Are there other options to make my laptop get out of the reboot loop so I can kill this ThinkPoint virus?

  174. Nick
    Oct 29, 2010 @ 16:47:52

    When the Check Point screen comes up instead of clicking “Safe Mode” hit ctrl-alt-del and under the file menu click on run a new task. In this window type in explorer.exe. You will then have your desktop and start menu available again. You can do this instead of clicking through to do a free trial.

  175. ben
    Oct 29, 2010 @ 20:17:14

    I just wanted to say that this page has helped me out a lot! I got the virus when i did an image search on google. nothing dirty eithere! Luckily I have another user account that I was able to log onto and it was not infected. Did a scan using SUPERAntiSpyware and it caught it. Hopefully it can remove it too.
    Also, to anyone who has given their credit card number to these people, CALL AND CANCEL YOUR CARD IMMEDIATELY!!! Try to stop payment as well if you can. Do you really think you can trust some unknown company/person who creates a virus with your info?!

  176. Paulina
    Oct 29, 2010 @ 22:28:34

    Genius Chris O. Comment N. 7 saved my computer. Thanks!

  177. A
    Oct 30, 2010 @ 03:59:24

    Hey what’s up, so I have had some trouble with this exact same thing except when I try to update malwarebytes it would give me a strange error code at first I thought it was because of windows 7 (64) so here’s what I did,
    -1 opened a file on a website (they got hacked :0 )
    -3Restarted my CPU because of instinct
    -2Got the think point screen
    -1Ctrl+Alt+Dle and ended hotfix.exe
    0New task -> explored.exe
    1-quickscan with old malwarebytes version removed 4 objects
    2-restart in safe mode with networking
    3-downloaded malware bytes (see second post)
    4-ran quick scan found 12 objects
    5-removed them a d ran a full scan
    6-everything came out clean :)
    Seems that the virus had put a bug and every time I opened an Internet tab it would say an error occurred and would not display anything. The first scan with old updates seemed to fix this for the 2nd start up.
    I haven’t seen a windows 7 with 64 post (although I’ll admit I didn’t look very hard) but I hope this will help someone who is having the same Internet issues.
    Happy to help :D

    -/a/

    Note* if explorer.exe won’t run try to run it again but before you hit run look for “run under administrative permissions” it something related to that. This was a problem for me and hopefully won’t be for you.

  178. Michael
    Oct 30, 2010 @ 04:35:53

    I’m having the same problem and none of these suggestions have worked.

    My laptop is low powered so when the ThinPoint splash screen came up, sometimes it wouldn’t load and I would still see some of the blue windows logo where the ThinkPoint screen should be. So I thought maybe if I run it in safe mode and then at least let the program run, then I can uninstall it. Well I did let the program run in safe mode but now I can’t bring up Internet Explorer. I can’t do any of the other suggestions like bring up Task Manager. I’m running Malwarebytes in safe mode but because of ThinkPoint, I could not update Malwarebytes before I ran it. Any methods of removing this thing that have not already been mentioned would be appreciated.

  179. Michael
    Oct 30, 2010 @ 04:36:41

    By the way I’m running Windows XP Media Center on the laptop that got infected.

  180. Jackie
    Oct 30, 2010 @ 06:12:35

    I got it out-of-the-blue, no idea what I did wrong. I was on my everyday websites. But after freaking out, I went on my main computer and found this.
    Helped. A lot.
    The only thing I worry about though is if it CAN’T be deleted, as in it is not picked up by the scanner (which I had downloaded already <3).
    What then?

  181. Gionny
    Oct 30, 2010 @ 10:22:47

    salve anche io stesso problema ho preso dei suggerimenti ed ora provero a risolvere il tutto ma se non ci riesco sara possibile formattare??? vedo che le procedure non sono uguali per tutti io ho un asus vecchiotto con xp

  182. Frank
    Oct 30, 2010 @ 16:16:01

    Matt, thanks for your advice I removed that nasty think point virus

  183. Jen
    Oct 31, 2010 @ 00:19:20

    It sure seems like all this advice would work…it doesn’t for me.

    I have a Windows 7. Every time I hit CTL+ALT+DELETE, it brings me to the log off screen, asking if I would like to log off or switch users.

    I am not in the admin account on my laptop (I don’t have access to it at all). I can’t access the Task Manage–it just brings up the log off screen, like I said.

    Help?

  184. Michael
    Oct 31, 2010 @ 00:51:56

    You need to get the Admin to log in and run in Safe Mode. When you restart your computer, before it gets to the Windows screen, press F8 and that is how I start in Safe Mode. When in Safe Mode, bring up the task manager and remove the process hotfix.exe

  185. Kris
    Oct 31, 2010 @ 01:50:08

    I followed what Matthew did in #2 and it worked. THANK YOU BIG TIME MATTHEW!!! Here is what I did. First, when thinkpoint virus was trying to load in windows, I hit control alt delete several times. When the task manager loaded, I went to processes and deleted “hotfix.exe”. This allowed me to get to my desktop and I opened explorer. From Google I found found Malwarebytes Anti-Malware on CNet and downloaded it, installed, and ran it. I then scanned my entire C Drive with Malwarebytes. It took 2 hours but it found the “hotfix.exe” application, quarantined, and deleted it. I was able to reboot my computer without thinkpoint appearing again. This nightmare is thankfully over.

  186. Matthew Mansfield
    Oct 31, 2010 @ 02:34:25

    Alright everyone this virus was a fun one!

    Here’s the setup:

    You don’t have Admin access, so there is no:

    restarting in safe mode (via F8)
    accessing hidden files or folders
    restarting using Administrator and messing with anything

    So, basically all you see is this annoying Think Point screen when the PC starts up. The taskbar is gone; win+R (run command) is disabled by I.T. Dept.; how do you get ride of this thing?

    It has disabled explorer.exe and the only thing you see is the annoying virus GUI.

    Here’s how I did it:

    Step 1:
    When your PC first starts up and that Think Point screen is first appearing CTRL+ATL+DEL like your life depends on it. The virus has some flaws in the coding and it hesitates some times when the PC boots. Don’t click on the GUI or any of its buttons and stay strong with trying to pull up your task manager. I had to do it a few times but finally it worked. Now, your task manager will appear.

    Step 2:
    All I could see was what was running. I have no access to the win+R (cmd window) so I can’t hard start anything. What worked for me was I looked at the processes that were running, selected Hotfix.exe and killed the process that belongs to this virus. Now, all I had running was the task manager (and other supplementary programs, but the only GUI (graphical user interphase — pronounced “Gooey” in the nerd world) I could see was my task manager.

    Step 3:
    Go to “Help” and go to F1, or the basic help area for the task manager. It opens a help index window where you can read annoying facts that don’t help you in this situation.

    Step 4:
    Take your cursor and right click in the area where the text is (or where the explanations/definitions are). Select “view source”. This will open up a notepad text document with the source code for that page. Now comes the magic – go to “save as” (like you really want to save that source code garbage *sigh*). I’m sure you see where this is going, right? now you have a window open, granted it’s a save dialog box but from there go to “My Computer”, “My Documents” or what ever folder (notice I said “folder” because you want to open a literal folder because this will open explorer.exe to do that for you) and right click and select “Explore” or “Open”.

    Step 5:
    BAM! Now you have your explorer.exe executed. Your Hotfix.exe is disabled and you have control back. The darn thing nests itself in your C:\Documents and Settings\[USER NAME]\Application Data file (at least it did for me; you may need to look around for yours but it will be in the app data/temp files area). Also, you can search for it if you wold like. Again, it’s called “hotfix.exe”. In that location there will also be another file or two that you need to get rid of. It will be a .exe file with a string of numbers (mine was “362944031.exe” and also another “362944032.exe”).

    Step 6:
    Get rid of all of those buggars! If you just get rid of the hotfix.exe file the others are there to recreate the hotfix file (so you will be back where you started).

    Step 7:
    Now that you have control over your PC again and that annoying virus is gone run a malwarebytes scan or spybot scan to get things all cleaned up. I would recommend using Avast (free antivirus software you can download from their website at avast.com as a really solid anti-virus program. Run all your scans, clean up shop and enjoy your freshly cleaned up PC.

    This Hotfix.exe virus takes on a bunch of different faces and may not look like the images displayed on this page. I’ve removed it off of several different stations and each mask has been different (but it’s behavior, location of embedding, and format have all been the same).

    I hope this helps someone out there in cyberspace!

    Cheers all,

    Matt~

  187. Matthew Mansfield
    Oct 31, 2010 @ 02:43:05

    Post Script~

    I’m terribly sorry but I failed to advise how you would navigate to a file you can’t see! All of the app data files (Application Data and Temp files) are hidden.

    Use Freecommander, it is a portable browser (or explorer program) you can run off of your thumb drive and it will allow you to see hidden files and folders. You can download a copy of it here: http : // www . freecommander . com/fc_downl_en.htm

    That is how I was able to navigate to those files and get ride of it without administrative access. You may not be able to download/install spybot or malwarebytes if you don’t have admin access but if you follow the steps provided and just delete those files along with the hotfix.exe file you will be just fine.

  188. Raphaelle
    Oct 31, 2010 @ 03:25:17

    I did absolutely EVERYTHING…
    Even Kaspersky…
    My task manager, even by deleting the process «hotfix» did not give me acces to my desktop..
    I had already installed Malewarebyte’s Anti-Maleware..
    (But, as soon as Think Point got on, I obviously couldn’t run it…)
    I also have AVG-Free, and YourUninstaller and SmartyUninstaller.
    But, since I can’t get to my desktop, I can’t access anything.
    Running Kaspersky worked, I could perform a full scan, but when came the time to delete the files, I ended up with this:
    – Result Detected: 1
    – Result Untreated: 1
    – Result Deleted: 1
    – Result Processing Error: 250
    – Result Task Started: 1
    – Result Task Completed: 1

  189. Raphaelle
    Oct 31, 2010 @ 03:27:21

    ..and now, even by running the Task Manager, I can’t have access to the «process» tab anymore. I only see the main window. And it’s empty…

  190. Raphaelle
    Oct 31, 2010 @ 04:33:22

    I just ran Kaspersky again…
    And it worked!!
    Thanks a lot !!!!

  191. PARSHANT TYAGI
    Oct 31, 2010 @ 07:45:45

    dont worry ,
    think point is a virus that is fully fraud and show world leading security on a blue screen with two mode due to which u unable the any program so please relax and follow these step confidentally ,….
    1> restrat your Windows.
    2>press f 8 again and again now u have a black screen with many attributes
    3>select command prompt with the help ur keyboard then enter
    now u on the command prompt
    4>type c:
    5>type attrib for see ur c attributes
    6>attrib -r -h -s hotfix.exe enter
    7>del hotfix.exe enter

    hotfix.exe is a file in ur c documents and settings\ application search in c manually that is a virus
    if these 7 step doest work then
    >>>>write control on command prompt>now u have desktop screen and control pannel go in my computer /c documents and settings /aplications or may be any name and delete hotfix.exe
    then restart ur pc and press f 8 open window in normal mode scan with antivirous and enjoy
    please if this work properly then mail me at monutg89 @ gmail . com
    ur PARSHANT TYAGI ROORKEE

  192. nikpacara
    Oct 31, 2010 @ 19:49:55

    i agree with Matthew’s solution but i could add something more…
    after your explorer shows up go to:

    at
    C:\Documents and Settings\[USER NAME]\Application Data …
    look for files with extension “.bat” DELETE them
    look again for some Unknown folders with strange name like “aAScx%dlk” DELETE them too

    after go to:

    Start > RUN >(type: regedit)ENTER

    at
    My Computer do Ctrl + F and type hotfix.exe and hit ENTER… delete all what the search find

    also search for Think Point…
    good luck

  193. Mal
    Oct 31, 2010 @ 22:39:34

    This SOB virus needs to be cleaned from a boot disk !
    I used the AVG bootable (google it) download and burn the ISO.

    Change the boot option in BIOS to boot from CD, and run the boot scan,this may take all night !!!!!!

    I could NOT get Avast to run,I was hoping to use it’s boot time scan.

    So, Malwarebytes update run a scan, then run an update again, scan again.

  194. Mal
    Oct 31, 2010 @ 22:42:52

    I would also suggest you check that the windows firewall is still running, check various websites.
    Also check that all is things are running as per normal.

    This SCAMware, is probably the WORST I have ever seen
    it has a rootkit and works in safe mode as well.

  195. Mike D.
    Nov 01, 2010 @ 00:27:26

    I tried to follow Matthew’s steps but when i tried to end process on hot fix.exe, the task manager basically froze. Can’t go any furthere. Any thoughts?
    Mike D.

  196. Rob
    Nov 01, 2010 @ 02:49:19

    Finally got rid of this thing after many hours. Very frustrated here. I noticed that there is an address or contact to purchase the full version of this crap. Can’t this information be used to trace to the scum that wrote this thing? They need to be behind bars. PC’s at a clinic were affected.

  197. vince
    Nov 01, 2010 @ 03:42:03

    dear Matt!
    thanks for the suggestions. for me it was disabling hotfix- that was the key to getting control back.

    you rock!

    -Vince

  198. Bibi
    Nov 01, 2010 @ 04:52:15

    THanks B, it worked!
    I got this ThinkPoint a couple of days ago, and it looked unofficial… I did run Safe Start Up intitiallly then suspected it was a virus, then immediately stopped.
    Now I just need to remove it permanently from my laptop! Thanks a lot!!

  199. Scott
    Nov 01, 2010 @ 05:32:07

    I was able to get around Think Point only by using DOS. The Microsoft instructions at http : // support . microsoft . com/kb/304449 made it very simple, actually.

    I was unable to use CTL+ALT+DEL or CTL+ALT+ESC to do anything more than delete hotfix32 from the process list. So I used the Command Line info to get around Think Point and open System Restore, then picked a day previous to the day I acquired the virus. It worked like a charm! I have yet to run a Malware Bytes scan, but a full McAfee scan turns up no infected files now, and a search of my drive turns up no Think Point files (by name).

  200. ky
    Nov 01, 2010 @ 06:55:31

    I need a solution for removing Think Point virus but i know you need to download Malwarebytes Anti-Malware but i dont have the money to pay for it. so what do i do? is there another way i need this off my computer. sumbody please help me ASAP!!!!!!

    thank ky

  201. NickLockard.com
    Nov 01, 2010 @ 09:15:05

    Incase you feel like you have no other options at fixing your computer, you do not have to format / install windows, system restore / restore to factory defaults. Don’t risk losing any more data or time then you have to. Let us remove it for you and get you backup and going.

    We have already helped hundreds of people with this infection, so what are you waiting for? It’s not going to fix it’s self, it’s only getting worse.

    Don’t end up like a few client’s that have contacted us to late. Trying to fix it your self can lead to MORE DAMAGE & Data loss! You risk it all when you start messing around poking at it.

  202. eddi3
    Nov 01, 2010 @ 09:29:16

    Yesterday I notice this think point virus and Malwarebyts antimalware did the work.I had older version and it couldnot do anything so I downloaded and instaled a new version.
    After a download I checked for updates and then ran a full scan, deleted all that was found and laptop is running fine now.
    @ky : you dont need to pay for malwarebyts it is free to download

  203. Carlos
    Nov 01, 2010 @ 09:40:49

    Matthew, I want to thank you for your suggestions to get rid of this crap. I followed your guidelines and “killed” it. I also deleted the temp files and run my anti-virus software after I rebooted and it’s now working fine.

    I concur with the person who said that it was great to see so many people helping those in need.

    Good luck to all of you.

    To K #14: I had a good laugh with your description of the dirtball who started this and I agree with you, however, if I may add, he’s probably in his 30’s, lives off some program that feeds his face, and thinks he’s independent because he lives in a seedy basement (mother’s basement, of course).

  204. nelo
    Nov 01, 2010 @ 13:25:39

    Matthew i just followed your instruccions and worked perfectly thanks
    you saved me a lot of head ache

  205. May
    Nov 01, 2010 @ 15:46:37

    Thanks for the information (great to confirm). Thinkpoint wasn’t being detected by Malwarebytes when it first showed up (before it became thinkpoint it was a Microsoft security thing). I figured I might as well download it and run Malwarebytes again and it worked! So just have patient and the virus can be beaten.

  206. ky
    Nov 01, 2010 @ 17:37:30

    hello can sum1 help me, reply back 2 me? I need a solution for removing Think Point virus but i know you need to download Malwarebytes Anti-Malware but i dont have the money to pay for it. so what do i do? is there another way i need this off my computer. sumbody please help me ASAP!!!!!!

    thank ky

  207. Mark
    Nov 01, 2010 @ 17:42:10

    Thanks everyone! Between the Kaspersky bootable USB drive, and subsequent Malwarebytes scan, 6 infected files were removed, and NO MORE THINK POINT! Would have never found this on my own, especially since Norton Antivirus and SpyBot did not find them – thanks again!

  208. Carlin
    Nov 01, 2010 @ 17:53:30

    got this virus on google images as well, i was trying to find a map for my project. gah. i’ve found Chri’s solution to be the best so far, especially for windows 7. i’m running the malware now to get rid of it, but if that doesn’t work there’s always the system restore fall back. TO ANYONE STILL UNSURE IF IT’S GONE-

    just do system restore. this isn’t the first spyware virus i’ve gotten, and that gets rid of it.

  209. Carlin
    Nov 01, 2010 @ 17:58:44

    KY, just use the trial version. once the comp is clean u can run the system restore and get rid of the trial and any last traces of the virius itself

  210. Bliss
    Nov 01, 2010 @ 18:01:57

    We tried alot of different proceses but in the end we went and did what #7 said and it worked! (GO to CTR-ALT-DEL open task manager, go to processes and right click on “hotfix.exe” and click delete. IT WORKED! thanks #7

  211. Autumn
    Nov 01, 2010 @ 19:24:43

    THANK YOU, THANK YOU!!
    All your advise was a HUGE time & money saver.

    I talked to the HP customer center about my problem with ThinkPoint and they said they could help, but I would need to buy some “support doc” security for $299/24 months!!
    Turns out all I needed was some “helpful” advise!

    I went to the task manager and removed the “hotflix.exe”. Then I went to “new task” and entered “explorer”. Worked perfect!

    Thanks again!

  212. ky
    Nov 01, 2010 @ 19:25:53

    oh my gosh im trying to get help here or find out sum things and no one can help me. please help im number 213 now and 204. plezzzz help isnt that what this thing is for any way?

  213. Alyssa
    Nov 01, 2010 @ 20:01:10

    I don’t know how this got on my computer, but it was on there when I turned it on today. I use FireFox as my browser, because internet explorer does not work due to virus. I tried to click accept to get online, but it won’t connect, because it tries to use internet explorer, and I can’t get onto FireFox. How do I get rid of it? The Virus protection I use didn’t even pick this up, and is not helping me now.

  214. Kyle J
    Nov 01, 2010 @ 20:02:46

    I just got the Think Point virus but my Norton 360 got rid of it along with 97 other viruses upon restart after doing a scan and while it was scanning I was still able to use other applications including Google Earth but no IE eXPLORer.

    The only thing blocked was the internet which clicking “Go unprotected” wouldn’t work and I couldn’t clickon eithere IE or FireFox. :(

    Norton 360 is very good if you have a faster newer computer within the last 3 years or it will slow the !$!#24 out ofyour OS.

  215. Kyle J
    Nov 01, 2010 @ 20:05:27

    Whoever made this virus should be in Prison for life or shot since these viruses can affect the outcome of actual businesses as well as personal recreation.

  216. Nal
    Nov 01, 2010 @ 22:09:11

    Pls pls pls i need help. I can’t seem to pass by “task manger” and how do i delete “hotfix.exe”? i am able to log into a different account on the same laptop!! its driving me crazy spent all day on this :(

  217. erin
    Nov 02, 2010 @ 00:53:58

    Thank you so much. I was like out because this virus just invaded my computer when i tried to open up a website and then was blocking all of my applications. I tired to use another machine to do the Kaspersky Bootable USB Flash Drive but it didnt work and then i just didnt know what i was going to do, then i started reading the comments and noticed that i had the same problem as Linda, so i used your task manager tip and got around it. I then downloaded Malwarebytes’ Anti-Malware and it worked great. thanks so much for your tips :)

  218. SUZIE
    Nov 02, 2010 @ 01:45:09

    Thank you all who posted ….now on my way to download the malwarebytes!

  219. Kathy
    Nov 02, 2010 @ 02:27:50

    Thanks for all the advice! I was able to remove it by going to taskmaster and removing hotflix….laptop now working fine…what a lifesaver :)

  220. dee
    Nov 02, 2010 @ 13:40:55

    you nearly people forcing yourself on them

  221. dee
    Nov 02, 2010 @ 13:41:47

    you nearly rape people forcing yourself on them

  222. heather
    Nov 02, 2010 @ 14:57:42

    i couldn’t get into task manager at all but i finally did
    -start
    -search
    and got into google that way. i was able to google malwarebytes and download the fix. ha, ha, creepy guy living in your mom’s basement: i’ve won this round!

  223. E.J. A.k.a Eric Johnson
    Nov 02, 2010 @ 18:34:40

    Thanks to everyone that contribtuted to this page. I was also infected wit thinkpoint, luckily I found this site and it helped me a lot. For everyone, to matthew, all the way to heathere, thanks a lot also.

  224. new user
    Nov 02, 2010 @ 18:49:13

    If Ctrl+Alt+Delete doesn’t work for you there is another alternative I have discovered. Before you click on your account, create a new account. You can then go into the new account and download a software such as Malwarebytes to remove the Think Point.

  225. E
    Nov 02, 2010 @ 21:24:38

    Hi, My problem is that I cannot get to the task manager. When I reboot in safe boot and then ctrl, alt, del I cannot get to the task manager screen?

  226. harry
    Nov 02, 2010 @ 21:55:11

    Got this virus and it’s nasty ..QUite a few of these around ,they must be very profitable …Fortunately I had a windows “rescue disk” . By having the computer boot from this and using the restore option I was able to restore to an earlier time ..You can use any rescue disk that you can download or the one that windows tries to make you do on install …Good luck
    Harry

  227. Kima
    Nov 03, 2010 @ 02:33:08

    I want to say thanks for the tips to get rid of think point. I did not put a spy ware on yet but by giving me the name of the file, i was able to go in and manually stop running the program then going to search and finding the individual files to delete them. Thanks so much. Muah

  228. Neal
    Nov 03, 2010 @ 02:36:01

    I was nailed with this stupid thing tonight. All I did to get rid of it was log in under another account on the Windows 7 desktop, and performed a system restore to an earlier date…about a week ago. No problems, since. It’s a simple fix!

  229. Kima
    Nov 03, 2010 @ 03:07:32

    Did not think of that at all. Something for future reference. I am usually good at spotting these things but since it had the microsoft logo I was fooled. Glad to know there are people out there to teach me the tricks of the trade.

  230. Alan Martin
    Nov 03, 2010 @ 08:56:50

    Alan replies, hit [CTRL]+[ALT]+[DEL] and open up the task manager. Delete “hotfix.exe” from processes tab, go to “new task.” Type in “Explorer.exe” open internet explorer, then scan & remove the nasty blighter, fixed it for me, thanks.

  231. 2smartpc
    Nov 03, 2010 @ 14:18:23

    Ok guys, here’s how to effectively remove the virus and secondly, better protect your computer from future infections.

    Removal of most known viruses: log on to your pc in safe mode. If you haven’t already, download antimalwarebytes. Install the program still in safe mode. Go to control panel, user accounts and create a new “administrative user account”. Make the account password protected so no one will use that account. NEVER give ANYBODY this password.

    Log off of the current user account and log on to the one you just created. The reason for the second account is, most trojans only affect the logged in user. Even though the files are on the same hard drive, it will not affect another user generally. Make sure you DO NOT share your files with other users or across the network.

    Once logged in to the new account, run antimalwarebytes to remove the infection. This program is FREE and will find anything known to it’s database. People think an antivirus/antimalware program will protect them from anything. That is completely false. These programs can only protect you from the things they know about. Just like we cannot fight a disease we’ve never heard of. I hope this helps.

    Lynn

  232. joe
    Nov 04, 2010 @ 00:49:51

    i think i downloaded the malware free program but i cant find it or run it

  233. jennybean
    Nov 04, 2010 @ 01:03:12

    Matthew–wanted to thank you !! Followed your steps & it was gone within seconds! You are AWESOME!

  234. davek
    Nov 04, 2010 @ 02:45:00

    I’m an experienced computer user, but I’m not experienced in dealing with its programs, so when I was hit by the ThinkPoint virus it was a real problem. I knew I needed help and that I could possibly find it on-line but my system was blocked and I didn’t have access to another PC to find possible solutions. Then a friend advised me to stop worrying, take my PC to BestBuy and let their Geek Squad fix it for me.

    The guy on the desk there immediately did the “open Task Manager/delete hotfix.exe/run Explorer” quick fix which got the computer started normally but then he told me that unless I removed the virus entirely, I wouldn’t be able to work for long before it came back and took over again. He also mentioned that this virus installs itself in many locations, the most he had heard of was 174 different locations, so removing it entirely could be eithere quite easy or extremely difficult.

    It cost me their standard virus removal fee of $200 to get rid of it…a lot of money for a retiree like me, but next day I got my computer back, all of my important personal files intact and my life back, completely virus free. Having read many of the stories on here from people who have tried and failed to fix this virus, at least I now feel much better about paying that £200.

  235. NajOn
    Nov 04, 2010 @ 03:23:44

    I tried to follow this directions but when I tried to pull up the task manager it wont let me get to the processes it’s like a blank task window… Any ideas what to do??

  236. SEANI
    Nov 04, 2010 @ 10:24:05

    I parted with $89.00 and was conned out of this I have now removed think point, but how would I recover my money? Any advice you can give me would be great, thank you.

  237. SnaGLe
    Nov 04, 2010 @ 22:26:00

    For three days I try all the solutions to recur desktop with nothing but fail. I have Windows 7 and I think that this does not work with explorer, I get an error that the windows 7. The viruses have managed to escape but fail desktop with no solution. (excuse me english)

  238. Kim
    Nov 05, 2010 @ 02:29:40

    To everyone having troubles getting around ThinkPoint in order to open windows and begin the deletion process try this:
    completely shut down the computer.
    as you press the power button continuously press the f11 button until it says “Opening windows files” wait until you see a black screen with a list on it.
    Click “System Restore”
    Restore your OS to an earlier time.
    This will allow you open access to the internet in order to get rid of this virus.

  239. Sumedh Sawant
    Nov 05, 2010 @ 16:19:43

    Hi

    I too had same problem with Think Point. I tried following things and so far they have worked. When you start your machine the Thinkpoint window appears and asks for complete system scan. Dont press any button instead try following:
    1. Press Clt + Alt + Del
    This will open task manager. Choose processes
    2. Scroll down till you see hotfix.exe
    3. Stop this process. A warning message will be displayed but ignore it.
    No items of the desktop will be seen.
    4. Now press new task button.
    5. Type explorer in the box. Icons of your desktop will appear.
    6. Click start button.
    7. Search for system restore.
    8. Open the file and restore the system to the date when it was running fine.

    Hope this will help you.
    Thanks

  240. Goose Slayer
    Nov 05, 2010 @ 20:32:52

    Take out your hard drive whethere if it is your laptop or desktop. Have another computer with Malwarebytes’ Anti-Malware installed and updated. Then install your hard drive into the other PC and do a full scan with Malwarebytes’ Anti-Malware program. This should remove the virus.

  241. Thomas
    Nov 05, 2010 @ 21:32:45

    god bless you all, and to hell with all the hackers out there!

  242. Totallypdoff
    Nov 05, 2010 @ 22:00:36

    Hi everyone! I have read through most of the comments and thank everyone for posting help however I would like to say…I have managed to get my desktop up and running but the blue ‘think point’ ballax won’t go!!! It’s like it is stuck on the desktop – please help if you can
    Cheers

  243. C Thomas
    Nov 05, 2010 @ 22:02:49

    CANNOT GET RID OF THIS THINK POINT.

    HELP.

    WHERE DID IT COME FROM?

    wHAT IS THE BEST WAY TO RID IT?

  244. Sakthi
    Nov 06, 2010 @ 01:25:35

    Thanks a lot Guyz…I followed the procedure and it saved my computer.

  245. Paula
    Nov 06, 2010 @ 02:10:32

    HELP!!! I am able to go to Windows Task Manager but do not have the option of hotfix.exe to end. Could it be under another name???

  246. Laura
    Nov 06, 2010 @ 10:02:52

    Thanks to Matt and Chris in 2 & 7. Worked! Saved me derriere.

  247. carrie
    Nov 06, 2010 @ 13:32:37

    just wanted to say thanks to everyone for their help. Was infected this morning I used comment 2 to fix it.

  248. Krow
    Nov 06, 2010 @ 15:29:56

    After I read all the ways to get rid of think point, I decided to use the method they told me to use to get the task manager open. This is what I did, got my computer to shut down then turned it back on. The only thing that ended up staying on the screen was the desktop background and that think point virus. Without clicking on anything, I pushed -ctrl-alt-del-, and that opened the task manager. From there I found the process labeled hotfix and ended that task. Then ran explorer, that got the other stuff on my system to work. Now I didn’t want to download anything else to my computer. So I used my system restore. I restored my computer from a few days before the virus came and bingo, the virus is gone from my computer.

  249. Greg
    Nov 06, 2010 @ 17:25:38

    This is a virus. It is not at all clear how I acquired this trojan since our computer never surf questionable websites. My browser was up but I was not surfing the internet when a windows defender alert popped up. All I did was click the alert and thinkpoint took over my desktop. There was no obvious way to get rid of it and I did not consent for it to do anything. After I tried to shut down my laptop and got a fake start-up it was becoming clear that this was a fraud. Once it had control of my desktop it became clear that the only hope I had of accessing my desktop and getting passed their roadblock was to pay these scum 60 bucks. Then I had no doubt whatosoever that this was phony.
    I did manage to work-around it and here is how: 1) I turned off the power to get a real restart. 2) I used my wife’s log-on to get to a desktop and internet explorer since my log-on was hijaked by the thinkpoint trojan. 3) I google searched thinkpoint and this search quickly confirmed that it was a trojan malware program. 4) I downloaded a program which remove the virus from my system.

    Hopefully this solution will help others similarly effected by this vile creation of lowly criminals.

  250. JeffM
    Nov 06, 2010 @ 20:12:24

    I tried Malwarebytes Anti-Malware and pcreimage & niethere worked. Downloaded rkill.exe to a flash drive and ran that. Worked like a champ & FREE! Yay! Thanks rkill!!!

  251. Kim
    Nov 06, 2010 @ 20:17:02

    OK, I must have it REALLY bad! I’ve read all these comments and nothing is working. User clicked the safe install from Think Point. I was able to get rid of the Think Point “splash” screen using the end processes advice. I can now reboot my computer and it seems just fine, however I have no network, internet, or USB access. When I try to manage my devices to see why my network is not working…it is BLANK. Most of my programs are not working. I am at a loss, been dealing with this for several weeks now. Anybody recovered from an experience like this?? HELP!!!

  252. Kim
    Nov 06, 2010 @ 20:27:35

    …oops forgot to add…I can’t install and run malwarebytes (which has always been my lifesaver in the past) because I cannot start the internet, load from network drive, run from CD or from USB drive…

  253. Brian
    Nov 07, 2010 @ 02:05:36

    I went to the task manager, end hot fix process, went to services, clicked new service, typed iexplore.exe, downloaded Malwarebytes software, ran full scan, removed threats.

  254. Bruce Y
    Nov 07, 2010 @ 02:30:03

    Glad I had a backup computer. I had tried to delete processes, serveral reboots than through taskmaster got my virus program to work. Found this site for info and successfully did the “hotfix” end and not allowing my software to find and destroy “Thinkpoint”. Wondering if anyone has reported this program to stop future invations. Thanks to all of you…Bruce

  255. Stephen
    Nov 07, 2010 @ 02:30:45

    I have the same virus but I can’t even get in to desktop. The computer boots I sign in and it Thinkpoint pops up whit it request. I am at a lost at what to do.

  256. Tyler
    Nov 07, 2010 @ 04:26:40

    this virus some how stopped working =) from my xp computer because i was able to delete hotfix and use the task manager which was a surprise to me

  257. Cabaal
    Nov 07, 2010 @ 05:01:33

    Alright To all who don’t know. I’ve figured out how people are getting this virus.. Its alsoa PiggyBack .. It will hide on a website til something is download..

  258. Chris
    Nov 07, 2010 @ 06:18:15

    Startup in safe mode, then do a system restore to a date a few weeks before infection. It worked easily for us. Good Luck!

  259. Alec
    Nov 07, 2010 @ 09:37:47

    Alright i feel like i’ve almost gotten rid of this evil bit of malware but i’m doing a full scan with malwarebytes. its been going for almost an hour and is at about 201,000 objects scanned. how much longer will this scan take? it’s very late and i’m very tired. I don’t want to abort the scan because it says there are 7 objects infected and i want to take a look at them afterwards.

  260. RAJ
    Nov 07, 2010 @ 15:03:35

    MATTHEW.. BUDDY.. U SAVED MY PC.. TRUST ME.. (comment #2)
    i got it through google images, ran the safe mode of thinkpoint before, dont know if has damaged anything already. getting a free malware software from
    http://www.precisesecurity.com/tools-resources/adware-tools/malwarebytes-anti-malware
    hope it works (didnt have money for a licenced one.
    GUYS JUST FOLLOW MATT’s FIRST COMMENT (COMMENT #2). IT WILL HELP.
    THANX AGAIN BUDDY..
    GOD BLESS UR SOUL :)

  261. Helanna Shelley
    Nov 07, 2010 @ 15:34:17

    OK so I had this on my computer an hour ago. It removed access to safe mode, task manager, start menu etc. I had no access to the internet or any files, folders or programs at all. Just my wallpaper and the Think Point start window which you have shown above.

    I have managed to finally remove the virus thing by doing the following;

    1, Unplugged my computer and started it up again.

    2, When it started up I got my wall paper and the Think Point startup menu. Clicked on the Safe mode button which has let it run its fake scan.

    3, When the scan finished I just kept clicking the continue unprotected buttons on the 4 or 5 pop-ups that kept coming advising me to payup.

    4, Once all of the pop-ups have stopped coming.I clicked on the settings tab of the Think Point top menu and right at the bottom of the pop-up it gives you a tick box which says something like alow normal startup or unprotected start up (something like that). I ticked that and then saved the settings. This alowed me to come out of the program and brought back my desktop for use.

    5, I already had Malwarebytes installed but when I did a scan Think Point did not come up because the version of Malware I had is not the latest version. Because Think Point virus block net access I couldnt update to a new version as Chrome and IE would not work. Everytime I tried to update an error code kept on coming.

    6, I went onto the help section on Malwares menu to find out what this error code meant. I searched the word update in the help section and it gave me a list of error codes. Right at the bottom of the list as part of the final error code explanation it gave me a link to download something from Microsofts website.

    7, I clicked on that link and it gave me internet access through the help window. It opened Microsofts website. I used the search bar at the top of Microsofts website to search Bing for Malwarebytes. It brought it up!

    7, I clicked the link in Bing which sent me to Maleware’s site and followed the process for Malwarebytes new installation and it installed without a problem.

    8, Ran a scan with Malwarebytes and they found it and removed it. I rebooted my computer and then ran a scan with my anti-virus software and Super Anti-Spyware and it has gone!

  262. Graham.in.Dunstable.UK
    Nov 07, 2010 @ 16:40:31

    There seems to be confusion over virus infections and malware infections. Most anti-virus programmes were not originally designed to detect malware, so do not be surprised if, 1) you are infected by virus, and 2) your AV programme fails to detect or remove it.

    ThinkPoint is a programme that has eithere been (accidently) invited on to a computer or has found a way to install itself. Also know as fakeware or scareware, it runs a fake scan, and presents reports on bogus infections found, in order to scare the user into purchasing its “cure”. Like the more sophisticated type of these programmes, it attempts to prevent its removal by blocking access to the normal routes of remedy.

    I have just removed this virus from a PC running XP.
    1. I waited until ThinkPoint logo appeared on screen and pressed ‘ctrl~ez_rsquo+ez_rsquo~alt~ez_rsquo+ez_rsquo~delete’ keys togethere, which brought up the ‘Windows Task Manager’ window.
    2. I clicked on the ‘Processes’ tab, and examined the list of processes running. One, ‘hotfix.exe’, looked suspicious.
    3. I right clicked on this process, on the pop-up menu selected ‘End Process Tree’ and then clicked the ‘Yes’ button. (If I had selected to end a critical system process I would have had to restart the computer.) This removed the ThinkPoint screen.
    4. I clicked on ‘File’ on the menu, selected ‘New Task’, typed in ‘explorer.exe’ and clicked ‘Okay’. This brought up the normal start up window with the start bar and icons.
    5. I clicked ‘Start’, and then ‘Run…’. In the box next to ‘Open’ I typed ‘msconfig’ and clicked ‘Okay’. This brought up the ‘System Configuration Window’.
    6. I selected the ‘Startup’ tab. I expanded the ‘Command’ area by clicking and holding on to the vertical line next to the word ‘Location’ and dragging it to the right.
    7. I looked for suspicious entries and unticked them. (I could have disabled all – this does not remove anything from the computer – just stops things listed from being start when the computer starts – they can always be enabled again.) I clicked ‘Okay’ and then clicked ‘Exit without Restart’.
    8. I dowmloaded Malwarebytes which is my favourite malware removal programme, made sure it was up-to-date and then did a full scan. This found furthere viruses which I then told Malwarebytes to delete by pressing “Show results” and then “Remove selected” (following the instructions displayed.) (The WordPad document which pops up was quickly closed … it shows what will be recorded in the ‘Log’ of ‘Malwarebytes’.)
    9. When restarted Windows XP started up normally, with no sign of ThinkPoint. Because I had altered the Startup Items a System Configuration dialogue box appeared. I ticked the ‘Do not show this again’ and then clicked ‘Okay’.
    10. Whilst I did not rerun Malwarebytes – you might choose to do so as a failsafe.

    The free version of Malwarebyts does not offer live protection – you will need to purchase it if you want runtime protection.

  263. Shelley
    Nov 07, 2010 @ 18:23:44

    I fell for this, too, Linda! Ironically it happened within five minutes of downloading Microsoft Security Essentials. And I did exactly what you did…hit the safe start-up only to have the whole nightmare begin again. The only difference is my laptop is running Windows 7. I was able to go to system restore and the set point was right after I had downloaded security essentials and before the think point nightmare had begun. After that, internet access was restored and no sign of think point. Running malwarebytes as Matthew suggested just to make sure, even though a search for hotfix.exe turned up nothing.

  264. Greg
    Nov 07, 2010 @ 18:56:36

    This dastardly program is not finished. Please see my note #251. I used malawarebytes to remove thinkpoint. I still retained windows defender as my malware alert and defense and I am 100 percent sure it was up when the following happened: I was surfing the web on a site called newscientist.com when a java update window popped up. I clicked on the java window (nothing more) and guess what popped up next. You guessed it, thinkpoint. This it was the screen which forces you to select the run in “safe mode” option. I did not touch any aspect of the thinkpoint window pop-up and immediately shut down the computer from the startup icon. Sure enough after the restart thinkpoint had hijacked my log-on as it had before and started running. I used the advice I read here to bypass it this time. I hit cntr-alt-delete and got on task manager. I then shut down the hotfix.exe garbage. I then used the start tab and typed in explore.exe and got back on my desktop. I then confirmed that windows defender was still up and running.
    This is quite disturbing to me now. This virus trojan is able to bypass windows defender like it not even there. It jumps on during normal web-surfing, so it has infected numerous web-servers which have failed to clean it off. It tries to fool you into thinking it’s legit, but even if you try to bypass it, it still takes over you desktop and forces you to pay to get by it, unless you are savvy enough to bypass it. This is extremely diabolical and tehre should be a much more massive media reaction to this virus than there already has been. I would recommend not web-surfing for a week or more until everybody has done due dilligence and cleansed this filth from their servers.

  265. Greg
    Nov 07, 2010 @ 19:49:26

    I just wanted to add a couple of points. I have learned from this not to open any pop-up window when the web browser is up. I should not have to worry about that with an effective malware defense on, however this is the new reality. The other point was that this fake java update popped up on my taskbar rathere than on the desktop which made me think for a second that perhaps it was something I had left open. If my browser is on and any pop-up comes up (on the taskbar or on the desktop) I will immediately shut down the computer. I will have to get all of my updates directly from the vendors themselves from now on. This is the best way to aovid future mishaps. It is unfortunate that it has come to this.

  266. supersonic
    Nov 08, 2010 @ 02:14:11

    I believe i keep on getting what is called the “Black screen of Death”. However, no matter how many times I try by pressing Control Alt Delete, it will NOT go to task manager. the screen is all black with nothing but the mouse that will move. help???? please.

  267. THuis
    Nov 08, 2010 @ 03:19:04

    What a bugger! I successfully killed the bugger in under an hour! Another suggestion once you have followed the steps to disable it, download the Microsoft Security Suite – it’s free!!!!!

  268. Janet
    Nov 08, 2010 @ 03:26:26

    It took forever, but I finally got that horrible thing off my PC. However….

    Now I can’t get Internet Explorer to run. It does nothing at all upon request, it never shos up as a task. Nada.

    I have tried manually running it, and again, nothing at all. I have downloaded a fresh version and again, no joy.

    I don’t mind switching to Netscape, but I would like this working and I want my precious bookmarks.

    Please, any ideas on what happened?

  269. disco
    Nov 08, 2010 @ 08:56:45

    thank you all so much for all your information on the thinkpoint infection/virus. it was a tough battle but will all your help i won. thanks again. peace

  270. Zeppelin
    Nov 08, 2010 @ 10:40:58

    Hi,
    I had the virus think point, I managed to get rid of it using malwarebytes but now I am left with the black screen syndrom
    can anyone help me with this?

  271. Jon Rotten
    Nov 09, 2010 @ 16:39:17

    Turn off your PC. Turn it back on. Go into the task manager. Remove ‘hotfix.exe’ from the processes and then go to ‘new task’. Type in Explorer.exe

    Then open internet exporer and you a good to go. T also want to go into programs and remove the ThinkPoint from there and emty the recycle bin. After that just go to Microsoft and do a FREE scan or use you already installed anti-virus or anti malware software to scan your system and remove and other issue it may have created. No need to spend $24.99 if you already have software or can get it for free from Microsoft.

  272. Katewe
    Nov 09, 2010 @ 19:59:45

    Help!

    I cannot get an Internet connection so that I can update my Malwarebytes. Can anyone suggest a work around?
    Thanks!

  273. Alex
    Nov 09, 2010 @ 21:40:19

    Ok so got the ‘black screen of death’…..
    got onto task manager, type in explorer.exe…..nothing….

    nothings happening, can’t get back onto my desktop
    Help!!

  274. SexyLiz
    Nov 09, 2010 @ 22:45:19

    THANK YOU MATTT!!! LIFESAVER.

  275. Darren
    Nov 10, 2010 @ 11:10:02

    Matthew. I had the black screen of death so followed your instructions to the letter and I’m working perfectly again! You rock my friend. Thanks

  276. Hope
    Nov 10, 2010 @ 14:19:52

    When I go onto Task Manager I do not see hotfix.exe .. What do I do? This is the second time I got the Think Point Virus!!!

  277. Shalimar
    Nov 10, 2010 @ 16:57:53

    I have the same issue like everyone here.
    I normally use malwarebytes to remove malware from my system, but i took a diffrent appraoch. I used spybot s&d to remove think point and
    ran malwarebytes to sweep up what spybot may have not detected during its scan…… Everything seems to be working just fine.

  278. Laura
    Nov 11, 2010 @ 00:08:53

    OK my mom has got this virus called think point on her computer. She has tried ctrl+alt+delete and think point pops up. she cant get anything else to open or run. She has already forced her to shut down and when it came back on T.P is still there. any suggestions??

  279. petter
    Nov 11, 2010 @ 00:49:22

    do CTRL+SHIFT+ESC to replace ctrl+alt+delete ,then kill hotfix.exe

    then malwarebytes

  280. jeffery
    Nov 11, 2010 @ 03:33:36

    ok i had the thinkpoint virus and i try all hte things u guys say but when i run the internet or do something to open it,it won’t work at all.when ever i try to open the iternet it is also disconnect the even though i have wireless.please help me =(

  281. Kelley
    Nov 11, 2010 @ 06:19:42

    I did everything in processes. Is that all it takes to remove the thinkpoint virus?

  282. Bri
    Nov 12, 2010 @ 02:45:50

    Did what you said and thought I got rid of it. Download malwarebytes and it seemed to work now I can’t open a java page and there is what seems to be a java update trying to run but it says it can’t run and that virtual machine can’t be found. When that comes up whatever I’m doing freezes so I end up having to reboot twice, once after java then again when it gets to the windows screen. After which it works fine until eithere java or think point comes up again. I’ve even ran malwarebytes and delete the stuff it finds, but think point or java still comes up and freezes the computer again. Someone told me to try combofix which didn’t do anything when I tried to run it except tell me that the program can’t be renamed as combofix[1] even though I never renamed it to begin with. Also with whatever is wrong with my java program I can’t get to any java pages. It says javascriptnull or the page I’m trying to load is blank except for [null] written twice. Sometimes it redirects me to a totally different page. I don’t know how much sense this made but I’m kinda frustrated at the moment.

  283. Claudia
    Nov 12, 2010 @ 03:07:05

    Thanks Matt for all your help. Follow comment #2 it worked and removed the virus. Thanks everyone.

  284. Jaturong
    Nov 12, 2010 @ 19:28:36

    When I press CTRL+ALT+DEL my task manage does not show up and I try the other way and nothing happen, can you help me please

  285. stevie d
    Nov 13, 2010 @ 01:20:22

    hi there

    to the guys who put up how to resolve the issue, big thanks to you. was back online in minutes. didnt have a clue what to do until i read ur advice! thanks so much.

    stevie

  286. Kristin
    Nov 13, 2010 @ 03:07:55

    Hi, I think I have removed thinkpoint, although my computer seems to be running a bit more slow. I had microsoft security essentials but I guess it didn’t protect against this virus so I bought a year subscription to McAfee, however, it doesn’t work hand in hand with microsoft essentials, any help or advice on what I can do to get back to “normal” again. This is my work desktop and it can’t run this slow it’s driving us nuts!!! Thanks

  287. Paul
    Nov 13, 2010 @ 03:58:17

    Nothing has worked. I got infected a week and a half ago and have tried several posted fixes. When I start my system, I can F8 into safe mode but nothing else happens. Control alt delete doesnt bring up task manager. I have tried downloading Malware bytes via zip drive and a burned disk and cant get my disk drives to work (internal and external). I have also tried all these steps without being in safe mode. My screen goes black and I am unable to get any response whatsoever. I had anti-virus programs and nothing caught Thinkpoint. Please help us.

  288. Jessica
    Nov 13, 2010 @ 06:06:50

    I tried the control alt delete and deleted hotfix from the processes. I was able to than run explorer and was able to download malware bytes anti malware. It seemed to work, and removed the infected objects. I thought I removed all traces of think point/hotfix. When I restart my computer, the think point always comes up again. I’m able to control alt delete to get explorer back, but I don’t want it to keep coming up. I tried to restore my system to an earlier date as well, but it won’t restore to than. Is there something else that I should be doing? Please help!

  289. Kislany
    Nov 13, 2010 @ 10:48:33

    Just had this happen to me as well. The problem in my case was the fact that i already had Microsoft Security Essentials installed and using, so when the first message popped up, no warning bells came up, since it has successfully fended off various other malware in the past. Only when I got the message about think point I got the first chills, but by then it was too late, I couldn’t access my task or the internet any longer, which means that killing the process through the task bar was no longer an option.
    The fastest way I could come up with is to use my wireless laptop and download rkill.com from bleepingcomputer, this is a tiny software that instantly kills any malware that is currently open and in the taskbar. Now I can access the internet and I’m now scanning my pc with malwarebytes. Let’s hope for the best…

  290. Jacqueline
    Nov 13, 2010 @ 12:11:26

    Linda….. what you will need to do is go into safemode by turning off pressing F8 several times. Once in safemode then you can select ctrl,alt and del at the same time to bring up your task manager. In the task manager end the processor hotfix.exe. Then select FILE (upper left hand corner) and select New Task. A box will appear.. type in explorer and then enter (on your keyboard) You might have to do this a couple of times .. what it will do is give you back the start button and your entire desktop. Once you have the desktop then download
    ((((http://www.malwarebytes.org/))))
    Malwarebytes… run the program and makesure it has the updates… this will remove the rogue. Then you will be able to reboot into regular mode. Once in regular mode then remove the program microsoft essentials (there is a fake microsoft essentials program. I suggest also to run the malwarebyes again. When removing the microsoft essentials program (fake)I would use ((((http://www.revouninstaller.com/revo_uninstaller_free_download.html))))
    REVO UNINSTALLER (this will remove programs and the roots as well.

    Good Luck!

    Jacqueline

  291. Jacqueline
    Nov 13, 2010 @ 12:13:22

    Make sure that you stay in safemode until you run the malwarebytes.. then you can reboot into regular mode.

  292. Jacqueline
    Nov 13, 2010 @ 13:02:57

    If this doesn’t work then also use rkill.exe BEFORE using the malwarebytes. This stops the processes in order to get all the roots.,

  293. iremovethinkpoint
    Nov 13, 2010 @ 14:29:23

    sorry mistake. Under the top left of the performance and maintenance screen. XD sorry

  294. Emily
    Nov 13, 2010 @ 21:25:25

    I just got attacked by thinkpoint on my laptop. When I started up it would come on the screen as a virus scanner.

    I restarted it, pressing F8 over and over like the previous posts advised. clicked on safe mode. then when i was able to access my desktop. I searched in “my computer” for key words like “think” “point” “hot” “fix” “32” and any other key words related to the virus.

    I deleted any files related to the virus which I found (3 in total) and then deleted them from my recycle bin.

    When i shut down and restarted my computer it worked fine, the virus appears to be gone and the computer os running fine so far.

    I don’t know if this will have permenantly destroyed the virus but for anyone who finds the other steps a tad confusing (like myself) try this!

    Emily

  295. Michele
    Nov 14, 2010 @ 05:45:17

    when i tried to go to safe mode at start up and hit enter it brought up a black screen and there the laptop sits. Not doing a darn thing. If i ctrl/alt/del it restarts and then goes right to the black screen. Sometimes with a cursor in the upper left corner. Can you suggest what steps I can take to move on from the black screen?

  296. Sam
    Nov 14, 2010 @ 17:38:22

    I just got this virus on my XP and this is what i did to remove it.
    Press ctrl/alt/del to get tast manager
    Click on Processes
    Look for Hotfix.exe click on it and end process
    You should now get rid of think point scan window
    Click file and New Task
    type explorer.exe
    This should get you into windows
    I did system restore. it worked for me you can also scan with antivirus at this poin asswell.

  297. 1776blues
    Nov 14, 2010 @ 20:19:14

    After thinking I had it fixed came the real bad news, searches for virus software will redirect your search. I have tried bootable virus programs only to see it stick at 13% complete on some file call upx data 0101 PE_Patch, which I cannot find out what folder it is in because the virus program does not show the full string; i.e. c:\my document\my pictures\

  298. Zakster
    Nov 14, 2010 @ 22:28:55

    I am not reading all these posts. So I am not sure if this was posted….
    Get on a second computer and download trojan removed from simplysup.com it IS a legit program you can read reviews on it.
    Put it on a flash drive and start the infected machine up. Start hitting your F-8 key when the boot screen comes up. If you do it right, it will stall windows and give you the option to boot in safe mode. Boot into safe mode, attach the flash drive and instal trojan remover. After it is installed, run it and follow promps. Should allow you to get into windows in reguler user mode and finish everything with malware bytes.

  299. Christine
    Nov 15, 2010 @ 02:43:42

    I need more help with getting rid of this Think Point, I tried everything that was listed above including the CTRL-ALT-Delete and HOTFIX.exe was not listed under processes. I also installed the Malwarebytes and the stupid thing just came back up. HELP!!!!!!!!!!!!!!!!!!!!!!!

  300. Seamonkey
    Nov 15, 2010 @ 05:34:25

    I could not get on the internet or open my virus scan so I right clicked hotfix.exe in the task manager and chose “properties.” That told me where the file was and I typed the entire path into “new task” (under the applications tab). Found the file on the list and deleted it. I was able to re-boot without the Think Point screen coming up. I am now running Malwarebytes and it shows 4 infected files so far. I hope this will be the end of it and I hope the person who created this dies a slow, painful death.

  301. KC
    Nov 15, 2010 @ 10:48:23

    This happened to me yesterday; here’s how I got rid of it.

    1) I turned my computer off.
    2) Turned on again, then pressed F8 until got the menu
    3) Selected ‘Safe mode’
    4) Logged on as ‘administrator’ (NOT my own profile, as ThinkPoint came up)
    5) Went to Start > Settings > Accessories > System Tools > System Restore
    6) Selected the most recent ‘pre-ThinkPoint’ date

    I then downloaded some genuine Anti-Virus software and thanked my lucky stars that no real damage had been done!

  302. leanne sharp
    Nov 15, 2010 @ 12:26:50

    Hi Guys I had this Think Point come up on my computer now i am not very technical so i just thought it was a basic windows security i paid to renew security and it has taken the money off me and i have no one to contact, what can i do about getting my money back??

  303. Rachael
    Nov 15, 2010 @ 14:47:46

    So thankful I found this website. I too was attacked by this virus and after a few hours of trying to recover or restore it, we were able to execute the internet and search for ways to fix it. It sure is a tough little bugger! This solution worked wonderfully. I had a little bit of a hard time executiing the malware software once I downloaded it but after a couple attempts it must have opened up and did its magic because suddenly I could see my start button again :D

  304. pop
    Nov 15, 2010 @ 15:00:34

    Hi Guys
    I am also in despair with think point
    I went down the path of ctrl-alt del, I thought my problem was solved, now the computer won’t even boot. I have a blank screen, the only thing I can see is the cursor I can do nothing, help help.

  305. pop
    Nov 15, 2010 @ 15:01:49

    Hi Guys
    I am also in despair with think point
    I went down the path of ctrl-alt del, I thought my problem was solved, now the computer won’t even boot. I have a blank screen, the only thing I can see is the cursor I can do nothing, help.

  306. Michelle
    Nov 15, 2010 @ 17:14:25

    Okay, it looks like my daughter got this Think virus…..I tried to run Malware and it only took me to a screen that said the application iexplore.exe could not run. Of course it wants me to get heuristic to fix it. Task manager won’t evern launch…how can I fix this problem?

  307. Jerry
    Nov 15, 2010 @ 19:39:25

    I quit reading after things started getting repetitive, but I saw a few questions asked repeatedly that can’t be answered enough:

    NO ONE SAID TO BUY OR LET THINKPOINT SCAN–it is a VIRUS, and giving it your CC# was a MISTAKE! If you did do that by mistake, tell your credit card company that you accidentally gave the number to thieves, and hopefully they will cancel the charges, and attempt to recover their money from the thieves (most good companies will do this no questions asked.) You’ll probably have to get a new CC# like if your card was stolen, but that’s a good thing, because it was.

  308. Jeremy
    Nov 15, 2010 @ 21:01:41

    Thank you to Chris OShaunnessy
    Followed your comments and am now free of this awful piece of .
    Jeremy

  309. marcin
    Nov 15, 2010 @ 21:50:57

    mi pomog?o przywracanie systemu dzia?a wszystko jest ok polecam marcin poland

  310. Thinkpoint solution
    Nov 15, 2010 @ 22:10:32

    Hi all – Im a novice but managed to get rid by pulling the plug and when thinkpoint appears on start up – you have a few secs to control/alt/delete to enter task manager then do the following;to open Windows Task Manager. Select Processes from tabs at top of page. Find hotfix.exe (may also be thinkpoint) in process list. Right click an…d select end process. Press enter. Select Application tab on task manager window, then click New Task. Type:explorer then press enter. The windows desktop will open. Close the task manager. Go to start, run and type regedit then press enter. Find and delete registry values: HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\\”Shell\” Close the regedit window. Go to Start, My computer, C drive Then find and delete file: C:\\Documents and Settings\\User\\Application Data\\hotfix.exe and any other files in that directory that have the same timestamp. Good luck

  311. Sameer kumar
    Nov 15, 2010 @ 22:35:48

    After I Forced shut down, my computer will not boot. It is just showing a black screen, with a flashing dash in the top left hand corner.

    Please help.

  312. Sameer kumar
    Nov 15, 2010 @ 23:05:54

    Sorry I forgot to say, im running windows XP …

  313. stacey
    Nov 16, 2010 @ 05:22:39

    OMG~ thank you, thank you MATTHEW!! comment # 2 did the trick…took some time to get it done but it worked!…did mention thank you!

  314. Qasim
    Nov 16, 2010 @ 05:29:16

    what a good matheww if you add manual removal guide too

  315. Thinkpoint solution
    Nov 16, 2010 @ 12:03:21

    @ Sameer kumar , try 306 KC’s comment to get your computer to start up on safe mode, then follow my previous instructions. Hope this helps! Good luck!

  316. Sameer kumar
    Nov 16, 2010 @ 13:54:09

    Thank you for the suggestion, however it is not working.
    I am running XP on a Macbook Pro using bootcamp.

    I have been repeatedly pressing F8 and F8+FN, however neithere is working.

    If i can just get it to boot, im sure I would be fine.

    Please help and many thanks…

  317. Steph
    Nov 16, 2010 @ 15:02:15

    Hello everyone, my laptop caught the thinkpoint virus at the weekend from trying to view photo’s on gumtree. I’ve got rid of the virus and all it’s evil friends but my internet connection is still really bad, it keeps disconnecting and I can’t get on a lot of sites. Does anyone know why this is happening or how to fix it please?

  318. Murali
    Nov 16, 2010 @ 16:54:47

    I am very much grateful to this site which has helped me to remove the Think Point from my system. Thanks a lot!

  319. Kathy Trowbridge
    Nov 16, 2010 @ 16:57:12

    I got a warning that my computer was infected with a trojan or virus and I had to install think point to get rid of it which I did mistake no. 1. The next mistake I made was to buy it because I could not clear it off my machine until I did . Then it would not let me shut down, so I had to switch off on the box now I cant get rid of it I do not want to spend any more money in case I get duped again BEWARE OTHERS

  320. Alissa
    Nov 16, 2010 @ 22:21:28

    I had to reboot several times in safe mode when I got the virus think point and now I can not access my desk top or the internet so I am unable to download a spyware. I tried task manager and deleted hotfix and still just a black screen. Please help

  321. Jenny
    Nov 17, 2010 @ 02:14:54

    My friends computer has this virus, but i can’t do any of the things you suggested, because it completely blocked the internet, Run doesn’t work eithere, nor does ctl+alt+dlt so any ideas, of what she should be doing?

  322. Kutman
    Nov 17, 2010 @ 02:56:16

    it worked perfectly, thanks man.

  323. karan
    Nov 17, 2010 @ 07:07:56

    Great job.. it really helped me to get rid from Think Point.

  324. Lee
    Nov 17, 2010 @ 08:01:54

    Everybody, listen close! This Trojan is one nasty little trick!! Everything here works to varying degree, but if you are using Malwarebytes like I do and you are using the free version like I am you Must! and I stress Must have first the latest version which as of this listing is ver,1.46 and Update it first before running a scan. The free version is a Manual version and must be updated every time Before you run a scan and if you have an older version and try to update it won’t update but give you an error code of something like 7xx whatever. This trogan is, as I understand, a modified version of an older one and seems to be getting past a lot of peoples defenses. First and foremost get and Keep your antivirus/antispyware up to date and second I noticed that someone was still running XP SP2! Folks! Windows XP is at Service Pack 3 now and has been for at least a year. I don’t care much for Vista and haven’t paid much attention to it but I believe it’s up to Service Pack 2 now and Windows7 is still new. Update your OS Service Packs! You can only get the latest updates with the latest Service Packs and much of your Windows security is in keeping current with Windows updates. Here lately over the last six months or so I’ve noticed that both Microsoft and McAfee have been throwing security updates out there sometime two or three time a day and I’m not the only one in my neck of the woods here that has noticed that. There’s been a lot of new malware coming out of Dark corners and security software developers are doing their best to keep up with all the Crap that keeps coming out. It’s like being in a mosquito infested swamp. You kill one and you have 10,000 more waiting to caught you! Anyway Get Updated!! It’s not a 100% guarantee but it will lessen the chance of an attack a fair bit. And follow the suggestions here in these posts, if one method doesn’t do ya’ then try another. You’ve got a lot of good help here. Don’t tag onto anything that looks suspicious or open anything if you don’t know the source and if something does get in or your realize you’ve opened something nasty then do an emergency shutdown or pull the plug! I have found that it is far better to run a CheckDisk scan(chkdsk in the Run Command) and let Windows unscramble the mess from the sudden interruption than to have to deal with a virus or malware. Play it safe Gang and learn how to fight back! It’s getting rough out there! Caio!

  325. wendy
    Nov 17, 2010 @ 12:28:53

    Hi, I have the thinpoint virus on my desktop. I downloaded spyware doctor to assist me with removing it. Spyware doctor is installed but needs updates. Problem is i cant complete the update process because thinkpoint pop ups come up and then the blue screen comes up to reboot computer. i have to do a hard restart each time. i cant stay online long enough to get the updates i need to activate the antivirus program. please help!

  326. wendy
    Nov 17, 2010 @ 12:30:44

    help, i have thinkpoint virus and i cannot stay online long enough to update the antivrus software or to doenload a new prgram to use to remove this. help! the computer comes to the blue screen and i have to do a hard restart each time.

  327. amina
    Nov 17, 2010 @ 13:06:02

    i cant get rid of the think point blue screen! i got onto google through the the task manager but in the task manager there is no option for processes :S everything seems to be working apart from this massive blue think point square blocking up half my screen!

  328. Geby
    Nov 17, 2010 @ 19:55:25

    I tried Spyware D*ctor, it detects Think Point but to remove it I have to purchase. Now I’m trying Matthew’s suggestion (comment #2) and now it’s scanning my system. It detects the infection. Hope that I don’t need to purchase to remove it, and I hope that when I finally get rid of this virus, my computer won’t be slow.

  329. niko
    Nov 17, 2010 @ 22:27:32

    i will uninstal thinkpoint,but i don’t now this program…..help me please…..

  330. Chris McRaaaee
    Nov 17, 2010 @ 22:55:59

    Finally got the virus. I ran explorer by opening my documents and just typing google into the top search bar. I downloaded rkill and hotfix was located, for me, in C:\Documents and Settings\Chris\Application Data\hotfix.exe
    When Rkill was running, it allowed me to manually delete it and now my desktop is wokring fine.

  331. Ternee
    Nov 18, 2010 @ 00:55:56

    Man, I hd a HARD TIME getting this dang virus off my mom’s laptop!!! I followed the instructions that otherrs had listed on here (deleted the hotfix or whatever it was!! process and input explorer.exe and was able to get back online. CURRENTLY am running the scan while my mom is using the internet! Hope I have nipped it the bud….. don’t know why people make such annoying things to bother people they don’t even know!! Definitely a scam to get people’s money and to annoy the crap outta of em!!!

    Thanks to all who posted before me. Ya’ll were a HUGE HELP!

    Hopefully anyone else who encounters this bug is able to fix it as well!

    Best of Luck! and I hope my mom’s computer is safe now!

  332. Tom
    Nov 18, 2010 @ 01:24:21

    Matthew, Thank you for taking the time to post your solution to fixing this annoying problem. You really saved me a lot of time and money. You’re awesome. Thanks again.

  333. Geoff
    Nov 18, 2010 @ 06:08:21

    Hey All, you can access the task manager by hitting “Ctrl Shift Esc” togethere. control alt del doesn’t work on all os settings, for example off domain desktops or home editions without the right settings.

  334. KC
    Nov 18, 2010 @ 16:38:08

    @ Steph

    I also got it while looking at Gumtree! Annoying. Hope they are sorting it out.

  335. Alyssa J.
    Nov 18, 2010 @ 18:37:10

    Hey guys. I just removed the Think Point virus from my PC in a few easy steps. This is what I did exactly, and it seemed to work. You have to actually let it finish scanning. Wait until it’s completely done scanning and your results pop up. Then you click to close all the windows and your desktop should load like normal. A few of the Think Point windows may pop up, just close them. Then go into System Tools in your control panel, and click on System Restore. Enter a different date of when your computer was normal, obviously before the virus. That should fix the problem, it did for me!

  336. Louby
    Nov 19, 2010 @ 11:05:58

    I really need some help here. I’ve somehow managed to infect my laptop with the ThinkPoint Virus. I followed all the instructions to remove it but unfortunately i restarted my computer before repairing the Windows Registry Shell so I am now unable to load my desktop or do anything at all!!! This is my work laptop and I really need to fix it ASAP. If you are able to help me, I would be SO grateful!!!

  337. Nathan
    Nov 19, 2010 @ 17:22:46

    to get in, hit Control alt delete, end hotfix process. Then click add new process. type explore.exe That will get you in. Then go to start menu..Search Thinkpoint. You should find it. highlight and right click to go to properties. You should then find a button to take you to “file location” Delete that bastard!!! you should be good to go from there.

  338. Ryan
    Nov 19, 2010 @ 19:35:40

    Clearly this procedure does not take into account the fact that this program will automatically download itself and restart your PC with a file to load it on startup.

    I am running Windows Vista and this hit me when I clicked a link from google (searching for something from amazon!?) I received a pop-up stating there was a security problem and my Windows would restart. I tried opening AVG but it had already started to shut down. I turned my laptop back on and it started scanning insisting my computer would not be fixed unless I paid out for a full version of this program not knowing it was a virus…

    SOLUTION

    I pressed ctrl, shift and escape to open the task manager and noticed two things that should not be running under the process tab, I ended something like presentation.exe hotfix.exe and ended up with a black screen so clicked file, new process and opened explorer.exe
    This started the user interface, I immediately started a virus scan with AVG and decided to search for the files responsible.

    The file is located at C:\Users\(username)\AppData\Roaming\hotfix.exe
    in this folder I also deleted completescan and install as I believe them both to be related to this virus.

    It is published by ABC Ltd. according to the file.

    This was my work around using Windows Vista. I hope people find this useful!

  339. Angel
    Nov 19, 2010 @ 20:48:11

    Managed to get to my desktop but not able to run Malware because the “run programme” box is behind the “ThinkPoint” box in the middle of my screen so I can’t click “run” to download the malware, how do I get around this?

  340. MDriz
    Nov 19, 2010 @ 23:44:49

    thks matt, i just kick out the thinkpoint from my laptop..i used yr 2nd option and it’s worked…

  341. Viteckek
    Nov 20, 2010 @ 09:47:41

    THANK YOU!!!!! SOO MUCH!

  342. J
    Nov 20, 2010 @ 20:16:37

    B you saved me thankyou so much! :D

  343. Matt-Northwest-UK
    Nov 20, 2010 @ 20:31:27

    Wish I had found this site 2 hours ago! All i ended up doing was a system restore to my last update (yesterday). It seems to have worked – everything is as it was.

    Has anyone done this and experienced problems later on? This isn’t my laptop so need to get it sorted asap!

    Thanks guys.

  344. debra
    Nov 20, 2010 @ 21:33:03

    Please help! I had tried to remove the Thinkpoint virus on my PC, but now it won’t reboot in any mode at all. I don’t have a CD drive eithere and I also don’t have the original WindowsXP installation disk. When I try to boot in safe mode, it hangs up at isapnp.sys. What can I do about this? Thanks!

  345. ed
    Nov 21, 2010 @ 06:09:02

    mine wont reboot eithere now!!!

  346. Larry
    Nov 21, 2010 @ 06:32:23

    I just got this virus and looked at this. If you want to close THINKPOINT, press CTRL+ALT+DELETE and go to start task manager; go to processes tab, and find the one that’s THINKPOINT, and end process. To open a browser, go to application tab, and click new task. Try entering a website you have been on recently, and the browser should open.

  347. Tony
    Nov 21, 2010 @ 18:48:06

    what if you have already pressed safe start up and got the second screen shot above how do you then remove it? \thanks

  348. NUTRON
    Nov 21, 2010 @ 21:22:54

    THERE ARE SEVERAL WAYS TO REMOVE THIS VIRUS !
    THOUGH YOU HAVE TO GET BY THE FAKE DESK TOP FIRST !
    LOG ON IN SAFE MODE AND LET IT LODE , BEFORE DOING ANYTHING ,
    hit [CTRL]+[ALT]+[DEL] and open up the task manager. From there, delete “hotfix.exe” from the processes and then go to “new task.” Type in “Explorer.exe”
    OK YOUR DESK TOP SHOULD BE SHOWING NOW !
    NOW YOU CAN DOWNLOAD MALWAREBYTES

    “OR”

    YOU CAN KICK IT’S BUTT MANUALLY ,

    FOR VISTA MANUAL DELETION ,
    FIRST DELETE THE DESK TOP SHORTCUT AND THE START MENU SHORTCUT IN PROGRAMS !
    OPEN CONTROL PANEL
    OPEN FILES AND FOLDERS
    OPEN THE “VEIW” TAB
    CLICK “SHOW HIDDEN FILES AND FOLDERS
    {ALL THINK POINT FILES ARE HIDDEN}
    CLOSE THIS
    NOW OPEN
    COMPUTER >LOCAL DISK C: >USERS >{YOUR ACCOUNT NAME} >APPDATA >ROAMING
    THERE YOU WILL SEE THE ICON FOR THINKPOINT IN GREEN ,
    THERE WILL BE 3 OTHER FILES FOR IT ALSO !
    YOU CAN TELL THE FILES BY THE DATE AND TIME CREATED !
    THEY WHERE CREATED ONE MINUTE APART ON THE SAME DATE !
    DELETE ALL 4 FILES AND THEN EMPTY YOUR RECYCLE BIN …
    RESTART YOUR WINDOWS AND BHAM , YOUR DONE !!!

  349. HELP WITH THINK POINT ON WINDOWS XP
    Nov 22, 2010 @ 05:37:28

    WHAT I DID TO GET RID OF THAT DAMN THING WAS GO TO TASK MANGER.
    HIT FILE = [CTRL] + [ALT] + [DELETE]
    GO TO NEW TAKE (Run…)
    TYPE IN explorer.exe
    HIT [OK]
    THEN I WENT TO THE START BUTTON IN THE LOWER LEFT CORNER
    WHEN TO ALL PROGRAMS
    THEN ACCESSORIES
    THEN SYSTEM TOOLS
    THEN SYSTEM RESTORE
    THEN CLICK NEXT AT THE BOTTOM RIGHT
    SELECTED A DATE BEFORE I GOT THE DAMN THINK POINT
    HIT NEXT AND THE IT SHOULD DO THE REST BY ITSELF…

    I HOPE THIS HELPS SOMEONE!

    NOTE….
    I DID NOT CLICK THE START BUTTON ON THINK POINT. I RESTARTED MY COMP AND DID WHAT I TYPED ABOVE.

  350. HELP WITH THINK POINT ON WINDOWS XP
    Nov 22, 2010 @ 05:38:24

    HELP I MEANT NEW TASK* NOT TAKE

  351. WOW
    Nov 22, 2010 @ 17:28:57

    Well. Everyone has their own little tips and tricks. As far as system restore, that only works if you have been setting restore points to fall back to. This “Think Point” is not even a true VIRUS it is a program written to try to fool fools and it is a program that is accepted and invited on to your system through browsing the web and accepting active content from malicious sites. It is and can be closed out by stopping the program called Hotfix.exe. then it can be deleted by locating it on the hard disk usually under the user folders. XP = Docs&Settigns / Vista = user folders. If you catch it early and before falling for it and clicking “START PROGRAM IN SAFE” because as a rule of thumb I have to warn you, never click anything or any button in these FAKE scan softwares. They are only gimmicks to get your credit card info, and install furthere instances of malware programs and files onto your system any and all choices SCAN STOP OPEN CLOSE LATER SAFE START etc. all lead to the same road, download and install secretly more garbage. BUT THROUGH ANY ADVICE and OVERALL no matter what you do or what program you use to get rid of them. The very best advice is: TURN OFF YOUR SYSTEM RESTORE features. remeber any program the writes a string value into the registy upon installing itself is considered to windows as important, whethere it be trash to us or not. Windows believes it is wanted and needed. so anything like software that does not have a legit uninstall that will clear out all registry values and files and thus is removed by finding and deleting the files will most likely and a lot of times be put right back where it was removed from due to windows telling itself that it is an important and needed system installed software or file. If you use system restore and like it fine, turn it back on later after the malware is cleaned and removed. Recap: Turn off system restore before scanning and removing viruses, or spyware / malware. And remeber this Think Point crub like all others starts as 1 file on your computer, usually under a TEMP or User folder. go to your folder options and view all files so that they are not hidden. If you see then pop up or run never click anything in them even if the button or link is called CLOSE, all buttons and links are activaters. Once you do click anyhting inside them now 1 file has turned into 2x or 10x or 20x or 50x the number of files to clean and get rid of. To the point where windows can not run and execute programs successfully. These tacky attacks are usually USER associated. Log on as nornal user bam its there. Log on as any other user name and No sign of the running software in a lot of cases. I reccoment setting up anoter user log in as a full administrator priviliged account as a futurer malware fighter entry point. Some times this helps. You can log on and update and run your Malware killing tools. Malwarebytes has by far created the best removal software to date that i have used or seen. Get it, Keep it updated, Run it hourly, daily, weekly, monthly, which ever your internet scowling needs require. And Maybe even purchase / support them and their software is needed, to protect yourself on a real time basis so it sees these things as they are trying to install / run.

    Good Luck to all. And remember Think it Through

  352. generallee69
    Nov 22, 2010 @ 20:21:38

    I just fixed a computer with this virus. So far the system is running perfectly. I rebooted into safe mode, allowed the virus to run its scan, got to my desktop, installed malware bytes program, removed 34 infected files, opened registry and performed searches for “thinkpoint” and “hotfix”, deleted all the entries, and then searched the hardrive for the same words, then deleted all those files. Took about two hours from start to finish. Hope this helps someone.

  353. vivi
    Nov 23, 2010 @ 19:27:31

    parler francais

  354. vivi
    Nov 23, 2010 @ 19:28:25

    on ne comprend pas le francais m….

  355. Lulu
    Nov 24, 2010 @ 01:01:30

    Please help me. I accidentally installed it and it ran a scan. I tried to close it but it stopped me. I turned the computer off and then back on. I logged onto another account and removed hotfix.exe. I checked back on the infected account and the screen was black. So I turned it off again and back on. Currently, I’m logged on another account. Can I run the Malwarebytes from a different account to remove it? PLEASE. I’m desperate for help! I need step by step instructions. I’m so scared right now.

  356. Lulu
    Nov 24, 2010 @ 01:03:45

    Please help me. I accidentally installed it and it ran a scan. I tried to close it but it stopped me. I turned the computer off and then back on. I logged onto another account and removed hotfix.exe. I checked back on the infected account and the screen was black. So I turned it off again and back on. Currently, I’m logged on another account. Can I run the Malwarebytes from a different account to remove it? PLEASE. I’m desperate for help!

  357. Lulu
    Nov 24, 2010 @ 01:24:03

    Scratch my last comment. I’m currently downloading the malwarebytes free trial version. All I did was restart the computer and followed Matthew’s steps. When the trial ends, will the virus be back?

  358. Lulu
    Nov 24, 2010 @ 01:43:24

    And once again, disregard my previous post. I restarted, did the ctrl+alt+del, went to task manager, removed hotfix.exe, and went to internet to download malware bytes. It found some infected files and removed them. Then it asked me to restart my computer. It restarted and now I have a big blue ThinkPoint Square in the middle of my desktop. Not to mention, Malwarebytes keeps asking me if it can make changes to my system and then it freezes up. I need some help on this virus. PLEASE.

  359. Lulu
    Nov 24, 2010 @ 02:02:43

    After a bit of tinkering around. I looked at some files that didn’t seem right and googled them. One of the processes on task manager I found was: _bff5.tmp*32

    If you have this, remove it. I did and the blue square on my desktop was gone.

    Hopefully, everything goes smoothly. If not, I will be back[:

  360. doc. Játro
    Nov 24, 2010 @ 22:06:40

    I destroyed this virus in a different way – after I got through the ThinkPoint scan, I right-clicked on the ThinkPoint icon on my desktop and found the file where it is all saved. And I deleted all files added in last 20 minutes – that was the virus. One of these folders couldn’t be removed – because some process running. So I shut the process down in task manager and than deleted it.
    Isn’t it genius? :-)

  361. B'duff
    Nov 25, 2010 @ 00:50:39

    Thanks a million Matthew from comment #2. Everything worked as you said and hopefully now my computer is back to normal. Now the real question, can anyone suggest a solid anti-virus software or anything else that would help keep my PC protected? Any advice would be stellar.

  362. Ashley
    Nov 25, 2010 @ 11:33:54

    I also have the virus BUT after downloading malware running three seperate scans and also using TDSS Killer it can not find any infected files!

    Please help|

  363. jeff
    Nov 25, 2010 @ 13:44:53

    Thanks for great info….not sure if its been said yet somewhere in all these posts, but if you already have malwarebytes installed, make sure you update it before you run it. This means you need to start in “safe mode with networking.”

  364. les
    Nov 26, 2010 @ 15:22:08

    Thank you so much for everyone’s help for getting rid of this nasty malware!! Thank goodness we also had a laptop to research a solution while our desktop was infected. Seems to be working great now and hopefully we got rid of it all! Thanks again!

  365. Charlie
    Nov 26, 2010 @ 20:55:27

    Can’t really be asked to read through comments but when Thinkpoint virus is checking the system it has a weakness, if you hit ctrl+alt+del and open task manager and run explorer, you can then access everything on your PC until it finishes ‘checking your system’. At this point quickly open your antivirus (or browser to download one) and run it. Or even better in your task manager select processes and end the process called hotpot or something, will be using a relatively high amount of memory. This will close the virus until you restart your system, unless you remove it.

  366. Adele
    Nov 26, 2010 @ 22:09:38

    Thank you – this worked!!! I was able to run system restore

  367. arlyne
    Nov 27, 2010 @ 04:36:40

    okayy i try to try what matthew said but the virus wont even let mehh enter the internet is like it discounected itself of the internet wireless connection need helpppp!!! seriously….

  368. Sam
    Nov 27, 2010 @ 17:43:58

    I ended the process hotfix.exe but when i type in explorer.exe as a new task but i receive the message “windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item” I tried the kasberky bootable disk but it doesnt open on my laptop. I have no desktop. No start menu, no icons nothing. Please help me remove this virus!

  369. Anna
    Nov 27, 2010 @ 18:28:43

    So I have read through most of these comments and my problem is that I cannot sign on to the Windows in any mode, it won’t boot in any safe mode type at all. So what do I do find the hotfix.exe file so that I can delete it? I already tried using the Kaspersky Rescue Disk 10 and I still can’t shut the computer down properly, or get to the task manager or any of that?

  370. MAXIMUSGOYO
    Nov 27, 2010 @ 23:05:33

    este malvare es de lo peor pero logre quitarlo de esta manera me fui a task manager oprimiendo las teclas ctrl-alt-del despues detengo el proceso hot fix despues corro me voy task manager file new task (run) msconfig despues a tools restore system i escoge el punto de restauracion donde no aigas tenido la infection asi funciono la mia es windows 7 funciono perfectamente bien iluego aplike el malwarite para finalizar el trabajo postata dale update al malwarite

  371. frank
    Nov 28, 2010 @ 01:26:20

    I did exactly what Matthew advised (#2), and his advise was superb. Virus free again

  372. Jessica
    Nov 28, 2010 @ 06:49:13

    Thanks Chris OShaunnessy I had same problems as linda but ur explanation helped much.

  373. Heidi
    Nov 29, 2010 @ 01:04:22

    Comment #2 from Matthew worked!!! I have a newer laptop with windows7 and it got rid of Thinkpoint virus and my laptop is CLEAN again!! THANK YOU!!!!!!!!!!!!!

  374. Paul M.
    Nov 29, 2010 @ 04:17:35

    I didn’t read through all the posts here so I don’t know if anyone mentioned this yet. I had this virus last night. my son triggered it from Face book.

    One way to get around the think point screen on start up is to go into settings/ options on that screen and choose I think it’s called “continue on unprotected” and it will allow windows to load up.
    From there I was able to use Malwarebytes to remove it.

    I still had to do a repair windows install to get my system back to normal. From what I can tell it effects Internet explorer the most.
    I was able to start up firefox and browse the web during the virus attack. In Win Xp, It installs the basic files in Documents and settings\(username)\Application Data folder

  375. Linda Corey
    Nov 29, 2010 @ 04:58:16

    Had the icky Thinkpoint virus and could not get rid of it. Finally got on this site and tried what Mike #2 suggested. It worked perfectly! Thanks a million.

  376. Donna
    Nov 29, 2010 @ 20:56:28

    Matthew…YOU ROCK!!

    Thanks to all, but your instructions to open task manager, look for “hotfix.exe…” worked! This ugly virus locked up my computer last night, and I couldn’t figure out how to get rid of this virus. Couldn’t boot my OS without this horrible thing taking up my whole screen.

    With your instructions, I managed to access the web, and download Malwarebytes Anti Malware. It’s scanning now :)

    Thanks so much!!

  377. Mary
    Nov 30, 2010 @ 01:36:56

    Matthew your posting on 18 Oct was helpful. I did what you recommended in task manager, remove hotfixe.exe…and Donna thanks for confirming to download Malwarebytes Anti Malware –there is a free version or you can opt to purchase for $24.95..after scanning it certainly found the trojan and rogue viruses…i rebooted…hopefully its safe now…Thanks again!

  378. joe
    Nov 30, 2010 @ 08:25:57

    I was just on google and typed in metallica and this fake microsoft security popped up. And as soon as i saw it i google it on my iphone and i saw this page and i quickly restarted PC and run system restored to a couple days back. Now my computer is fine, and there is no trace of thinkpoint virus.

  379. jeff
    Nov 30, 2010 @ 13:20:15

    help. i don’t see the thinkpoint program in my task manager but i ran malwarebytes full scan anyway a couple times. no luck. I’ve still got that big Think Point logo when i turn on the computer. no icons on desktop except for that giant Think Point asking me to run in safe mode, which i haven’t done. any idea how i can get rid of this? i thought it would be easy to find in task manager but it isn’t there under processes or any other place. HELP! How can I kill this?

  380. Kay
    Nov 30, 2010 @ 14:12:18

    Well done Matthew yes indeed you are a genius that worked a treat thanks a lot.

  381. Lucy
    Nov 30, 2010 @ 14:27:42

    HELP! This virus arrived when I downloaded my automatic updates. I have followed some instructions on here but I could not get onto the malware site to download the removal tool. Everytime I typed into google it would bring up visa sites, holiday sites etc. It felt as though someone was using my PC remotely. I went and brought norton 360 and installed it. I tried to run a scan for virus and it wanted to create a back up point first so after it did this it needed to reboot. Trouble is, now it wont boot at all, I get the following:
    Your PC is blocked.
    Your hard drive has been encrypted.
    Browse www . safe-data . ru and it goes on to give you an ID number and tells you that you will lose all of your data if you try and recover the files another way
    Obviously I am not going to go onto this site. I just don’t know what else to do. Windows will not boot from any cd I have tried so far and I am at a loss of what I can try next.
    I really do not want to lose my files as I have stupidly not backed up for a month and have all my invoices etc on it!!!
    I really hope that someone can offer me some advice on how to get rid of think point virus. Failing that I think I may just cry!
    Thanks

  382. jeff
    Nov 30, 2010 @ 16:45:49

    any chance that if i open task master in safe mode from “OWNER” instead of “ADMINISTRATOR” that this might work. can’t find the program in the task manager from the administrator log on. can anybody help me?
    thanks.

  383. Paul
    Nov 30, 2010 @ 18:51:14

    Matthew, we got the virus and you were 100% right. Thanks a million. We are running xp pro. Thanks again.

  384. Lynn
    Nov 30, 2010 @ 22:19:09

    I called the 800 number that poster 165 gave. I advised them that I was billing them $480 for my lost time and $1760 for lost business and I needed their address for my lawyer to bill them. I suppose the address he gave me is bogus but if enough people annoyed them, perhaps it would help.

  385. Jodi
    Dec 01, 2010 @ 02:32:56

    I think I got Thinkpoint virus off of my daughter’s PC (as it isn’t displaying on the desktop anymore), but the internet won’t work. Now what do I need to do?

  386. Ashwin Kumar
    Dec 01, 2010 @ 06:16:00

    Download Regrun 6.8 from google…run software to install….run Regrun 6.8 and scan for virus,spyware etc, removing all infected files…..restart PC to fix the problem….best software for any virus removal.

  387. Jeff
    Dec 01, 2010 @ 15:27:36

    Had this pop up on a computer this morning. I was able to access the PC remotely (it’s located 300 miles from where I am) and once I let ThinkPoint do its initial scan and accepted the top button (forgot the exact wording-not the unprotected button). After a couple of minutes the AVG Free Anti-Virus software detected and isolated the threat. Then I was able to download and run Malwarebytes which finished removing the threat.

    I could not get past the threat using the ‘continue unprotected’ option. I had to accept the software as is and also had to change a setting in ThinkPoint to allow me to close the window (forgot the name of the checkbox, but it was under the Settings menu).

    After Malwarebytes ran and rebooted it is gone. I was surprised it was that easy to get rid of (thanks to the initial instructions in this post).

    Hope my comments help someone else that needs to tweak the settings!

  388. Jeannie
    Dec 01, 2010 @ 19:42:19

    Thanks to all of you for your help. My daughter called me in a panic because her laptop was locked up with the Thinkpoint virus (or whatever it is). She directed me to the Internet to look for help. I can’t detail exactly what we did, but can tell you I looked at multiple notes/recommendations from those of you that posted them and her laptop is now up and running. It is good to see that something bad made us see something very good in people helping people. Couldn’t have done it without you. Thanks again.

  389. AA
    Dec 02, 2010 @ 11:33:18

    hi! i just acquired that “think point” in my laptop..i don’t how..its just too fast..my computer suddenly restarted..and then, there it goes..i have to deal with it before i can log-in my account..then..i felt uncomfortable with it..and tried to find way to remove it..but i can’t.. can’t access task manager, internet..but i can log-off my account..
    so i tried other account if it pop-ups there..and i noticed that i doesn’t..so..what i did to make story short..was..i logged in my account again..i created another account..log off..then log in to the new account and deleted the previous account..i don’t seem to have problems anymore..well, so far..but, do i still need to worry? well, right now i’m running a full scan of my system…i hope what i did will solve really this problem..anymore suggestions?

  390. Victor
    Dec 02, 2010 @ 12:32:11

    Hello AA,

    You need HitMan Pro or Malware Bytes to remove Thinkpoint

    If need any furthere help , reply

    Thanks
    Victor

  391. Victor
    Dec 02, 2010 @ 12:34:17

    Hello Everyone,

    If you need help on phone to remove thinkpoint

    Leave your number or contact me throught Email ([email protected])and I will try to call you back.

    Thanks
    Victor

  392. Brian
    Dec 02, 2010 @ 13:20:43

    I did the process of ctrl alt del to get rid of hotfix.exe… ran my malware that I already had just had to update it and got rid of it… I was trying to show a friend what happened and shut my PC off before I fixed it which I had already done so a few times (manually via power button). So now I fixed it in safe mode but when I boot my Windows up regularly… windows loads for about 10 secs and then restarts and goes straight to the list of options including boot in safe mode. Safe mode works perfectly fine, but it’s HUGE and nothing fits on the screen and I really can’t work with that. I was wondering if there is any way to get my machine to stop automatically restarting itself or do I need to just go out and buy windows xp again and reinstall it. I have a partitioned hd so I got most of my files separate from my os. I’m 99.9% sure I got rid of the virus and I didn’t notice any strange processes running after I got rid of thinkpoint. Any help is appreciated.

  393. AA
    Dec 02, 2010 @ 13:27:27

    thanx victor..i’l try that, but first..i’m done with scanning my system..i used avast..and it seems the comp has no symptoms of any infections or malfunctioning..do i still need to go on with hitman?

  394. warren
    Dec 02, 2010 @ 14:42:02

    just change the names to the files…..they cant access each other

  395. Victor
    Dec 02, 2010 @ 15:57:23

    Yes, HitMan Pro 3.5 and make sure about your Windows Operating System (32 bit or 64 bit)

  396. Gary
    Dec 02, 2010 @ 21:56:25

    Many many thanks to all! – Inspired and considerate people are few and far between – but those who knew what to do should be wearing that badge now! I had great pleasure following the task manager instructions re hotfix and then explore.exe. With some nervousness I waited for Norton 360 to do its work and then I gleefully deleted the ‘thinkpoint’ shortcut, considerately left on my desktop – like i would want to open that ever again!

  397. Kenneth
    Dec 02, 2010 @ 22:12:48

    Hey just did what Matthew and some other suggested..ctrl alt delete…went processes delete hotfix.exe…got me into windows explorer…then got some free malwarebytes software…downloaded it…did full scan with…and deleted the virus…so far so good….going to to a full scan tonight….

    Hopes this helps :)

  398. erock
    Dec 05, 2010 @ 02:36:04

    i got rid of it this a.m heres what i did. let it run the scan then keep clicking x’s until its of screen. turn off PC, restart, icons should be back along with think point window(motherf%#@&*s)don’t touch think point windows. hit start goto accessories goto system restore hit it, it won’t work but don’t fret, icon will be up in start menu next time you start your rig. shut off machine again and restart goto start, find think point icon(little bast@#% in a trench coat)click once to highlight only.hit it twice and you’ll have to restart. after icon is highlighted goto properties disable text and there was something else there also disable it also, restart computer. when it opens next time think point window should be gone, if it is goto start, system restore icon should be there still, hit it and pray. once you can get back online get some protection (i went to “avg”) took me about 6 hours to figure this out. hope it helps

  399. mexmass
    Dec 05, 2010 @ 07:23:05

    So has anyone tried to sue this assholes? I am calling the attorney general office to see if there is something that i can do or do it as a group for the time and expenses this company has cost us?

  400. Grace
    Dec 06, 2010 @ 02:51:05

    I got this too and the desktop was locked. What I did was click on “settings” on the ThinkPoint window and at the bottom or something there’s an option you can select to continue without installing or updating. Then you can “X” out of the ThinkPoint window. After that, every time I tried to open my web browser, ThinkPoint would pop up again. So I right clicked the ThinkPoint icon on my desktop, opened the File location and saw it was labeled “Hotfix” in my files. Then I opened my Task Manager, went to the “processes” tab, found “Hotfix,” right clicked it, and ended the process. That got rid of ThinkPoint popping up all the time.

  401. Jeffrey
    Dec 06, 2010 @ 05:47:02

    i thank you for having that information it was so much useful to me. it helps to remove the thinkpoint out from my computer….

  402. generallee69
    Dec 06, 2010 @ 16:39:00

    I repair computers for a living. I just fixed one with this virus. So far the system is running perfectly.
    I rebooted into safe mode, allowed the virus to run its scan, got to my desktop, installed malware bytes program, removed 34 infected files, opened registry and performed searches for “thinkpoint” and “hotfix”, deleted all the entries, and then searched the hardrive for the same words, then deleted all those files. I then had to reinstall anti-virus program. IMPORTANT – Clean out any of these entries in the registry manually because if any are left, they may cause the virus to erupt again. Although Malwarebytes found and removed infected files, the virus was still active after rebooting. This is when I dove into the registry and also searched out the entire hard drive for any of these files.

    Took about two hours from start to finish. Hope this helps someone.

  403. Tim
    Dec 07, 2010 @ 15:28:34

    I have an Windows XP system; I got this virus yesterday, followed the removal instructions for deleting hotfix.exe and starting eplorer.exe. This stopped Thinkpoint and gave me my desktop back but as I launched the Malwarebytes (from a disk) the IE kept trying to go the net and popped up faster than I could close them with other dialog boxes about “terminate this…, errors found…”, etc. Got to the finished scan Malware screen that listed the suspicious files and clicked remove. But another screen called HDD Recovery popped up and asked to defrag hard drive now to correct critical errors. I started the defrag and after about ten minutes the screen went black with only the flashing curser in the top left hand of the screen. Is this a new twqist on this virus? I don’t see any comments about this outcome in the string.
    Now, when I try to reboot it only goes to the black screen; won’t allow any command prompts like F8 or F10 system recovery during reboot. I cncan get into the BIOS but don’t see any safe mode start anywhere. I am at a loss…has it trashed my hardware (although he BIOS still sees all my drives)?

  404. Dennis
    Dec 07, 2010 @ 20:23:54

    I wanna get rid of this virus so bad. I have tried everything and non work so far.. It disabled mouse and keyboard input i think. I could not move my mouse and Ctrl+Alt+Del do nothing even in safe mode. Even command prompt would come up but i cant input anything. I tried the bootable usb but it cant find the file to start up. I burnt it to a cd and it worked but the damn virus is still there. Kaspersky tell me that i need updates >.<
    Unlike everyone here, my cousin was tricked and he purchased the so called full version of the damn thing. He has blocked his bank account so he is unlikely to lose $. However, the files on the pc r important to me and i really wanna get them back. If any of u could help, i would be really grateful.

  405. Matt c
    Dec 08, 2010 @ 01:02:43

    I give my thanks to Matthew, his advice did the trick…and I’ve also just wheeled my PC back with a System restore point just to be extra safe.

    I am just thankful I had my Macbook so I could type ‘Think Point virus’ into a search engine and come across this helpful site, until I figured out how to get around the fake desktop it creates and get online via my PC to download MalwareBytes it was a very scary thing indeed. I would have been lost without the help on this site and it would have been a call to the Computer repair shop for sure.

    I’ve come across these fake virus programme promotions before so luckily I suspected it was a virus right away….but this was the worst i’ve come across.

    Many thanks to all of you for the help…and to those dealing with this thing, try and keep calm and not make any hasty decisions, that’s what the people who have made this horrid thing count on…This thing is designed to SCARE you into parting with your money.

  406. Think point
    Dec 08, 2010 @ 11:03:15

    I has this virus on my computer. I though the error was real. Stupid me. Run Spybot and it will catch it. It shows up as “Fraud.ThinkPoint”. USE SPYBOT TO REMOVE VIRUS

  407. Amanda
    Dec 08, 2010 @ 23:55:07

    Hello, Does anyone have advice on how to rid my Toshiba laptop of the ThinkPoint virus? I can hit CTRL-ALT-DELETE but when I click Task Manager I am redirected back to the ThinkPoint screen, which says Start Safe Mode. Is there another way to rid ThinkPoint from my laptop if I cannot access the Task Manager? Thanks!

  408. ldees
    Dec 09, 2010 @ 18:02:59

    If I save a anti-virus program to a flash drive, how does it install to my computer if I can’t get to any screen except the thinkpad screen?

  409. David Young
    Dec 10, 2010 @ 14:15:09

    Just do it the long, easy way. Reinstall the OS and be sure to do a slow format.

  410. BHaynes
    Dec 12, 2010 @ 03:41:58

    I have successfully removed this piece of crap from around three or four computers but I have one that must be worse off. When it boots I see the post screen and an intel image and then it just goes solid black. No access to task manager and it won’t boot to safe mode eithere.

    I have removed the hard drive and it mounts fine as an external drive. I have copied off all of the files but after I reinstalled the hard drive I booted with the Ultimate Boot DVD and tried running MalwareBytes and check disk. Both worked and when I rebooted to XP I got the same thing. I know I could just reformat and move on but this is like solving a puzzle at this point.

    Any suggestions? I want to look smart to my friend.

  411. BrandonEgg
    Dec 13, 2010 @ 15:37:30

    I’m having a hard time performing any of these suggestions. I am running Windows 7 on my HP Mini Netbook which does not have a disk drive, thus I cannot download a bootable antivirus program and when I try to download the Malwarebytes’ Anti-Malware, I click on the link and then a web page proceeds to pop up that says my browser can not display the webpage. Please help! Thanks!

  412. vincent IT expert
    Dec 13, 2010 @ 17:23:04

    use task killer to delete the think point virus and the its located at the document and delete it manually

  413. Tim
    Dec 13, 2010 @ 17:48:01

    To BHaynes {415}:
    I had the same problem with the black screen of death during booting after being infected and shut down by Thinkpoint – with a twist, see post 408 above.
    A friend of mine brought over a copy of Windows on a stick last night and was able to boot into safe mode from that. We backed up pertinent files first and then tried to reboot normally from the hard drive after running a repair on my XP Media OS from his stick’s OS. It partially worked, but at this point went to a blue screen crash after partially loading XP (got to the XP screen but no furthere).
    Turns out that Thinkpoint apparently changed the interface command in the BIOS to RAID from SATA.
    My system is not arrayed for RAID so it could not complete the reboot process. We switched the interface to IDE and it booted perfectly. Then after a couple of stable reboots, I switched to the original SATA interface which is faster than the older IDE.
    I can’t believe how deeply this bugger gets it’s hooks into the BIOS and then turns ugly when one tries to get rid of it. I have not seen any comments about Thinkpoint doing this to another PC, so I cannot state with 100% certainty that this was done by the virus but this has never happened before on this machine.
    Anyway, get a copy of an OS on the stick (from someoone or make a copy from another PC and start from there to recover your OS. Everything is there, Thinkpoint is just preventing access.

  414. Rakesh
    Dec 13, 2010 @ 20:12:12

    Think point Rocks…… great brains used for nasty things….

    i have XP lite version which runs limited resources and think point doesnot allow me to get in ….
    I used CTRL+ALT+DEL to get my task manager but never worked…. then rebooted and used WIN+L so that i can use different Login but this time around i got opportunity to bring in Task Manager…

    as soon as i logged in i keyed CTRL+ALT+DEL before think pad Screen appeared and killed the hotfix.exe from processor menu of Task Manager…. it had cracked my IE and Chrome which i had used for internet…. so I am currently using Firefor from Task Manager to login… will try tomo on updating with Malware Anti byte …

    hope above step would be usefull to get into Browser….
    Will let you guys know more after running Malware Anti byte new version… i use 1.44v which was running on my system earlier but it had not worked…. let me see with the latest version….

  415. Tim
    Dec 14, 2010 @ 16:52:43

    Just to update my sad situation; apparently Thinkpoint punched a hole in my firewall so this evening when I ran IE I was attacked by another malware similiar to Thinkpoint called HDDRecovery that I thought I had purged already with the Thinkpoint.
    Apparently restore on XP won’t eliminate this breed of malwares completely and they lie are only dormant for a few reboots before it comes back by locating your restore point and tagging along for the ride.
    So, Thinkpoint is gone (I hope) using the procedures detailed in this string but now HDDRecovery requires the same spanking to ‘cleanse’ my system. Here’s what I found g4enerally in the blogs:

    How to removeHDD Recovery Virus manually.
    In order to get rid of HDD Recovery Virus altogethere, start your PC in safe mode with networking, by pressing F8 key. Clean your Windows temp folder.
    Windows Temp folder.
    By default, this is C:/Windows/Temp for Windows 95/98/ME, C:/DOCUMENTS AND SETTINGS/ProfileName/LOCAL SETTINGS/Temp for Windows 2000/XP, and C:/Users/ProfileName/AppData/Local/Temp for Windows Vista and Windows 7
    HDD Recovery Virus stores its files in Windows temp folder. You need to delete these files.
    Impacted Registry Entries, Files and Folders.
    %Temp%[Random Characters]
    %Temp%[Random Characters].exe
    %Temp%dfrg
    %Temp%dfrgr
    %Temp%[Random Characters].dll
    %Temp%[Random Characters].exe
    %Temp%tmp2.tmp
    And also
    %UserProfile%DesktopHDD Recovery.lnk
    %UserProfile%Start MenuProgramsHDD Recovery
    %UserProfile%Start MenuProgramsHDD RecoveryHDD Recovery.lnk
    %UserProfile%Start MenuProgramsHDD RecoveryUninstall HDD Recovery.lnk
    %UserProfile% is C:/Documents and Settings for Windows 2000/XP & C:Users for Windows Vista/7
    %Temp% is C:/DOCUMENTS AND SETTINGS/ProfileName/LOCAL SETTINGS/Temp for Windows 2000/XP & C:/UsersProfile/Name/AppData/Local/Temp for Windows Vista and Windows 7
    Registry Entries:
    HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “[Random Characters]“
    HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “[Random Characters].exe”
    Processes:
    [Random Characters.exe]

  416. kirandy
    Dec 15, 2010 @ 01:24:33

    I can’t even get to the ‘Thinkpoint’ screen. It used to pop up but now when I turn the computer on I eithere get a flashing black screen or a solid black screen. Any suggestions?

  417. RAKESH
    Dec 15, 2010 @ 09:20:26

    I WANT TO REMOVE THINK POINT FROM MY PC MY OC IS NOT WROKING BECAUSE OF THINK POINT

  418. George
    Dec 30, 2010 @ 03:33:27

    OK I have a similar problem with this Think Point Problem. Mine seems a little bit different. When I attempt to boot up my Windows XP Pro. It only now brings up a “Black Screen”. So I went into F8 and hit for “Safe Mode” and all it would do is show 3 lines that I assume are loading files for the Safe Mode. They are as follows:

    1st line; multi(0)disk(0)Partition(0)\Windows\System32\nt0skrnl.exe 2nd line; multi(0)disk(0)Partition(0)\Windows\System32\hal.dll 3rd line; multi(0)disk(0)Partition(0)\Windows\System32\KDCOM.DLL

    and then it stops/freezes there. Nothing happens after it. So I am trying to get into the Safe Mode to kill the hotfix.exe process. And then add new task for explorer.exe in order to DL that malware program.

    Anyone have an idea what I can do to get past this stop of safe mode in order to get to the task manager or to msconfig to disable the Think Point Process?? Any help with this similar problem would be appreciated.

  419. Al
    Dec 30, 2010 @ 17:36:40

    I’ve had Thinkpoint for months now, and am stumped.

    1. Thinkpoint has totally disabled my internet, so no downloading of any kind is possible.

    2. Thinkpoint has totally disabled my Windows (Vista) task manager, so that’s not an option.

    Any rays of hope?

  420. luigi
    Jan 03, 2011 @ 20:36:45

    Al – You should be able to “off load” your critical files using an external drive reader and then boot to your operating system disk and reinstall Windows

  421. Victor
    Jan 05, 2011 @ 16:37:05

    Al,

    You can try System Restore on your Windows Vista.

    Boot Windows in safe mode with Networking (When your pc is restarting keep on pressing F8 and then boot the in Safe Mode with Networking)

    Once the started,
    Click on Start -> All Programs -> Accessories -> System Tools -> System Restore and then try to restore the system to a back date (3-4 months back)
    Else you can leave you number I will try to call you back and see what I can do !

  422. Victor
    Jan 05, 2011 @ 20:01:57

    Amanda,

    Its a long process to kill this virus completely from the computer

    You can leave your number or can contact : victorisgenius @ yahoo.com

    Anyone can mark an Email for any help

    Thanks
    Victor

  423. Blake
    Jan 06, 2011 @ 15:54:04

    i clicked the saft startup or w/e, then i shut down. i tried the malware and it kicks me off the internet so i put it on to a flashdrive and tried to do the setup that way and it kicks me off of that. what do i do now?

  424. Victor
    Jan 06, 2011 @ 19:24:00

    Blake

    Shut down the machine and restart in Safe Mode with Networking (Keep on tapping the F8 key when computer is restarting)

    Then try to open Task Manager by keyboard combination (Ctrl + Shift + Esc)

    GO into the processes tab and kill the hotfix.exe process and then try access internet and run a scan by the updated version of Malware Bytes

    Thanks
    Victor

  425. LUIS DONADO
    Jan 07, 2011 @ 21:56:57

    If you can’t run safemode, try running Directory service Restore Mode. Press F8 to see this option, then proceed with the instructions given here.

    If you can’t run DSRM than you can resort to using a Drive to USB connector. It will appear as an external device on My Computer, then right click on that icon and analyze with Malwarebytes and other updated Malware removal software you may have. Make sure to always update the softwares you use to be current to today’s date.

  426. Shel Rene
    Jan 08, 2011 @ 07:16:07

    Unfortunately my laptop was infected with this virus as well. I started reading over the comments on here and many of them were very helpful; especially the one about the task manager and bringing up iexplore.exe. When I first noticed thinkpoint was when I started up my laptop. but I had no option but to let it run. however when i tried to accept it, the browser wouldnt load up at all. when i went to refresh it, nothing… but anyway.. im in the process of running a scan with the malwarebytes’ antimalware. thanks for the help. :)

  427. lisa cleanit virus
    Mar 20, 2011 @ 04:57:50

    I have the clean it version on my dell desktop xps400. I believe this virus has been on my system for months now. My internet connection has not worked on this machine for months. so when i fixed the internet it only took 2 days for this CLEANIT virus to attack. I tried to get into task manager and it would not let me. I tried safe mode with networking and a few other things listed above. After restarting my system several times now it will not start at all. It shows the dell startup screen and then goes black. I am able to hit f8 and get the menu but no matter what choice i make it goes to a screen that lists many lines that say the same things, like its trying to load. Please help. I have so many files that I have to save!!!! does anyone know how i could just get my files?

  428. Timo
    Mar 20, 2011 @ 17:51:24

    Wow- this thing is a killer. I have the ‘CleanThis’ version of the virus…it is the same thing as the ‘Think Point’ virus & is just as hard to remove. I am running Windows Vista, service pack 2. I could not control-alt-delete or start in ‘safe mode’ because that darn pop up screen always appeared. If I hit control-alt-delete too much it would just reboot my PC.
    I eventually clicked on ‘safe mode with prompt’ which let me into a DOS screen, from there I was able control-alt-delete and then click File, Run, internet explorer (which didn’t work because safe mode has no internet) however, this did get me past that stupid CleanThis screen. I just ran ‘Malware Bytes’ quick scan (found 166 errors) and then rebooted. Ugghh- still did not work! I’m going to try it again and do the long version…I’ll post again if it works, otherwise, just consider me stuck with this virus.
    Also, there is no hotfix.exe anymore, I think it was changed it to gog.exe

  429. Chelsea Smith
    Apr 03, 2011 @ 16:16:38

    For those with these problems: (Vista 32bit OS)

    -Cannot open Task Manager
    -Cannot get to Desktop
    -Desktop lock
    -Cannot get to safe mode
    -Cannot find hotfix process
    -Cannot open downloaded program
    and still, if any problems try this solution.

    Restart your pc, and hold down F8+F12 keys and your keyboard will start beeping. Let it beep. From there, select your reboot options and see what works best. and as for myself, I wound up under safe mode and also found my Guest account was NOT infected, unlike the Admin account, and I worked and downloaded from there.

    Hope this Helps, Jesus Is Savior and Lord, God Bless You!!

  430. Truxton
    Apr 17, 2011 @ 02:26:10

    this is a really mean virus and hard to get rid of but the best way to do it is to start your pc normally then choose your account then go in and dont start it yet then press ctrl-shift-esc then go to process then terminate hotfix.exe ok? then just restart pc and be on your way! =]

  431. Vijay
    Jul 16, 2011 @ 09:41:50

    hi

    iam not able to download the anti virus_MBAM, and also my Task manager not working. please suggest.

  432. Denice
    Apr 15, 2012 @ 02:15:33

    I’ve been hijacked by a virus called smart scan hdd. How can I access my frozen data content? I’ve reinstalled windows twice. I was able to recover data but can’t access it cause the content is frozen. I can see the names of the files, the file type and even the size. Although a great deal is lost, I’m wondering how I could recover the files that I can still see. I have my draft graduation thesis and other important files on it and I,m completely hopeless. Please help me find a solution to this problem? Thanks in advance…

Leave a Reply

*

Disclaimer:
Read our article disclaimer about Think Point.