Think Point

18 October 2010 Rogue 434 Comments

Think Point, which is also known as ThinkPoint virus is part of a fake Microsoft Security Essentials Alert. Think Point is being advertised as one of the five removal tool that may get rid of any infection found on computer. Initial infection will result to malfunction of Windows desktop, removing all icons and displaying nothing but fake alert message stating virus presence. An attempt to clean this malware will open up a new window displaying multiple virus scanners but only five rogue programs are able to identify the infection, and that includes Think Point.

Executing any of the endorsed rogue product will allow itself to be installed on the system. Having it on the PC will provide various annoyances including blocked Internet access, browser hijacking and system malfunction. It’s hard to believe that this destructive virus also obstruct Safe Mode start-up. Trying to run any installed applications will be blocked by Think Point and instead it releases warning message stating that executable file is already compromised. It appears like there is no other way to get rid of ThinkPoint at this moment.  All of these displeasure carried out on the computer aims to persuade users into getting the licensed version of useless software called Think Point.

Screen Shot Image:

If you see the introduction window. Do not click on “Safe Startup” to prevent installation of Think Point. Restart Windows immediately and perform a virus scan.

Alias: ThinkPoint Virus

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Malware Behavior
Think Point will prevent all applications from running. Any attempts to run a program will pop-up a window containing this message:

The application file.exe was launched successfully but it was forced to shut down due to security reasons.
This happened because the application was infected by a malicious program which might pose a threat for the OS.
It is highly recommended to install the necessary heuristic module and perform a full scan of your computer to exterminate malicious programs from it.

Added Registry Entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = "%AppData%\hotfix.exe" 
KEY_CURRENT_USER\Software\PAV
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Setting "WarnonBadCertRecving" = "0"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "WarnOnPostRedirect" = "0"

Associated Files and Folders:

%UserProfile%\Application Data\hotfix.exe
%UserProfile%\Application Data\thinkpoint.exe
%UserProfile%\Application Data\install

Think Point Removal Tool

This guide requires a tool called Malwarebytes' Anti-Malware. It is a free tool designed to eradicate various computer infections. MBAM scanner is distributed for free.

1. Download Malwarebytes’ Anti-Malware. Save the file on your Desktop or any desired location as long as it is accessible to you.
2. When finish downloading, double-click on the file mbam-setup.exe to install the application.
3. Follow the prompts and install with default configuration.
4. Before the installation completes, you need to update the database.

5. Click Finish. Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
6. When update is finished please exit MBAM. We have to reboot your computer in Safe Mode.
- Press F8 repeatedly on your keyboard right before Windows logo begins to load.
- Windows Advanced Options menu will appear.
- Select Safe Mode.

7. If Windows is already on Safe Mode. Locate Malwarebytes' Anti-Malware icon and run. Select Perform full scan to check your computer thoroughly.
8. When scanning is finished click on Show Results.
9. Make sure that all detected threats are checked, click on Remove Selected. This will delete all files and registry entries that belongs to Think Point.
10. Restart your computer.

Note: If Think Point prevents mbam-setup.exe from downloading. Download the software from another computer. Renaming it to something like 'anything.exe' can help elude the malware.