ThinkSmart

2 November 2010 Rogue 0 Comment

ThinkSmart virus will be another widely-spread fake anti-virus program based on the behavior it has shown when invaded a computer. To some this Think Smart virus was just another unwanted application that when installed on computers can be easily remove using an anti-malware program. But with the current diagnostics, it performs and endangers the computer more than its previous variant called Think Point. A Trojan will be utilized to redirect a web browser to predefined malicious web sites. From there, ThinkSmart will be installed on computer and modifications will be completed on the affected PC that will have itself to load instantly when Windows is started. Dozens of fabricated alarm is presented to convince user that virus infection may cause severe damage on the computer. At this point, an advise to purchase the registered version is revealed as the only solution.

This unwanted program will never stop promoting itself either in a form of fake alerts, browser redirection and blocked Internet access with false error page. Don’t mind all of this, instead remove ThinkSmart virus instantly by having a descent anti-malware program that was tested and proven to remove counterfeit and annoying software from a compromised computer.

Screen Shot Image:

Alias: Think Smart

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

ThinkSmart Removal Procedures

Manual Removal:
1. Unload any running ThinkSmart process by pressing Ctrl+Alt+Del on your keyboard. This will open Task Manager. Look for the following process and click “End Process”:
hotfix.exe

2. If there are antivirus programs installed, connect to Internet and update it to have the latest database and pattern files.
3. Thoroughly scan the computer and clean/delete all infected files. Check if there are remnants of virus-related files, delete if found.
4. Edit Windows registry and delete ThinkSmart entries. [how to edit registry]
5. Close registry editor, changes will be save automatically.
6. Remove start-up entry by going to Start > Run, type msconfig on the “Open” dialog box. System Configuration Utility will open. Go to Startup tab and uncheck the following Startup item(s):
hotfix.exe

7. Click on Apply and reboot the computer for changes to take effect.

ThinkSmart Removal Tool:
For automatic removal of this malware, please download and run Malwarebytes Anti-Malware here. There are instances that ThinkSmart Trojan will block the downloading execution of security application. On this situation, please download the file from an uninfected computer and rename it before installing on the infected computer.

Technical Details and Additional Information:

Malicious Files Added by Think Smart :
HKCU\Software\Microsoft\Windows NT\CurrentConfiguration\Winlogon\\Shell = %AppData%\hotfix.exe

ThinkSmart Registry Entries:
%UserProfile%\Application Data\completescan
%UserProfile%\Application Data\hotfix.exe
%UserProfile%\Application Data\install