Web Talk

Lately, users are reporting a nasty virus infecting a lot of computers. The virus is called ThinkPoint and it tricks users into thinking that it is a legitimate antivirus protection tool. Once installed on a computer or laptop it causes multiple pop-ups, fake virus infection alerts, purchase advices, security issues etc. Other more serious consequences include: Internet connection issues (users can not connect to the Internet anymore) and locked Windows files. Such virus gives also issues after it has been uninstalled by triggering the following Windows error message: “Windows Explorer has stopped working”.  What follows is a list of solutions on how to remove and uninstall it and get rid of all the problems it causes. Thinkpoint antiviurs will alert and scare you  with the following pop message:

Here are some remedies  which will help you remove and uninstall the Thinkpoint fake antivirus.

First Solution (it will let you gain Internet connection so that you will be able to download a good antivirus).

1. Restart your Windows OS in Safe Mode with Networking.
2. Go to C:\Documents and Settings\ UserProfile\ Application Data. (for Windows XP).
3. Go to C:\Users\ AppData\Roaming or C:\Users\ AppData\Local (for Windows Vista and Windows 7).
4. Rename the following files: hotfix  to hotfixbak, tmp to tmpbak, thinkpoint to thinkpointback.
5. Reboot your computer normally. Now you should be able to connect to the Internet.

Second Solution.

1. Restart your computer. Once ThinkPoint appears press Ctrl+Alt+Delete or Ctrl+Shift+Esc. You should be able to see the Windows Task Manager screen.
2. Click the Porcesses tab and kill: hotfix.exe.
3. Now on the Task Manager window, click File – New Task – Run…  and type explorer.exe.
4. Click OK.
5. Open your browser, download and run  Spybot-S&D.

Third Solution.

Read my old article on how to delete fake antiviruses. (download Sandboxie)

Clean your computer from Thinkpoint leftovers

Now, let’s delete all the junk Thinkpoint installed on our computer. Delete the following files:

Windows XP

• C:\Documents and Settings\ Username\Application Data\ hotfix.exe
• C:\Documents and Settings\ Username \Application Data\ [random words and numbers].bat

Windows Vista and Windows 7

• C:\Users\ Username\AppData\Roaming\ hotfix.exe
• C:\Users\ Username\ AppData\Roaming\ [random words and numbers].bat

Now, delete the following registry keys: (click Start – Click Run… or type in the Search filed CMD and press Enter).

• HKEY_CURRENT_USER \Software \PAV
• HKEY_CURRENT_USER\ Software\ Microsoft\ Windows\CurrentVersion\ Internet Settings “WarnonBadCertRecving” = “0″
• HKEY_CURRENT_USER\ Software\Microsoft\ Windows\CurrentVersion\ Internet Settings “WarnOnPostRedirect” = “0″
• HKEY_CURRENT_USER\Software\ Microsoft\ Windows NT\CurrentVersion\ Winlogon “Shell” = “%AppData%\hotfix.exe”

After this, some users still reporting issues related to the following error message: Windows Explorer has stopped working. Read this article and ITS COMMENTS to solve it.