ThinkPoint

ThinkPoint is a rogue security product that pretends to find malicious code on a victim’s machine in order to frighten him or her into purchasing this useless application.

ThinkPoint is downloaded by the (existing) fake Microsoft Security Essentials alert online scam. However, the malware writers have changed the code so the downloader is copied to the users profile folder and is run after a reboot. Previously, the fake Security Essentials alert displayed fake scan results in order to get the user to chose a security product from a list of different names (which actually resulted in the same install.)

Initial fake Microsoft Security Essentials Alert screen:




(Click on graphic to enlarge)

“Click OK” screen “to allow operation system (sic) to install the trial version of ThinkPoint(c)."



(Click on graphic to enlarge)

ThinkPoint GUI:



(Click on graphic to enlarge)

Payment screen:


 
(Click on graphic to enlarge)

Splash screen:




(Click on graphic to enlarge)

Threat Name: ThinkPoint.FakeRean

How to remove ThinkPoint:

When you fall victim to the ThinkPoint rogue security application, the downloader reboots your machine then presents the victim with its own scanning screen on a Windows blue screen.

 
(Click on graphic to enlarge)

Once the machine is rebooted, the rogue takes over the machine by preventing Explorer.exe to load (which means, the desktop will not load, either). If you click on the X in the upper right corner to close out of ThinkPoint, you are then presented with the “unprotected startup” screen.

A victim can’t get around the ThinkPoint screen because “current settings don’t allow unprotected startup.”

 
(Click on graphic to enlarge)

However, ThinkPoint actually has an operating “settings” selection with a drop-down box that includes a checkbox “Allow unprotected startup.” You can close the ThinkPoint window and load your desktop once that has been checked. From there, you can use Windows Task Manager to stop hotfix.exe -- the rogue’s main file.


(Click on graphic to enlarge)

If  ThinkPoint has infected your pc, you should remove it immediately. Click here to use VIPRE to remove ThinkPoint from your computer now.