My computer got infected with ThinkPoint virus and how I got rid of it

-
My computer got infected from an external drive with a virus masquerading itself as an official Microsoft looking anti-malware calling itself ThinkPoint! If you see something like the screen shot below, do not click any of the buttons. If you did, then the malware will be installed on your machine and it will force you to restart the computer.



 Upon restarting, the following screen will be shown.


Once the computer is infected, then you cannot bring up the Windows Task Manager. Instead, it will show the screen below.


I found a way to kill off the ThinkPoint malware by using the PsTools from the Windows Sysinternals website. Download PsTools and unzip to a folder e.g. C:\Share\PsTools.

Kill off the ThinkPoint process

  1. Open up a Windows Command Prompt.
  2. In the Command Prompt, type in the following commands to list out the running processes:

    C:\> cd \share\pstools
    C:\> pslist

    A list of running processes is displayed.
  3. Determine the process id number of the hotfix process, e.g. 2124.

    Note: hostfix.exe is one of the files used by the ThinkPoint malware.
  4. In the Command Prompt, type in the following command to kill off the hotfix process.

    C:\> pskill 2124

    The process is killed and the ThinkPoint dialog box disappears from the screen. A sample session is shown below.


Remove all ThinkPoint files


ThinkPoint installs files onto the current user's Application Data folder on Windows XP e.g. C:\Documents and Settings\[user]\Application Data\. These files have to be removed.

  1. In a Windows Explorer, browse to the current user's Application Data folder.


  2. Mouse left click and press down the CTRL key to select the following files. Press DELETE.

    start
    completescan
    install
    hotfix.exe
    agtykj.bat (the letters are random)
Fix the Registry
  1. Select Start > Run.

    The Run dialog box appears.
  2. Type in regedit.


  3. Click OK.
  4. In the Registry Editor, select the key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" = "%AppData%\hotfix.exe".
  5. Press Delete.

    The key created by the malware is deleted.

Comments

Post a Comment

Popular posts from this blog

Image background removal using Krita

-
Image
Like other image editing software such as Gimp or Photoshop , Krita has similar tools to remove the background of an image non-destructively using transparency masks. The following steps show how: Open up an image in Krita . In the Layers pane on the right, mouse right click on the paint layer. A pop up menu appears . Choose Add | Transparency Mask . A transparency mask sub layer is created underneath the paint layer . Draw a selection polygon roughly around the foreground object in the image using the Polygonal Selection Tool , as shown below. Then in the File menu, click Select | Invert Selection . Choose Black as the foreground color. Choose a Brush e.g. Basic-1 Ink . Make sure the transparency mask layer is selected or active. Then paint over the background. Choose Select | Deselect to remove the selection polygon. The marching ants selection polygon is removed . Make the brush size smaller and zoom closer  to the background - foreground boundary. Brush over t...
Read more

Making a simple balloon using Inkscape

-
Image
Here is a simple example of making a simple vector line art of a balloon (shown below) using the Inkscape paths and node tools. Create the balloon body Create a new Inkscape document. Click the Create Circles, Ellipses and Arcs (F5) button of the Toolbox . Place an ellipse on the canvas. If you like, toggle off the stroke and color fill it with solid pink. Select Path | Convert Object to Path . Then click the Edit Paths by Nodes (F2) button in the Toolbox . Drag a rectangle to enclose the middle node as shown below. Press ARROW UP on the keyboard a few times. Drag a rectangle to cover the middle and bottom nodes as shown below. Then press the Insert New Nodes into Selected Segments button on the Controls Bar . 2 nodes are created . Drag a rectangle covering only the two newly created nodes. Then press > on the keyboard a few times to shape the balloon to your satisfaction. Create the balloon end In the Toolbox , click the Create Rectangles and Squares (...
Read more

How to copy and paste the color from one object to another using Inkscape

-
Image
In Inkscape , it is possible to copy the color from one object to another object using the Pick Color   tool. This saves a bit of time since you don't have to note down the source color and type in the new RGB color values in some dialog box.  To illustrate how to do this, see the following steps. In Inkscape , click the Pick Color tool    icon in the left tool bar or press F7 on the keyboard. The cursor changes to an eye dropper . Hover the cursor over the object with the source color e.g. green S , as shown below. Then press CTRL+C . The color underneath the cursor is copied over to the clipboard . Then click the Select and transform objects tool or press F1 . Now click on the object to be changed, e.g. blue G , as shown below. Press CTRL+V . The selected object's color is changed from blue to green. 
Read more