dominoc

My computer got infected from an external drive with a virus masquerading itself as an official Microsoft looking anti-malware calling itself ThinkPoint ! If you see something like the screen shot below, do not click any of the buttons. If you did, then the malware will be installed on your machine and it will force you to restart the computer.  Upon restarting, the following screen will be shown. Once the computer is infected, then you cannot bring up the Windows Task Manager . Instead, it will show the screen below. I found a way to kill off the ThinkPoint malware by using the PsTools from the Windows Sysinternals website. Download PsTools and unzip to a folder e.g. C:\Share\PsTools . Kill off the ThinkPoint process Open up a Windows Command Prompt . In the Command Prompt , type in the following commands to list out the running processes: C:\> cd \share\pstools C:\> pslist A list of running processes is displayed. Determine the process id number of ...

I found my home computer and a few thumb drives infected with this virus. The only indication that something was not right was that whenever I plug in my multi-card reader into my USB port, a message will pop up saying that the drive is empty or something to that effect; or in other words, something was trying to write to my multi-card slots. So I examined my thumb drives and SD cards and found these hidden files VirusRemoval.vbs and Autorun.inf on it. Luckily this virus doesn't do anything more damaging than changing the home page of Internet Explorer and propagating itself onto portable drives. And I was able to remove it with a few simple steps. Symptoms of the virus: If a computer is infected, then the following are true. The file VirusRemoval.vbs can be found in the Windows system folder c:\Windows\System32\ as a hidden, readonly file. The HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\ registry entry will be set to start up the VirusRemoval.vbs scr...