1

I have a Windows 7 box infected with the fake Thinkpoint anti-malware program. I do not have of the admin password on this computer. I did find what appears to be some good instructions at BleepingComputer.com to remove this, but am unsure on how to proceed.

  1. Has anyone successfully removed this malware ( if so, can you recommend steps )

  2. If I need to get into an admin account on Win 7, what is the best way? I have used Ultimate Boot CD in the past on XP boxes, but have not done so on 7 yet.

mozzer
  • 149

1 Answers1

2

First thing is to get into safe mode. To do this, while the PC is booting up, press F8. A list of startup options should be listed. CHoose Safe Mode.

How to remove ThinkPoint manually:

Manual removal of ThinkPoint is a feasible objective if you have sufficient expertise in dealing with program files, processes, .dll files and registry entries.

The files to be deleted are listed below:

* %UserProfile%\Application Data\hotfix.exe
* %UserProfile%\Application Data\thinkpoint.exe

The registry entries that need to be removed are as follows:

* HKEY_CURRENT_USER\Software\PAV
* HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “thinkpoint”
* HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon “Shell” = “%Documents and Settings%\[UserName]\Application Data\hotfix.exe”

(taken from: http://remove-malware.net/how-to-remove-thinkpoint-rogue-anti-spyware/)

Wayne-Z
  • 335