ThinkPoint will first pose as a simple Flash Player updated, although when run it will display a fake Microsoft Security Essentials alert, claiming an Unknown Win32/Trojan has breached the system (which is a rare case that even a legitimate program finds an unknown trojan). The user will likely select "Clean Computer", which will recommend them to "Scan Online". Once the user has scanned online, the software will recommend to activate a free trial of "ThinkPoint" and the "infected" PC will restart.The infected system will boot into a splash screen, with two options: "Normal Startup" and "Safe Startup". Of course, normal startup will not be available until you configure the settings. Once the user starts the scan, they might realize that Regedit and CMD have been unblocked, but it will still block task manager (unless the user finds a way to get past it's blocklist by copying the task manager application and rename it a name that ThinkPoint won't detect).
Once the user configures the application so they can perform an Un-Safe startup they will boot into Windows. The user may now proceed to remove the program.
1. When ThinkPoint starts, immediately press CTRL+ALT+DEL. Now select Task Manager and kill the process.
2. Now, start a new task "Explorer.exe"
3. From here, the user can simply download Malware-Bytes Anti-Malware, and the user's system will be clean.