Palladium Pro is a rogue security program that pretends to be legitimate antivirus software and attempts to deceive unsuspecting PC users into paying to remove fake or simulated malware infections. Palladium Pro is a rebranded version of ThinkPoint rogue. It relies on social engineering, whereby the user is tricked into installing Trojan virus which masquerades as Microsoft Security Essentials and displays a fake security warning that uses the same fonts, colors, and layout as trusted security program. It makes false claims about having detected unknown Win32/Trojan and states that Microsoft Security Center has detected the submitted suspicious file as Trojan.Horse.Win32.PAV.64.a. Trojan then prompts the user to install Palladium Pro to solve the problem. As you may already know, profit is a primary motivation for creators of such malware. Please do not purchase Palladium Pro for any reason. If you are reading this article then your computer is probably infected with this fake program. Thankfully, we've got the removal instructions to help you to remove Palladium Pro and related malware from your computer. Please follow the removal guide below.
Thanks to rogueamp for making this video.
When you press the OK button, to allow Palladium Pro to install, the Trojan will reboot your computer to finish the installation.
After a reboot, you will see the "Palladium World's leading security solution" screen instead of your normal Windows desktop.
When you click the "Safe startup" button, the fake Palladium Pro scanner window will show up on your computer screen. The rogue will pretend to scan your computer for malware. After the fake scan, it will prompt you to buy heuristic modules to remove the threats from your computer which don't even exist. Do not fall victim to this rogue program. Furthermore, Palladium Pro will interfere with the normal operation of the computer. It will prevent you from launching other applications and block access to legitimate websites. In order to remove Palladium Pro from your computer, you will have to end its process, restore Windows explorer and scan your computer with anti-malware software. If you choose to remove the rogue program manually then you will also have to change Windows shell value in the registry; otherwise your Windows desktop will not be displayed the next time you reboot. Be advised, that the rogue may come bundled with other malicious software. That's why we strongly recommend you to use anti-malware software. For more information, please follow the removal instructions below. And, of course, if you have already purchased this bogus program, then you should contact your credit card company and dispute the charges. If you have any questions regarding Palladium Pro removal, then please leave a comment. Helpful comments are welcome as always. Good luck and be safe online!
Palladium Pro removal instructions:
1. Restart your computer. Once the "Palladium World's leading security solution" window comes press Ctrl+Alt+Delete or Ctrl+Shift+Escape. You should now see the Windows Task Manager screen as shown in the image below or a screen where you can select the Task Manager to be run.
Click on the Processes tab. Then click and highlight palladium.exe and click End Task. If it asks you "Are you sure you want to terminate the process?" click yes (or press Enter). This will close the ThinkPoint program.
2. While in Windows Task Manager, click the File -> "New Task (Run...)" from the menu on the bottom right. Type in explorer.exe and click OK. Your desktop and icons should start up as normal.
NOTE: if you got an error message "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access them", then please run this command first:
cacls "C:\Windows\explorer.exe" /G Everyone:F
A new windows will come up asking "Are you sure?" Type Y and press enter.
Now run explorer.exe again.
3. Download the following file to your Desktop: windows-shell.reg. Double-click to run it. Click "Yes" when it asks if you want to add the information to the registry. This file will fix the Windows Shell entry. This step is important because if you won't fix this entry, then your Windows Desktop will not be displayed the next time you reboot. Once the new registry value has been added, you can delete the file from your computer.
4. Run Internet Explorer or any other browser and download free anti-malware software from the list below:
Run a full system scan and remove Palladium Pro from your computer.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator.
5. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET NOD32 Antivirus 4.
Palladium Pro associated files and registry values:
Files:
For Windows XP users:
- C:\Documents and Settings\[User Name]\Application Data\palladium.exe
- C:\Documents and Settings\[User Name]\Application Data\[SET OF RANDOM CHARACTERS].bat
- C:\Documents and Settings\[User Name]\Application Data\uid_pal
- C:\Documents and Settings\[User Name]\Application Data\completescan_pal
- C:\Documents and Settings\[User Name]\Application Data\install_pal
- C:\Documents and Settings\[User Name]\Desktop\Palladium.lnk
- C:\Documents and Settings\[User Name]\Start Menu\Programs\Palladium.lnk
- C:\Windows\Tasks\At[random].job
- C:\Users\[User Name]\AppData\Roaming\palladium.exe
- C:\Users\[User Name]\AppData\Roaming\[SET OF RANDOM CHARACTERS].bat
- C:\Users\[User Name]\AppData\Roaming\uid_pal
- C:\Users\[User Name]\AppData\Roaming\completescan_pal
- C:\Users\[User Name]\AppData\Roaming\install_pal
- C:\Users\[User Name]\Desktop\Palladium.lnk
- C:\Users\[User Name]\Start Menu\Programs\Palladium.lnk
- C:\Windows\Tasks\At[random].job
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell = "%AppData%\palladium.exe"
0 comments:
Post a Comment