Your computer is infected with malicious software? Do you have popups on your PC?
If so, search this blog for removal instructions or find computer threats by category.

Tuesday, January 4, 2011

How to Remove Palladium Pro (Uninstall Guide)

Tell your friends:
Palladium Pro is a rogue security program that pretends to be legitimate antivirus software and attempts to deceive unsuspecting PC users into paying to remove fake or simulated malware infections. Palladium Pro is a rebranded version of ThinkPoint rogue. It relies on social engineering, whereby the user is tricked into installing Trojan virus which masquerades as Microsoft Security Essentials and displays a fake security warning that uses the same fonts, colors, and layout as trusted security program. It makes false claims about having detected unknown Win32/Trojan and states that Microsoft Security Center has detected the submitted suspicious file as Trojan.Horse.Win32.PAV.64.a. Trojan then prompts the user to install Palladium Pro to solve the problem. As you may already know, profit is a primary motivation for creators of such malware. Please do not purchase Palladium Pro for any reason. If you are reading this article then your computer is probably infected with this fake program. Thankfully, we've got the removal instructions to help you to remove Palladium Pro and related malware from your computer. Please follow the removal guide below.




Thanks to rogueamp for making this video.

When you press the OK button, to allow Palladium Pro to install, the Trojan will reboot your computer to finish the installation.



After a reboot, you will see the "Palladium World's leading security solution" screen instead of your normal Windows desktop.



When you click the "Safe startup" button, the fake Palladium Pro scanner window will show up on your computer screen. The rogue will pretend to scan your computer for malware. After the fake scan, it will prompt you to buy heuristic modules to remove the threats from your computer which don't even exist. Do not fall victim to this rogue program. Furthermore, Palladium Pro will interfere with the normal operation of the computer. It will prevent you from launching other applications and block access to legitimate websites. In order to remove Palladium Pro from your computer, you will have to end its process, restore Windows explorer and scan your computer with anti-malware software. If you choose to remove the rogue program manually then you will also have to change Windows shell value in the registry; otherwise your Windows desktop will not be displayed the next time you reboot. Be advised, that the rogue may come bundled with other malicious software. That's why we strongly recommend you to use anti-malware software. For more information, please follow the removal instructions below. And, of course, if you have already purchased this bogus program, then you should contact your credit card company and dispute the charges. If you have any questions regarding Palladium Pro removal, then please leave a comment. Helpful comments are welcome as always. Good luck and be safe online!


Palladium Pro removal instructions:

1. Restart your computer. Once the "Palladium World's leading security solution" window comes press Ctrl+Alt+Delete or Ctrl+Shift+Escape. You should now see the Windows Task Manager screen as shown in the image below or a screen where you can select the Task Manager to be run.



Click on the Processes tab. Then click and highlight palladium.exe and click End Task. If it asks you "Are you sure you want to terminate the process?" click yes (or press Enter). This will close the ThinkPoint program.

2. While in Windows Task Manager, click the File -> "New Task (Run...)" from the menu on the bottom right. Type in explorer.exe and click OK. Your desktop and icons should start up as normal.



NOTE: if you got an error message "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access them", then please run this command first:

cacls "C:\Windows\explorer.exe" /G Everyone:F



A new windows will come up asking "Are you sure?" Type Y and press enter.



Now run explorer.exe again.

3. Download the following file to your Desktop: windows-shell.reg. Double-click to run it. Click "Yes" when it asks if you want to add the information to the registry. This file will fix the Windows Shell entry. This step is  important because if you won't fix this entry, then your Windows Desktop will not be displayed the next time you reboot. Once the new registry value has been added, you can delete the file from your computer.

4. Run Internet Explorer or any other browser and download free anti-malware software from the list below:
Run a full system scan and remove Palladium Pro from your computer.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator.

5. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET NOD32 Antivirus 4.


Palladium Pro associated files and registry values:

Files:

For Windows XP users:
  • C:\Documents and Settings\[User Name]\Application Data\palladium.exe
  • C:\Documents and Settings\[User Name]\Application Data\[SET OF RANDOM CHARACTERS].bat
  • C:\Documents and Settings\[User Name]\Application Data\uid_pal
  • C:\Documents and Settings\[User Name]\Application Data\completescan_pal
  • C:\Documents and Settings\[User Name]\Application Data\install_pal
  • C:\Documents and Settings\[User Name]\Desktop\Palladium.lnk
  • C:\Documents and Settings\[User Name]\Start Menu\Programs\Palladium.lnk
  • C:\Windows\Tasks\At[random].job
For Windows Vista and Windows 7 users:
  • C:\Users\[User Name]\AppData\Roaming\palladium.exe
  • C:\Users\[User Name]\AppData\Roaming\[SET OF RANDOM CHARACTERS].bat
  • C:\Users\[User Name]\AppData\Roaming\uid_pal
  • C:\Users\[User Name]\AppData\Roaming\completescan_pal
  • C:\Users\[User Name]\AppData\Roaming\install_pal
  • C:\Users\[User Name]\Desktop\Palladium.lnk
  • C:\Users\[User Name]\Start Menu\Programs\Palladium.lnk
  • C:\Windows\Tasks\At[random].job
Registry values:
  • HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell = "%AppData%\palladium.exe"
Share this information with other people:

15 comments:

Anonymous said...

what if there is no windows task manager?? can somebody help me?

Admin said...

Which version of Windows do you use?

Once the "Palladium World's leading security solution" window comes click "Safe startup".

If you use Windows XP, go to:
C:\Documents and Settings\[User Name]\Application Data\

If you use Windows Vista/7, go to:
C:\Users\[User Name]\AppData\Roaming\

Create a new folder named "sold_pal" (without quotes). This trick should stop the rogue program and you should be able to download anti-malware software.

OR you can rename palladium.exe to any-name.exe. Then open registry editor and fix Windows shell value.

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell = "%AppData%\palladium.exe"

Change %AppData%\palladium.exe to explorer.exe

I hope this helps. Good luck!

Anonymous said...

once you have removed all threats and such and the computer starts normally, do you delete Palladium for Windows from your desktop and programs and then from the recycling bin, or is there a way of uninstalling the program?

Anonymous said...

thank u sooo much,something finally worked!! i followed till point 2 and then once my internet explorer and system restore became available,i went ahead and restored my pc to an earlier date.
hope this will not bring back any virus...can i use my pc normally now?

alex said...

Thank you very much, pretty simple to follow directions. I deleted the files and the registry peice myself and it seems to be working great

Anonymous said...

They are on to this....when you do control+alt+delete to reach task master the pc goes to black screen..... what to do now?

Anonymous said...

When I try to open this (cacls "C:\Windows\explorer.exe" /G Everyone:F) it dosen't show up.

Anonymous said...

Yeah, CNTL-ALT-DEL doesn't work anymore.

Ren said...

So I went to my Task Manager in Method one, and I couldn't find the files that should be deleted anywhere on Task Manager. I have a Windows 7 Starter.

What I mean is that I cannot locate the programs At1 through At24 in Task Scheduler anywhere. Is it a bad thing that it is not there, or is this a good thing?

Nate said...

I couldn't get into the task manager and safe mode with networking didn't work. The operating system was Windows Vista. I started the computer in safe mode with command prompt and removed the files manually. Upon restart I was able to remove the rest.

Anonymous said...

I'm using Windows 7 as well and didn't find AT1... in Task Scheduler. But so far looks like everything's okay. THANK YOU SO MUCH!!!

Anonymous said...

TAHNK YOU!!!!

Anonymous said...

Thank-you very much for your help - it is greatly appreciated. Like some of the others on this site, though, I didn't see AT in the Scheduled Task section... is that bad or good? Now I'm paranoid...but the computer does seem to be running just fine...

Admin said...

That's OK, don't worry. Scheduled Task ATs don't appear in some cases.

Anonymous said...

I can't find Application data after going to users and user name