Thanks to rogueamp for making this video.
When you press the OK button, to allow Palladium Pro to install, the Trojan will reboot your computer to finish the installation.
After a reboot, you will see the "Palladium World's leading security solution" screen instead of your normal Windows desktop.
When you click the "Safe startup" button, the fake Palladium Pro scanner window will show up on your computer screen. The rogue will pretend to scan your computer for malware. After the fake scan, it will prompt you to buy heuristic modules to remove the threats from your computer which don't even exist. Do not fall victim to this rogue program. Furthermore, Palladium Pro will interfere with the normal operation of the computer. It will prevent you from launching other applications and block access to legitimate websites. In order to remove Palladium Pro from your computer, you will have to end its process, restore Windows explorer and scan your computer with anti-malware software. If you choose to remove the rogue program manually then you will also have to change Windows shell value in the registry; otherwise your Windows desktop will not be displayed the next time you reboot. Be advised, that the rogue may come bundled with other malicious software. That's why we strongly recommend you to use anti-malware software. For more information, please follow the removal instructions below. And, of course, if you have already purchased this bogus program, then you should contact your credit card company and dispute the charges. If you have any questions regarding Palladium Pro removal, then please leave a comment. Helpful comments are welcome as always. Good luck and be safe online!
Palladium Pro removal instructions:
1. Restart your computer. Once the "Palladium World's leading security solution" window comes press Ctrl+Alt+Delete or Ctrl+Shift+Escape. You should now see the Windows Task Manager screen as shown in the image below or a screen where you can select the Task Manager to be run.
Click on the Processes tab. Then click and highlight palladium.exe and click End Task. If it asks you "Are you sure you want to terminate the process?" click yes (or press Enter). This will close the ThinkPoint program.
2. While in Windows Task Manager, click the File -> "New Task (Run...)" from the menu on the bottom right. Type in explorer.exe and click OK. Your desktop and icons should start up as normal.
NOTE: if you got an error message "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access them", then please run this command first:
cacls "C:\Windows\explorer.exe" /G Everyone:F
A new windows will come up asking "Are you sure?" Type Y and press enter.
Now run explorer.exe again.
3. Download the following file to your Desktop: windows-shell.reg. Double-click to run it. Click "Yes" when it asks if you want to add the information to the registry. This file will fix the Windows Shell entry. This step is important because if you won't fix this entry, then your Windows Desktop will not be displayed the next time you reboot. Once the new registry value has been added, you can delete the file from your computer.
4. Run Internet Explorer or any other browser and download free anti-malware software from the list below:
Run a full system scan and remove Palladium Pro from your computer.
NOTE: in some cases the rogue program may block anti-malware software. Before saving the selected program onto your computer, you may have to rename the installer to iexplore.exe or winlogon.exe With all of these tools, if running Windows 7 or Vista they MUST be run as administrator.
5. New threats appear every day. In order to protect your PC from such (new) infections we strongly recommend you to use ESET NOD32 Antivirus 4.
Palladium Pro associated files and registry values:
Files:
For Windows XP users:
- C:\Documents and Settings\[User Name]\Application Data\palladium.exe
- C:\Documents and Settings\[User Name]\Application Data\[SET OF RANDOM CHARACTERS].bat
- C:\Documents and Settings\[User Name]\Application Data\uid_pal
- C:\Documents and Settings\[User Name]\Application Data\completescan_pal
- C:\Documents and Settings\[User Name]\Application Data\install_pal
- C:\Documents and Settings\[User Name]\Desktop\Palladium.lnk
- C:\Documents and Settings\[User Name]\Start Menu\Programs\Palladium.lnk
- C:\Windows\Tasks\At[random].job
- C:\Users\[User Name]\AppData\Roaming\palladium.exe
- C:\Users\[User Name]\AppData\Roaming\[SET OF RANDOM CHARACTERS].bat
- C:\Users\[User Name]\AppData\Roaming\uid_pal
- C:\Users\[User Name]\AppData\Roaming\completescan_pal
- C:\Users\[User Name]\AppData\Roaming\install_pal
- C:\Users\[User Name]\Desktop\Palladium.lnk
- C:\Users\[User Name]\Start Menu\Programs\Palladium.lnk
- C:\Windows\Tasks\At[random].job
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell = "%AppData%\palladium.exe"
