Paladin Antivirus is a new rogue antispyware program from the same family of rogues as Malware Defense and Anti Malware. Nothing new here, the rogue is distributed with the help of trojans. When the trojan is started, it will download and install Paladin Antivirus onto your computer without your permission and knowledge. The same trojan will also register the program in the Windows registry to run automatically every time when Windows loads.
During installation, Paladin Antivirus will ask you to uninstall legitimate antispyware tools (Malwarebytes’ Anti-Malware, AVG, etc). The following alert will be shown:
Paladin Antivirus
There is unauthorized antivirus software detected on your computer. It is recommended you to remove it, otherwise
it could conflict with Paladin Antivirus.
Once started, the rogue will imitate a system scan and detect a lot of various infections to make you think that your computer in danger, that it is infected with a lot of worms, trojans, spyware and other malware. Paladin Antivirus uses the real names of infection to make the scam look more realistic. However, the rogue won’t remove those infections unless you purchase so-called “full” version of the program. Most importantly, do not purchase Paladin Antivirus! All of these threats are fake. So you can safely ignore the scan results!
What is more, while Paladin Antivirus is running, you will be shown numerous warnings and a lot of fake security alerts and notifications from Windows task bar. The fake alerts stats:
Warning! Network attack detected!
Network intrusion detected!
Your computer is being attacked from a remote PC.
Warning!
Most of the viruses and worms on your PC because of visiting
pornosites or warez/torrent sites.
Warning!
PLEASE, OPTIMIZE YOUR PC. IT RUNS ONLY 10%.
Warning! Keylogger detected!
Keylogger activity detected on your PC!
Warning! Virus threat detected!
Virus activity detected!
Nuker.Win16 adware has been detected
Of course, all of these warnings and alerts nothing more but a scam and like false scan results should be ignored!
As you can see, Paladin Antivirus is a scam and should be removed from the system upon detection. If you are infected with this malware, then use these removal guide below, which will remove Paladin Antivirus and any other infections you may have on your computer for free.
More screen shoots of Paladin Antivirus
Symptoms in a HijackThis Log
O4 – HKCU\..\Run: [Paladin Antivirus] “C:\Program Files\Paladin Antivirus\pav.exe” -noscan
Use the following instructions to remove Paladin Antivirus (Uninstall instructions)
Step 1. Remove _VOID trojan (Rootkit TDSS)
Some variants of Paladin Antivirus installed with a _VOID trojan-rootkit that blocks the ability to run various antivirus and antispyware programs, including Malwarebytes Anti-Malware.
Download TDSSKiller from here and unzip to your desktop.
Open TDSSKiller folder. Double click the TDSSKiller icon to start scanning Windows registry for Rootkit TDSS. If it is found, the you will see a screen similar to the one below.
TDSSKiller
Type delete and press Enter. Once TDSSKiller has finished removing rootkit TDSS, you will see a windows as shown below.
TDSSKiller
Type Y and press Enter. Your computer will be rebooted.
Step 2. Remove Paladin Antivirus and any associated malware.
Download MalwareBytes Anti-malware (MBAM). Once downloaded, close all programs and windows on your computer.
Double-click on the icon on your desktop named mbam-setup.exe. This will start the installation of MalwareBytes Anti-malware onto your computer. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to “Update Malwarebytes’ Anti-Malware” and Launch “Malwarebytes’ Anti-Malware”. Then click Finish.
MalwareBytes Anti-malware will now automatically start and you will see a message stating that you should update the program before performing a scan. If an update is found, it will download and install the latest version.
As MalwareBytes Anti-malware will automatically update itself after the install, you can press the OK button to close that box and you will now be at the main menu. You will see window similar to the one below.
Malwarebytes Anti-Malware Window
Make sure the “Perform quick scan” option is selected and then click on the Scan button to start scanning your computer for Paladin Antivirus infection. This procedure can take some time, so please be patient.
When the scan is finished a message box will appear that it has completed scanning successfully. Click OK. Now click “Show Results”. You will see a list of infected items similar as shown below.
Note: list of infected items may be different than what is shown in the image below.
Malwarebytes Anti-malware, list of infected items
Make sure all entries have a checkmark at their far left and click “Remove Selected” button to remove Paladin Antivirus. MalwareBytes Anti-malware will now remove all of associated Paladin Antivirus files and registry keys and add them to the programs’ quarantine. When MalwareBytes Anti-malware has finished removing the infection, a log will open in Notepad and you may be prompted to Restart.
Note: if you need help with the instructions, then post your questions in our Spyware Removal forum.
Paladin Antivirus creates the following files and folders
C:\Program Files\Paladin Antivirus
C:\Documents and Settings\comp\Start Menu\Programs\Paladin Antivirus
C:\Program Files\Paladin Antivirus\pav.exe
%UserProfile%\Start Menu\Programs\Paladin Antivirus\Paladin Antivirus.lnk
%UserProfile%\Start Menu\Programs\Paladin Antivirus\Uninstall Paladin Antivirus.lnk
C:\Program Files\Paladin Antivirus\pavext.dll
C:\Program Files\Paladin Antivirus\help.ico
C:\Program Files\Paladin Antivirus\pav.db
C:\Program Files\Paladin Antivirus\phook.dll
C:\Program Files\Paladin Antivirus\uninstall.exe
%UserProfile%\Start Menu\Programs\Paladin Antivirus\Paladin Antivirus Support.lnk
%UserProfile%\Desktop\Paladin Antivirus Support.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Paladin Antivirus.lnk
%UserProfile%\Desktop\Paladin Antivirus.lnk
Paladin Antivirus creates the following registry keys and values
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\paladin antivirus
HKEY_LOCAL_MACHINE\SOFTWARE\Paladin Antivirus
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paladin antivirus
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\extrac64_cab.exe
Thank you for being so vigilant and helpful. The TDSSKiller was the only way to remove this rogue. I don’t know where it came from but I know I have to be much more careful whenever I’m on-line. Thanks again.
Thank you for your very useful tips on removing paladin antivirus. TDSSKiller and Malwarebytes Anti-malware did the job. it was awesome. oh by the way on my laptop it found 51 infected files!!!!!!!!!
When I run the TDSSKiller I get following message:
“utility doesn’t support x64 operating systems!”
Is there any alternative?
Vicky, skip first step.
Thank you very much! but there is one problem: i have encountered these problems before and i knew the drill, i automatically used tdss killer got malwarebytes and scanned it but my results didnt have paladin in it why? Yes i have paladin installed the only problem now is the fake alerts from my pc for no reason reply me ASAP please… and one more question can you name me the author(s) i would like to ‘thank’ them for this…
I meant the authors of paladin, it happens to be that these bastards can get put behind bars for this crape.
qwerty, i don`t know them.
i cant remove paladin please help me with more details
Worked great… It had blocked me from using Iexplorer and firefox.. But it allowed me to get this file and it worked so far.. Running my anti virus now.. Wish me luck haha
Thanks for the guide. I tried TDSSKiller but didn’t pick up anything so went to step 2. I ran Malware Bytes but this didn’t pick anything up either 🙁
The darn thing is still on my machine.
Any other tips would be appreciated.
Just got the paladin here at work and i cant even get onto the internet to download TDSSkiller / malwarebites! Help!
Thanx dude I had the malware bites but cudnt run it coz of the tds thing ran the kiler naild it ran malware and everythn works a treat. Thanx dude.
Matt, please open a new topic in our Spyware removal forum. I will check your PC.
Chris, try download these suggested apps by using Safe mode with networking or another computer.
When I saw the virus I went into my “Add/Remove Programs” and uninstalled Paladin Antivirus. It seemed to uninstall but the computer was still infected. I then rebooted to go into safe mode and it stayed in a black screen with the fake security alerts popping up, not allowing me to even work in safe mode. Then I rebooted again to go back into regular mode and now windows keeps crashing and freezing when it tries to launch. So I can’t even do anything!! Is there any resolution to this??
thanks a lot!! it´s so fantastic.I have my pc clear as a whistle
Wow worked like a miracle. Even in Vietnam my pc was infected :P. I was considering reinstalling windows when I stumbled upon this wonderful and helpful guide. Thank you thank you thank you 😀
Wow this worked so well. I got rid of this annoying malware in 5 minutes. Thank you thank you thank you
Tony, try boot your PC in the last good configuration.
the guy who wrote this is a genious! this was he most fuck up virus i ever had, i couldnt even go into safe mode, or access te internet, so i use someone else laptop and use a memory stick to run the tdss.
when i run tdsskiller it said driver load error plz help
About the blue screen problem making booting impossible. Keep trying in normal startup mode: I did about 15 times and finaly I managed to get in….
d3y69, you have started TDSSKiller as administrator ?
Yes I started it as administrator
D3y69, follow these steps:
1. backup your registry using ERUNT. Download it from here and run. Follow the prompts.
2. Download Avenger from here and unzip to your desktop.
Run Avenger, copy,then paste the following text in Input script Box:
Drivers to delete:_VOIDd.sys
Then click on ‘Execute’. Click Yes to confirm.
Afterwards, Windows restarts, run Malwarebytes Anti-malware.
I’m running Windows 7 x64. I managed to kill all of the processes it runs – a false notepad, a fake Internet Explorer, etc. (all x86 processes, so it’s relatively easy for me to nail them) as well as all of its program files, but the instant the trojan got onto my system it disabled registry editing, and to my dismay TDSSkiller is not compatible with x64 operating systems. I did not have Malwarebytes, instead using Avira, and when I went to install Malwarebytes the trojan blocks it from running or even installing. I tried Patrik’s method of backing up my registry and running Avenger, but Avenger can’t delete anything because registry editing is still blocked. So- I’m at a loss. Any ideas, anyone?
doesnt seem to work on my lappy.
The prompt screen jus disappears the moment i try to type delete.
Nex, ask for help in our Spyware removal forum.
lulu, read my above comment to D3y69. Use Avenger to remove TDSS trojan.
Thanks!! works fine!