Home Malware Programs Rogue Anti-Spyware Programs Paladin Antivirus

Paladin Antivirus

Posted: February 8, 2010

Threat Metric

Threat Level: 10/10
Infected PCs: 91
First Seen: February 8, 2010
Last Seen: October 1, 2019
OS(es) Affected: Windows

ScreenshotPaladin Antivirus, or PaladinAntivirus, is a rogue antivirus program and product of a blatant cyber scam. Paladin Antivirus enters the computer when a related Trojan infection opens a backdoor to allow Paladin Antivirus entry to the compromised system. Once active, PaladinAntivirus will produce a fake PC scan and results which warn that the computer is infected with malware. These scare tactics are used to convince the unwary computer user to purchase Paladin Antivirus software, for removal of the alleged threats detected. Do not fall for this scam, instead use a reliable anti-malware program to terminate all threats associated to PaladinAntivirus.

Paladin Antivirus belongs to the FakeCog (CoreGuard) (CoreGuard) family, which includes members such as PC Protection Center 2008, CoreGuard Antivirus 2009, Protection System, Dr.Guard, User Protection, Your Protection, Digital Protection, Data Protection, Protection Center, Defense Center, AnVi, PC Protection Center, Virus.DOS.RogueAntiSpyware, Fraud.Defense Center and Malware Protection Center.

ScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshotScreenshot

Aliases

Trojan.Win32.Generic!BT [Sunbelt]Heuristic.LooksLike.Trojan.TDss.B [McAfee-GW-Edition]Virus.Win32.Heur [Ikarus]Win32/WindowsAntivirusPro!generi [eTrust-Vet]Win32/Heur [AVG]Virus.Win32.Heur!IK [a-squared]TROJ_TDSS.SMAL [TrendMicro]Packed.Generic.277 [Symantec]Trojan.Win32.Generic.pak!cobra [Sunbelt]Mal/TDSSPack-Q [Sophos]Trj/CI.A [Panda]a variant of Win32/Kryptik.CQQ [NOD32]Trojan:Win32/FakeCog [Microsoft]Trojan.Fake.PaladinAnti [McAfee-GW-Edition]DNSChanger.at [McAfee]
More aliases (33)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



pav.exe File name: pav.exe
Size: 2.34 MB (2342912 bytes)
MD5: 814cafe042f1fcec320b5a1793f5f622
Detection count: 45
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: February 12, 2010
phook.dll File name: phook.dll
Size: 9.21 KB (9216 bytes)
MD5: d2cf8c85cda2d189ae311073e42af609
Detection count: 12
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: February 8, 2010
pav.exe File name: pav.exe
Size: 2.22 MB (2220032 bytes)
MD5: d7f99e8f3bd8a91cd76593acd99ffe89
Detection count: 11
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: February 8, 2010
pavext.dll File name: pavext.dll
Size: 37.37 KB (37376 bytes)
MD5: 5585c4da24fcf724c8bc3eede4a4d813
Detection count: 10
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: February 8, 2010

Additional Information

The following directories were created:
%ProgramFiles%\Paladin Antivirus

One Comment

  • david says:

    I recently used my computer and suddenly realised there was a palatin antivirus page on my profile page. It would not go so i decided to install it and thought i could just uninstall it in order for my profile page to be as it was before. Within minutes I was bombarded with trojan, malware security alerts instructing me to pay for the antivirus program in order to get rid of them. I thought it was very strange as there was no option or file to find that I could uninstall palatin antivirus. I decided to look on the internet for this and came accross this website i am glad to know what it is but i have no idea how to get rid of it. Even with your instructions I am unable to find it or get rid of it. I would also like to know why my current antivirus and spyware allowed this to happen surely my original one should have prevented this ?

Loading...