Remove Ghost 2.3
Removal instructions
Severity scale:  (67 / 100)
This is a newer version of the Ghost RAT virus. It was designed to annoy the victim by performing stupid useless operations, such as open/close CD-rom, turn off/on the monitor, etc. The virus in a non-destructive type of RAT. It can not damage the system, however some versions include a "keylogger" ability. Some personal information, such as passwords and bank account numbers can be lost. The author of this pest is a hacker called Lame_Joker. The pest is written in Visual Basic. Many variants (Ghost 2.0, Ghost 2.1, Ghost 2.2, Ghost 2.3, Ghost 2.4a, Ghost Mini-Server 2.3) appeared in the internet from October 2001 to August 2002. The place of origination is Israel. This version was created in December 2001.
From the publisher:
"=====================
Ghost v2.3 -
OnLine Hacking tool
=====================
By using this program you agree to the following terms:
1) I (The man referred by the name of Lame_joker) will not be held responsible and will not accept responsibillity for the use of this program (Use it at your own risk!). This is also including all forms of damage or loss of information and hardware.
2) This Program is a freeware and that means you can copy it to any one you want as long As you keep all of the contents of this zip file along.
How do I use this thing?
First you need to find yourself a victim... then you send him the "server.exe" file (you might want to edit it first...) the victim execute the file and walla! you can connect to his/hers IP number and annoy them to death!
In this zip file you can find: Ghost.exe - The client side of ghost. Server.exe - The server part of ghost. Ghost server editor - Enables you to edit some of the settings in the Ghost server (Only for version 2.3) Binder.exe - Bind server with an exe for easy infection. Winsck_Droper.exe - Installs "Mswinsck.ocx" on remote computer (try binding it with server!). Small Server.bat - Make server smaller using upx.exe, Edit before compressing! (you won't be able to do so after the server has been compressed!). ReadMe.txt - This text file.
With ghost you can: Open/Close you host's CD-ROM drive, Hide/Show start button, Hide/Show startBar, Hide/Show taskIcons, Disable/Enable Ctrl+alt+del, Logoff user, Force restart, send customed messages, Send host to a url, Blackout/Blackin host's windows, Start host's notepad, Prank host,Print crap on host's printer, reset host's mouse position , Hide/Show teskBar Clock, Disable host's mouse, Disable host's Keyboard and messup host's windows colors,Spy on open windows,Close active windows, Open window, Flick keyboard lights, Control files using file manager, Log keys, chat with host, Get information and ICQ numbers, Send key types.
Pranks: Microsoft warning - Send the host a fake warning message from the Microsoft server telling it that an illegal Windows key number was detected installed on his system. Tip of the day - Let the host know about some interesting yet stupid tips/facts about himself. Insult machine - Let the user know what you really think about him ;)
FAQ:
Q:Why in some cases the server is not infecting the target system?
A:could be a program running on memory blocking the server (Fire walls, task managers etc...)
Q:Some times when I use WindowSpy it's caption is blank.
A:The caption showen in WindowSpy is the caption of the current window host's mouse position is at, might give you some ideas ;)
Q:Client is not connecting.
A:Are you sure the host was infected?, maybe to host is running a firewall on his system.
Q:When active: the server is sending an error about "Mswinsck.ocx"
A:Well..., Ghost client and Ghost Server are in need of "Mswinsck.ocx" to be installed in local and remote systems, you can find it in the Ghost zip file, or use the "Winsck_droper.exe" to install it on remote computer (You can bind it with the server!)
Q:When I try to connect to a victim I get this message: "Ghost X.X server's are no longer supported by this client!" what is this all mean?
A:The latest versions of Ghost has newer communication engine, and because of that the older versions of Ghost are no longer supported, and that means the server or the client might not function as they should...
Q:How can I connect you?
A:Email me: Lame_Joker@yahoo.com
All rights reserved to Lame_joker, 2001
Have fun! :)"
Ghost 2.3 properties:
• Allows remote user connection
• Logs keystrokes
• Hides from the user
• Stays resident in background
Automatic Ghost 2.3 removal:
We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use.
By Downloading any provided Anti-spyware software to remove Ghost 2.3 you agree to our privacy policy and agreement of use.
Malwarebytes Anti Malware
We are testing Malwarebytes Anti Malware's efficiency at removing Ghost 2.3
(2005-03-27 14:16:41)
We are testing Spyware Doctor's efficiency at removing Ghost 2.3
(2005-03-27 14:16:41)
We are testing STOPzilla's efficiency at removing Ghost 2.3
(2005-03-27 14:16:41)
Ghost 2.3 manual removal:
Kill processes: binder.exe, ghost.exe, ghostservereditor.exe, server.exe, winsck_droper.exe
Delete files:binder.exe, ghost.exe, ghostservereditor.exe, readme.txt, server.exe, small server.bat, winsck_droper.exe
Phone Support to remove Ghost 2.3
QR code for Ghost 2.3 removal instructions:
QR is short for Quick Response. They can be read quickly by the mobile phones. QR codes can store more data than standard barcodes, including url links, geo coordinates, and text.
The reason we add QR code to the website is that parasites like Ghost 2.3 are really hard to remove on infected computer.
you can quicly scan the QR code with your mobile device and have manual removal instructions to uninstall Ghost 2.3 right in your pocket.
Simply use the QR scanner and read removal instructions from mobile device.
Information added: 2005-03-27 11:39:26
Information updated: 2005-03-27 11:39:26
Additional resources:
Attention: If you know know a reputable website reated to security threats, please add a link here: add
url
more resources
|
Latest spyware news:
Subscribe to news
Similar parasites:
|
FORUM:
HELP:
|
|
Post Comment: