Remove Ghost Antivirus. Description and removal instructions

 
Title: Ghost Antivirus
Also known as: GhostAntivirus
Type: Spyware
Severity scale:Ghost Antivirus severity is 96  (96 / 100)
 
Ghost Antivirus is a fake security tool which uses aggressive malicious techniques trying scam users’ money. Because of this tactics, GhostAntivirus is also hard to remove just like its successor called Internet Antivirus Pro. However, it is possible when using a reputable anti-spyware program or removal instructions, written in the bottom of the page.

Ghost Antivirus loads fake system scanners when installed. It displays exaggerated scan results with tons of worms, Trojans and other spyware “detected” after checking. This application typically shows fake alerts about a critical security level such as “Serious security and privacy threats found on your computer!” and using such messages tries to convince PC users that they really have security problems on their PCs. Finally, as a solution for fixing everything and deleting all these cyber threats, Ghost Antivirus directs victims to purchase its “full’ version. However, wasting your money in such a way is not recommended! All the files, reported by Ghost Antivirus as infections, in reality are legitimate Windows files, so their removal can even affect a proper operation of your PC.

Ghost Antivirus attacks compromised machines with trojans and fake online anti-malware scanners help that usually are met on insecure websites. There are tens of domains that are known to be bonded with this malware:


93.190.140.165 Softwareanti com
93.190.140.165 Softwarejar com
93.190.140.165 Softwarerising com
93.190.140.165 Softwaresecure net
93.190.140.165 Softwarespyware net
93.190.140.165 Softwarethe net
93.190.140.165 Softwarethreats com
93.190.140.165 Softwarethreats net
93.190.140.165 Softwarexp net
93.190.140.165 Softwarespam net
93.174.95.194 Ghost-antivirus com
93.174.95.194 Ghost-pay com
93.174.95.194 Ghostantivirus com
93.174.95.194 Ghostpays com.


When downloaded and installed, GhostAntivirus firstly protects itself by disabling Task Manager and also installing other malware which has a filename onin.exe, created in various paths under Windows folder. Because of these actions, people additionally find themselves enabled to end processes of Ghost Antivirus and access Windows desktop or any other program existing on it. Ghost Antivirus also stops all the legit security programs found and modifies Internet browser to a fake website pretending to be Windows Explorer.

It must be clear that Ghost Antivirus seeks only to mislead users into purchasing its “full” version. This ransom ware should not be purchased in any circumstances and must be removed once after detection. Contact your credit card immediately if you have already purchased Ghost Antivirus. Dispute the charges and delete every file connected to this malware. A reputable anti-spyware is highly recommended when you find this malware on your computer. Remove Ghost Antivirus ASAP.



Related files: [random symbols]onin.exe, services.exe, pguard.ini, iPSh.png, iMSh.png, iGSh.png, times.conf, links.txt, Uninstall Ghost Antivirus.lnk, unins000.exe, uill.ini, settings.ini, Purchase License.lnk, Ghost Antivirus Home Page.lnk, Ghost Antivirus.lnk, [random symbols].dll, wmilib.dll, version.db, listing.cfg, Infected.wav, ghost.sql, working.log, web.ico, uninst.ico, unins000.dat, register.ico, ghostav.exe

Ghost Antivirus properties:
• Changes browser settings
• Shows commercial adverts
• Connects itself to the internet
• Hides from the user
• Stays resident in background

Ghost Antivirus snapshot:
Ghost Antivirus removal

Automatic Ghost Antivirus removal:

remover for Ghost Antivirus

Ghost Antivirus manual removal:

Kill processes:
ghostav.exe unins000.exe [random symbols]onin.exe services.exe
Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ghost Antivirus_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
HKEY_CURRENT_USER\Software\Microsoft\FTP “SearchDir” = “%Program Files%\Ghost Antivirus\”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run “onin”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Ghost Antivirus”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce “3P_UDEC”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent “URIAPRO[1.1.3.9]“
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe “Debugger” = “?”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe “RealDebugger” = “?”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon “RealLogonType” = “1″

Unregister DLLs:
WMILib.dll [random symbols].dll

Delete files:
ghostav.exe register.ico unins000.dat uninst.ico web.ico working.log ghost.sql Infected.wav listing.cfg version.db WMILib.dll [random symbols].dll Ghost Antivirus.lnk Ghost Antivirus Home Page.lnk Ghost Antivirus.lnk Purchase License.lnk settings.ini uill.ini unins000.exe Uninstall Ghost Antivirus.lnk links.txt times.conf Ghost Antivirus.lnk iGSh.png iMSh.png iPSh.png pguard.ini services.exe [random symbols]onin.exe
Delete directories:
%Program Files%\Ghost Antivirus\
%Program Files%\Ghost Antivirus\Languages\
%Program Files%\Ghost Antivirus\lib\
%Documents and Settings%\All Users\Start Menu\Programs\Ghost Antivirus\
%Documents and Settings%\All Users\Application Data\Ghost Antivirus\
%Documents and Settings%\[User Name]\Application Data\Ghost Antivirus\lib\

Other programs to remove Ghost Antivirus:

• Malwarebytes Anti Malware - Review - Download
• Malwarebytes Anti Malware - Review - Download
• Windows Defender - Review - Download

Information added: 14/01/10
Information updated: 14/01/10

Additional resources related to Ghost Antivirus:

Attention: If you know or you have a website or page about Ghost Antivirus removal, feel free to add a link to this list: add url




more resources

Post Comment:

Attention: Use this form only if you have additional information about Ghost Antivirus parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.



Enter security code:

Latest spyware news:
Similar parasites: