Severity scale  
  (96/100)

Ghost Antivirus. How to Remove? (Uninstall Guide)

removal by - -   Also known as GhostAntivirus | Type: Rogue Antispyware
12
Ghost Antivirus is a fake security tool which uses aggressive malicious techniques trying scam users’ money. Because of this tactics, GhostAntivirus is also hard to remove just like its successor called Internet Antivirus Pro. However, it is possible when using a reputable anti-spyware program or removal instructions, written in the bottom of the page.

Ghost Antivirus loads fake system scanners when installed. It displays exaggerated scan results with tons of worms, Trojans and other spyware "detected" after checking. This application typically shows fake alerts about a critical security level such as "Serious security and privacy threats found on your computer!" and using such messages tries to convince PC users that they really have security problems on their PCs. Finally, as a solution for fixing everything and deleting all these cyber threats, Ghost Antivirus directs victims to purchase its "full’ version. However, wasting your money in such a way is not recommended! All the files, reported by Ghost Antivirus as infections, in reality are legitimate Windows files, so their removal can even affect a proper operation of your PC.

Ghost Antivirus attacks compromised machines with trojans and fake online anti-malware scanners help that usually are met on insecure websites. There are tens of domains that are known to be bonded with this malware:


93.190.140.165 Softwareanti com
93.190.140.165 Softwarejar com
93.190.140.165 Softwarerising com
93.190.140.165 Softwaresecure net
93.190.140.165 Softwarespyware net
93.190.140.165 Softwarethe net
93.190.140.165 Softwarethreats com
93.190.140.165 Softwarethreats net
93.190.140.165 Softwarexp net
93.190.140.165 Softwarespam net
93.174.95.194 Ghost-antivirus com
93.174.95.194 Ghost-pay com
93.174.95.194 Ghostantivirus com
93.174.95.194 Ghostpays com.


When downloaded and installed, GhostAntivirus firstly protects itself by disabling Task Manager and also installing other malware which has a filename onin.exe, created in various paths under Windows folder. Because of these actions, people additionally find themselves enabled to end processes of Ghost Antivirus and access Windows desktop or any other program existing on it. Ghost Antivirus also stops all the legit security programs found and modifies Internet browser to a fake website pretending to be Windows Explorer.

It must be clear that Ghost Antivirus seeks only to mislead users into purchasing its "full" version. This ransom ware should not be purchased in any circumstances and must be removed once after detection. Contact your credit card immediately if you have already purchased Ghost Antivirus. Dispute the charges and delete every file connected to this malware. A reputable anti-spyware is highly recommended when you find this malware on your computer. Remove Ghost Antivirus ASAP.
Related files: unins000.exe, settings.ini, unins000.dat

Ghost Antivirus properties:
• Changes browser settings
• Shows commercial adverts
• Connects itself to the internet
• Hides from the user
• Stays resident in background

It might be that we are affiliated with any of our recommended products. Full disclosure can be found in our Agreement of Use. By downloading any of provided Anti-spyware software you agree with our Privacy Policy and Agreement of Use.
Do it now!
Download
Reimage - remover Happiness
Guarantee
Compatible with Microsoft Windows
What to do if failed?
If you failed to remove infection using Reimage Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Ghost Antivirus. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.
Reimage is recommended to uninstall Ghost Antivirus. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.

More information about this program can be found in Reimage review.
Not using OS X? Download a remover for Windows.
Press Mentions on Reimage
Alternate Software
Alternate Software
STOPzilla
Tested and Confirmed! STOPzilla removes Ghost Antivirus (2010-01-14 01:00:06)
Malwarebytes Anti Malware
Tested and Confirmed! Malwarebytes Anti Malware removes Ghost Antivirus (2010-01-14 01:00:06)
Plumbytes
We are testing Plumbytes's efficiency (2010-01-14 22:02)
Hitman Pro
STOPzilla
Tested and Confirmed! STOPzilla removes Ghost Antivirus (2010-01-14 01:00:06)
Malwarebytes Anti Malware
Tested and Confirmed! Malwarebytes Anti Malware removes Ghost Antivirus (2010-01-14 01:00:06)
Webroot SecureAnywhere AntiVirus
Ghost Antivirus screenshot
Ghost Antivirus snapshot

Ghost Antivirus manual removal

Kill processes:
ghostav.exe
unins000.exe
[random symbols]onin.exe
services.exe
Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ghost Antivirus_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
HKEY_CURRENT_USER\Software\Microsoft\FTP ??SearchDir?? = ??%Program Files%\Ghost Antivirus\??
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ??onin??
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ??Ghost Antivirus??
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce ??3P_UDEC??
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent ??URIAPRO[1.1.3.9]??
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe ??Debugger?? = ?????
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe ??RealDebugger?? = ?????
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ??RealLogonType?? = ??1?

Unregister DLLs:
WMILib.dll
[random symbols].dll

Delete files:
ghostav.exe
register.ico
unins000.dat
uninst.ico
web.ico
working.log
ghost.sql
Infected.wav
listing.cfg
version.db
WMILib.dll
[random symbols].dll
Ghost Antivirus.lnk
Ghost Antivirus Home Page.lnk
Ghost Antivirus.lnk
Purchase License.lnk
settings.ini
uill.ini
unins000.exe
Uninstall Ghost Antivirus.lnk
links.txt
times.conf
Ghost Antivirus.lnk
iGSh.png
iMSh.png
iPSh.png
pguard.ini
services.exe
[random symbols]onin.exe

Delete directories:
%Program Files%\Ghost Antivirus\
%Program Files%\Ghost Antivirus\Languages\
%Program Files%\Ghost Antivirus\lib\
%Documents and Settings%\All Users\Start Menu\Programs\Ghost Antivirus\
%Documents and Settings%\All Users\Application Data\Ghost Antivirus\
%Documents and Settings%\[User Name]\Application Data\Ghost Antivirus\lib\

Geolocation of Ghost Antivirus

Map reveals the prevalence of Ghost Antivirus. Countries and regions that have been affected the most are: Vietnam, India and United States.

Information updated:

Comments on Ghost Antivirus

Post a comment

Attention: Use this form only if you have additional information about a parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Home page Name



«

(All fields are required)