Remove GhostVoice. Description and removal instructions

Title: GhostVoice
Type: Remote Administration Tools	Severity scale: (55 / 100)

This RAT virus was created with only one purpose - to annoy the victim. The attacker infects the PC via the e-mail or File and Print Sharing. A "server" allows him to connect via a "client" on his own machine. The author of this pest is a hacker called Caesar. Variants of this pest appeared from November 2002 to January 2003. The pest is written in Visual Basic.

From the publisher:

"This is a very small trojan that will do just one task: Speak Like LOM's Funcfactory but without having the character, just the voice. LOL imagine how much scaryness u can brin to your vics ;) Theres the editor that comes with the server and the client, to choose install filenames, reg keys and port. Remember to not put the .exe on the file name. Well its my first trojan so i think it got some bugs'

GhostVoice Trojan By Caesar of Nuclear Winter Crew
Version 1.02
This is a very small trojan that will do just one task: *Speak* Like LOM's Funcfactory but without having the character, just the voice. LOL imagine how much scaryness u can bring to your vics ;) Theres the editor that comes with the server and the client, to choose install filenames, reg keys, port, password and icq notify. Remember to not put the .exe on the file name, or it will became yourfile.exe.exe ;). Well its my first trojan so i think it got some bugs, but feel free to msg me thru Trojan Forge Forums (http://www.trojanforge.net).
PS: Dont pack the server before editing or you wont be able to edit it.
Nuclear Winter Crew: Caesar2k, SNip, Frosty911, Morpheus, Orion, RaideN, Blacksoulman, Vozzie, Yankee, Pyrator, Brim, M1cr0, Alex-X, hippytyre, Pc
Fixed Bug: - Server were closing after some data sending - Objects in the client and server were allocated and replaced - Now server uses the wsck32.dll (Winsock 2.2 API) not the ocx that not much ppl had on their pcs - First installation file wasnt copying and unloading itself causing the original file was like been used by windows :P - The Remove server command wasnt removing the server
Added: - Password protect connection - A client back picture, it was very ugly without a wall paper lol - ICQ Pager - Will open the port just when the vic is online (Optional) - Both client and server carries necessary files to work properly(except runtimes)
Removed - Version Info (All VB6 Apps got that damn thing)
THX to: Zatrix for the edit server code Gobo for the flatstyle module Read101 for the move form module NWC Members for the support
Caesar"

FORUM:
Discuss GhostVoice in
spyware removal forum

GhostVoice properties:
• Allows remote user connection
• Hides from the user
• Stays resident in background

Automatic GhostVoice removal:

remover for GhostVoice

GhostVoice manual removal:

Kill processes:
client.exe, clientvbp.exe, edit.exe, server.exe, servervbp.exe

HELP:
how to kill malicious processes

Delete files:
client.exe, clientvbp.exe, edit.exe, readme.txt, server.exe, servervbp.exe

HELP:
how to remove harmful files

Other programs to remove GhostVoice:

• SUPERAntiSpyware - Review - Download
• CounterSpy - Review - Download
• Windows Defender - Review - Download

Information added: 27/03/05
Information updated: 27/03/05

Additional resources related to GhostVoice:

Attention: If you know or you have a website or page about GhostVoice removal, feel free to add a link to this list: add url

more resources

Post Comment:

Attention: Use this form only if you have additional information about GhostVoice parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.