Ground.exe virus: what it is, how to remove it and repair the g-files

Q: Is Ground.exe a virus?

Yes. Ground.exe is the dropped copy of the Grenam file-infecting virus, which Microsoft calls Virus:Win32/Grenam.A and Trend Micro lists with %AppData%\Ground.exe as its copy. It is not a Windows file and not part of a program you installed. It infects .exe files by moving each real program to a hidden g-prefixed name and putting a copy of itself in its place. Two forum cases with scan logs, in 2019 and 2021, show the same file name in AppData. The file is not ransomware and does not encrypt anything, but it should be removed, and the programs it replaced need repair.

Q: How do I remove Ground.exe?

Remove the virus first, then repair what it replaced. End Ground.exe in Task Manager, delete the Ground.lnk shortcut from the Startup folder (Win + R, shell:startup), then run a Microsoft Defender full scan and the offline scan from Windows Security. Microsoft's page on the virus lists Defender among the tools that detect and remove it. Restart and check that %AppData%\Ground.exe and the shortcut are gone. Only then reinstall the programs that the virus replaced, or rename their hidden g-copies back. Do not repair first, because a copy that is still running infects the repaired files again.

Q: What does Ground.exe do?

It infects programs. For each .exe it finds, starting at drive C: and including attached and network drives, it copies the real program to a hidden file named g plus the original name, and then copies itself under the original name with the original icon. Run an infected program and the virus starts first and then launches the hidden original, so everything seems to work. It handles 123 files per run. It also starts with Windows, which is why deleting the process alone does not last. Some variants write "I am Sorry" onto JPG images.

Q: Why does Ground.exe keep coming back after I delete it?

Because something starts it again. In the 2021 BleepingComputer scan log the cause was a Ground.lnk shortcut in the Startup folder that pointed at the copy in AppData\Roaming. Other variants use a registry entry, according to PCrisk. Delete the shortcut and any start-up entry first, then the file, then restart and look again. If it returns, check Task Scheduler and Startup apps, run the offline Microsoft Defender scan, and consider that another program, the one that dropped it, is recreating it.

Q: Why do my programs now have a g in front of their names?

Those are your real programs. The virus moved each original to a hidden file named g plus the original name, and replaced the normal name with a copy of itself. Make hidden and protected files visible in File Explorer and you will see both files side by side. Do not delete the g-files. After the virus is removed, reinstall the program, or delete the 522 KB infected file and rename the g-file back to its original name. Reinstalling is safer because it also fixes anything else the virus touched.

Q: Does a System Restore or Safe Mode remove Ground.exe?

No, neither is a removal. A restore point made after the infection contains the infected files, and a restore point made before it does not repair programs infected later. Safe Mode is not needed because Microsoft Defender can remove the virus in normal Windows, and its offline scan runs before Windows loads, which is the same advantage Safe Mode was meant to give. Use a full scan and the offline scan, then repair the programs. If you want an extra safety net before cleaning, copy your documents to an external drive first, and disconnect that drive again before you scan.

Q: Is Ground.exe ransomware or a crypto-miner?

Neither, according to the analyses we read. Our 2020 guide compared it with ransomware and mentioned crypto-mining, but Microsoft and Trend Micro describe a file infector: it replaces programs and keeps starting itself. It does not encrypt files or ask for money. The one routine that touches your pictures writes "I am Sorry" text onto JPG files. The program that delivered the virus can be something else, so a scan should look for further malware, and if it finds a stealer or a miner, treat that as the bigger problem.

Ground.exe is the dropped copy of the Grenam file-infecting virus: it hides each of your programs under a g-prefixed name and takes its place. Remove the virus first with a full and an offline Microsoft Defender scan, then reinstall or restore the programs it replaced.

By Olivia MorelliPublished October 7, 2026Updated October 17, 20264 min read

Facts checked October 7, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.

Automatic

Get a free scan and check if your PC is infected.

Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.

A full scan can check every copy of Ground.exe and the tasks that start them.

Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free.

Do it yourself · free Remove Ground.exe yourself 5 steps, about 15 minutes, no software needed.

Start the steps

Windows Task Manager on a Windows 7 style PC listing Ground.exe on the Processes tab, with the command line C:\Users\Test\AppData\Roaming\Ground.exe, next to a red virus icon and a virus warning sign — From our 2020 guide: Task Manager with Ground.exe running from AppData\Roaming. An illustration, not a scan of your PC.

Ground.exe: summary

Type	File-infecting virus of the Grenam family (Microsoft: Virus:Win32/Grenam.A); `Ground.exe` is its dropped copy
Risk	High for your programs: every `.exe` it reaches is replaced by a 522 KB copy of the virus. Not ransomware, and no sign of file theft in the vendor analyses
Symptoms	`Ground.exe` in `%AppData%`, a `Ground.lnk` in the Startup folder, hidden `g`-prefixed copies of programs, antivirus alerts on every `.exe` you open
How to get rid of it	End the process, delete the Startup shortcut, run a full and an offline Microsoft Defender scan, then reinstall or restore the programs it replaced
Our check (6 October 2026)	No sample run. Vendor analyses and forum scan logs read; they agree on the behaviour. Not our own lab result
First reported by us	10 July 2020 (Microsoft's analysis of the family dates from 18 March 2012)
Removal	Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free.

Show 15 more facts

Detection names	Microsoft Trojan:Win32/Grenam, Virus:Win32/Grenam.A, Kaspersky Virus.Win32.Renamer.j, Trend Micro Virus.Win32.GRENAM.B, ESET Win32/Delf.NRJ, Avast Win32:Renamer-F
Name	Ground.exe
Files and processes	`Ground.exe` and `%AppData%`
Evidence	4 reports from affected users and security sites; details still limited
File name	`Ground.exe`
Description	No Windows description: it is the copy of a file-infecting virus
What it is	A malware file
Role	Replaces your programs with copies of itself and starts with Windows
Fake copies seen in	`%AppData%` (`C:\Users\<you>\AppData\Roaming`)
Linked threat	The Grenam file-infecting virus (Virus:Win32/Grenam.A)
First seen	10 July 2020
Microsoft Defender name	`Virus:Win32/Grenam.A`
Distribution	As the malware it belongs to
Damage	As the malware it belongs to
Facts checked	6 October 2026

Facts checked on 6 October 2026 against Microsoft's and Trend Micro's analyses of the Grenam family, two public forum cases with scan logs and Microsoft documentation. We had no sample of the file and ran no test.

What the Ground.exe file is

What Ground.exe is: the dropped copy of a file-infecting virus

Ground.exe is not a Windows file and not a program you installed. It is the name of the virus's own copy. Microsoft describes the family as Virus:Win32/Grenam.A, a "companion virus" that infects .exe files, and Trend Micro lists %AppData%\Ground.exe as the copy a Grenam sample drops. Our 2020 guide called it a generic trojan; the sources point to something more specific, and it is not ransomware.

File: Ground.exe, usually in C:\Users\<you>\AppData\Roaming (%AppData%), with the hidden and system attributes set
Part of Windows: No. Windows does not ship or need it, and no program you install needs it
What it is: A copy of the Grenam file-infecting virus (Microsoft: Virus:Win32/Grenam.A, a companion virus written in Delphi)
Size of the infecting file: 534,016 bytes, which Explorer shows as 522 KB. Every infected program becomes a file of this size
What it does to a program: Copies the real app.exe to a hidden gapp.exe, then puts a copy of itself where app.exe was, with the same icon. Starting the program starts the virus, which then starts the hidden original
Family parts (Microsoft): A virus part that replaces programs (Virus:Win32/Grenam.A and .B), a trojan part that starts it with Windows (a shortcut in the Startup folder), and a worm part that copies it to removable and shared drives with an autorun.inf
Detection names: Microsoft Trojan:Win32/Grenam, Virus:Win32/Grenam.A, Virus:Win32/Grenam.B and Worm:Win32/Grenam; Kaspersky Virus.Win32.Renamer.j; Trend Micro Virus.Win32.GRENAM.B; ESET Win32/Delf.NRJ; Avast Win32:Renamer-F
Other spellings: Some samples put a v, not a g, in front of the hidden original (Microsoft, Win32/Grenam). The steps below apply to either letter
Names we could not confirm: W32.Tapin and TROJ_AGENT_005249.TOMB, named in our 2020 guide: no current source we read lists them

The old guide said the file works by "adding the G at the start" of program names. That is half right: the virus does not rename your program to a different name, it moves the real file aside under a name with a lowercase g in front, and takes its place. The useful consequence is that your real programs are usually still on the disk, hidden, which matters for the repair.

What we could check, and what we could not

We did not run the virus. We read the vendor analyses, the forum cases that include scan logs, and the public descriptions, and we say below what each one covers.

Public record · read on 6 October 2026

Microsoft's analysis of the familyVirus:Win32/Grenam.A is documented (published 18 March 2012, updated 15 September 2017): 534,016 bytes, infects .exe files, keeps the original as a hidden g-prefixed copy, infects 123 files per run.
Trend Micro's analysis of a 2020 sampleVirus.Win32.GRENAM.B: first samples received 14 November 2020; it drops %Application Data%\Ground.exe and makes a hidden infected copy of every executable it reaches.
Scan logs in two forum casesA 2021 BleepingComputer log shows Ground.exe (534,016 bytes, hidden and system attributes) in AppData\Roaming and a Ground.lnk shortcut in the user's Startup folder. A 2019 Malwarebytes forum case shows the same name flagged by Avast.
Microsoft's family pageWin32/Grenam (published 15 October 2013, updated 15 September 2017) describes three parts: a virus that renames programs, a trojan part that starts it with Windows, and a worm part that copies it to removable and shared drives. Microsoft says Windows Defender detects and removes it.
Our own run of the fileNot done. We have no sample, so we claim no lab result, no network traffic and no timing of our own.
Crypto-mining, backdoor and data-theft claims of the old guideNot in the Microsoft or Trend analysis. The family is a file infector; what else sits on a PC is decided by whatever dropped it.
Whether your copy is a variantPossible. The 2012 analysis and the 2020 sample differ in detail, and some samples add a picture-defacing routine. Check your own PC with the steps below.

Known malware Two vendors document the family, and the forum logs match the description. This page is based on reports and vendor analyses, not on our own run of a sample.

How to remove Ground.exe permanently

Permanent removal depends on cleaning every place the virus can live, not only the one file you see.

Deleting Ground.exe while infected programs remain lets those programs run the virus again on the next launch. That is why it seems to come back after each delete.

Work in this order. Disconnect any USB drives and network shares, because infected programs on them can reinfect the PC. Remove the Startup shortcut, run the full and the offline Microsoft Defender scans described above, then reinstall or restore each damaged program from a clean source.

Only call it gone after a second full scan finds nothing and no new g-prefixed copies appear after a restart. We did not run a sample ourselves, so this order is our reading of the vendor analyses and scan logs we read.

How to remove the Ground.exe virus permanently, so it does not return

To remove the Ground.exe virus permanently, you have to clean every infected program, not only delete Ground.exe itself.

Grenam replaces each .exe it reaches with a copy of the virus and hides the real program under a g-prefixed name. If one infected program stays on the PC, opening it runs the virus again and Ground.exe comes back.

Work in this order. End the Ground.exe process in Task Manager and delete the Ground.lnk shortcut from the Startup folder. Run a full Microsoft Defender scan, then a Microsoft Defender Offline scan, which checks files before Windows starts.

Repeat the full scan until it reports nothing. Only then reinstall or restore the programs the virus replaced, from the vendor or a clean backup.

Check the result before you call it done. After a restart, %AppData% should hold no Ground.exe, the Startup folder no Ground.lnk, and Protection history should show no new Grenam alert when you open your programs. Copy nothing back from USB drives or shares you used during the infection until a scan has cleared them, because an infected .exe there would start the whole cycle again.

Is Ground.exe safe or a virus?

Ground.exe through the years

The family is old: the first Microsoft analysis dates from 2012. These dated entries show how reports of the Ground.exe copy kept coming, with the same symptom each time.

18 March 2012
Microsoft publishes Virus:Win32/Grenam.A
The analysis describes a Delphi companion virus of 534,016 bytes that renames each target to a hidden g-file and takes its name and icon. It states that security-software alerts "may be the only symptom". Updated 15 September 2017.
17 August 2017
A user writes a clean-up script
A developer published a small Node.js script on GitHub to rename the hidden g-files back to their original names after a Malwarebytes scan, and noted that every infected file was 522 KB. The page says plainly that the script does not remove the virus.
30 July 2019
Malwarebytes forum: Avast flags it on every .exe
A Windows 10 user wrote that Windows Security kept detecting Grenam.A even after Malwarebytes removed it, that Avast alerted every time an .exe was opened, and that Ground appeared in the Task Manager start-up tab. A helper asked for a Farbar Recovery Scan Tool log and posted a fix list. The thread is filed under resolved removal logs.
21 March 2020
Microsoft Q&A: it returns at every start
A user wrote that Ground.exe was a process that came back at the next boot after being deleted, and that it renamed other files with a g. The one answer advised a Malwarebytes full scan with rootkit scanning, AdwCleaner, a System File Checker run and, last, a repair install of Windows. Microsoft's page says 200+ people had the same question.
10 July 2020
Our first guide
We published a short trojan description with two illustrations and a generic removal list. This rewrite replaces it.
$Windows Task Manager on a Windows 7 style PC listing Ground.exe on the Processes tab, with the command line C:\Users\Test\AppData\Roaming\Ground.exe, next to a red virus icon and a virus warning sign$
A Windows 7 style Task Manager with Ground.exe running from C:\Users\Test\AppData\Roaming, from our 2020 guide. The user name in the path is Test; the CPU and memory figures belong to that one moment and prove nothing about your PC.
14 November 2020
Trend Micro receives a GRENAM.B sample
The Trend Micro entry lists Ground.exe in the Application Data folder as the dropped copy and says the virus arrives dropped by other malware or downloaded unknowingly when visiting malicious sites.
15 May 2021
BleepingComputer: g-files across a Photoshop folder
A Windows 7 user wrote that the .exe files were hidden and that a visible copy with a g in front of the name had appeared for each. The helper's log tool showed Ground.lnk in the Startup folder pointing to Ground.exe in AppData\Roaming, and the user's Adobe Photoshop folder held g-prefixed files. The thread was closed on 23 May 2021 for lack of feedback.
2024 to 2025
Still being catalogued
A February 2024 PCrisk entry lists the family as a trojan, virus and worm hybrid, and Malpedia's page, with a January 2025 reference, notes that a Grenam routine writes "I am Sorry" into JPG images.

What Ground.exe does to a PC, step by step

The behaviour is mechanical and the same on every infected PC. Knowing it tells you how to find the damage and how to undo it.

1
It installs itself and survives restarts
The first run drops Ground.exe into %AppData% and makes sure it starts with Windows. In the 2021 log that was a Ground.lnk shortcut in the Startup folder. Microsoft's family page describes the same arrangement for the family's own copy: a paint.exe in %AppData%, a paint.lnk in the Startup folder, and sometimes a Paint value under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. The Ground.exe samples use the same pattern under the other name. That is why deleting the process alone fails: it is back at the next start.
2
It walks the drives, beginning with C:
Microsoft: the virus searches folders recursively from C: and also reaches mapped network drives and attached drives, as far as the account's permissions allow. A plugged-in USB drive or a shared folder that the user can write to is within reach. The worm part also drops a copy named Paint and an autorun.inf on the drives it finds; Microsoft advises turning Autorun off.
3
It hides the real program
For each .exe it finds, it copies the original to g<name>.exe with the hidden attribute, then copies itself over <name>.exe with the original's icon. If the original has no icon it leaves a zero-size g<name>.ico.
4
It keeps the program looking normal
When you open the infected file, the virus runs and then starts the hidden original with ShellExecute, so the program seems to work. It handles 123 files per run and skips any program whose g-copy already exists.
5
The symptoms
Besides security alerts: every .exe is the same size, g-prefixed twins appear in program folders, and programs are slower to start. Some variants also write "I am Sorry" in the corner of every .jpg, which our old guide described.

What the old guide got right and wrong

Our 2020 text listed many dangers. Here each one is sorted by what the vendor analyses and forum logs actually support.

High
It infects and replaces your programs
Confirmed by Microsoft and Trend Micro. Every .exe it reaches, including programs you rely on, is swapped for a copy of the virus. This is the real damage, and it is what the repair section undoes.
High
Other malware may be on the PC
Microsoft says the virus may be installed by other malware or arrive as an e-mail attachment. Whatever delivered it is a separate infection, so a scan has to look for more than Ground.exe.
Medium
Slow programs and high CPU
Plausible, because every start of an infected program runs the virus first. The 99% figure in the old guide came with no source, and the Task Manager picture in our timeline shows 35% for one moment, so treat it as a variable symptom, not a rule.
Medium
Picture defacing, "I am Sorry"
Reported by Malpedia for the Grenam family. It changes your .jpg files, so back up unaffected copies before you trust a repair.
Low
Crypto-mining, botnet use, stealing files and passwords
Not part of the Grenam descriptions we read. A file infector does not itself mine or steal; the program that dropped it might. Treat saved passwords as at risk only if your scan finds another threat.
Low
"As dangerous as ransomware"
Corrected. It does not encrypt files or demand money. It is serious because it damages programs and can hide for a long time.
Low
It deletes itself without symptoms
Not as described. The virus stays and starts again; after each run it only exits, leaving the infection in place.

How to check the Ground.exe file

Ground.exe detection names

If Windows Security shows Virus:Win32/Grenam.A, it has found Ground.exe or a file that belongs to it.

Write the name down before you click Remove: it is the most useful search term later, and you will need it if you report the incident.

A family name in the label is more informative than a heuristic one. Our page on why one threat has many antivirus names lists the common formats and what each part means.

Check your PC for Ground.exe and g-files in five minutes

Because the file is hidden with the system attribute, you first have to make Windows show it. The steps work in Windows 11 and Windows 10. Do not delete anything yet.

1
Make hidden and protected files visible
Open File Explorer, choose View > Show > Hidden items (Windows 11) or tick Hidden items on the View tab (Windows 10). Then open Options (Windows 11: the three dots) > View and untick Hide protected operating system files (Recommended). Confirm with Yes.
2
Look in AppData\Roaming
Press Win + R, type %AppData%, press Enter. Look for Ground.exe, and for paint.exe, the name Microsoft gives the family's own copy. On a PC that has the virus it is 522 KB (534,016 bytes) in the Details view.
3
Look in the Startup folder
Press Win + R, type shell:startup, press Enter. A Ground.lnk shortcut that points to Ground.exe is what restarts it. Microsoft names paint.lnk as the same kind of shortcut for the family's other copy. Also open Task Manager (Ctrl + Shift + Esc) > Startup apps (Windows 11) or Startup (Windows 10) for an entry named Ground or Paint. In Windows 10 and 11 that list also shows entries from the Run key of the registry.
4
Look for g-prefixed twins
Some variants use a v. In a folder of a program you use, for example under C:\Program Files, look for pairs such as app.exe and gapp.exe. If app.exe is 522 KB and gapp.exe has the size you expect from the real program, that program is infected.
5
Check where it is running from
In Task Manager open the Details tab, right-click Ground.exe > Open file location. The folder should be your AppData\Roaming folder.

What you find	What it means	Do this
`Ground.exe` in `%AppData%` and a `Ground.lnk` in the Startup folder	The virus is installed and restarts itself	Go to "Removing it"
Several programs with a 522 KB `.exe` and a hidden g-twin	The virus has already infected programs	Remove it first, then repair
A Windows or antivirus alert for Grenam or Renamer, but no Ground.exe	A copy of the virus under another name, or an infected program you opened	Run the full and offline scan, then repair
Nothing of the above	No sign of this family on this check. Not a clearance: other copies or names may exist	Run one full Microsoft Defender scan anyway

The same Task Manager screenshot showing Ground.exe running from AppData\Roaming, beside a stock photo of a woman pointing at it — The same Task Manager listing from our 2020 guide, with the command line C:\Users\Test\AppData\Roaming\Ground.exe. The woman in the picture is a stock image and has nothing to do with the virus.

Where Ground.exe comes from

No source we read tells how your copy arrived, but the descriptions agree on these ways.

High
Dropped by other malware
Microsoft and Trend Micro both say the virus is installed by another malware. If you find Ground.exe, assume something else ran on this PC before it.
High
E-mail attachments
Microsoft names an attached file as a way in. Opening an unexpected invoice, delivery notice or archive can start it.
High
Cracks, keygens and pirated software
PCrisk lists software cracks among the routes, and our 2020 guide named pirated packages, torrent and peer-to-peer downloads. A modified installer is a common place to hide a dropper.
Medium
Malicious sites
Trend Micro: the file can be downloaded unknowingly when visiting malicious sites, for example a fake download or update page.
Medium
Shared and removable drives
Once on one PC, it reaches attached drives and network shares that the user can write to, so a second PC can be infected from the first.

What to do with Ground.exe

How to remove Ground.exe

End the process, remove what restarts it, then delete the file and scan.

Step 1: Check where Ground.exe runs from and stop it
Ground.exe is the part you can see, and its location tells you whether it belongs there. Right-click it on the Processes page of Task Manager and choose Open file location, then right-click the file > Properties > Digital Signatures to see who signed it.
An unsigned file, or one in a user folder such as %AppData%, is the one to remove: end the task, then delete the file.
Note the folder name, because the same folder usually holds its other files. This is the same in Windows 11 and Windows 10.
Full procedure with screenshots: Close a frozen app (Task Manager, Force Quit) On uGetFix
2
Step 2: Delete scheduled tasks that bring it back
Open Task Scheduler from the Start menu and click Task Scheduler Library. Select each task you do not recognise and read the Actions tab:
- a task that starts a file in %AppData% or %Temp%
- runs powershell with a long encoded line
- opens a web address belongs to Ground.exe or a similar program
Right-click such a task and choose Delete, and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 3: Remove it from startup
Whatever Ground.exe installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 4: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through %LocalAppData%, %AppData%, %ProgramData% and the two Program Files folders.
Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold .exe, .dll, .js or .ps1 files are the strongest sign.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 5: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options.
Full procedure with screenshots: Run a Microsoft Defender Offline scan

Removing it: the order that works

Take the virus off before you touch the programs it replaced. If you repair first, a still-running copy infects them again. Safe Mode is not required, and a System Restore point is not a removal.

1
Disconnect what it can reach
Unplug USB drives and disconnect from shared network folders. The virus infects attached and mapped drives as far as your account may write to them.
2
End the process and remove its start-up entry
In Task Manager, Details tab, right-click Ground.exe > End task. Then delete Ground.lnk (or paint.lnk) from the Startup folder (shell:startup). Without the shortcut it will not start at the next boot.
3
Run a Microsoft Defender full scan
Windows Security > Virus & threat protection > Scan options > Full scan > Scan now. Microsoft's page on Virus:Win32/Grenam.A lists Defender among the tools that detect and remove it, and advises a full scan because it can find other hidden malware. Microsoft Safety Scanner is its free on-demand tool for a second opinion.
4
Run the offline scan
On the same Scan options page choose Microsoft Defender Antivirus (offline scan) > Scan now. The PC restarts and the scan runs before Windows loads, when the virus cannot protect itself.
5
Delete the file by hand if it is still there
If %AppData%\Ground.exe remains after the scans and the process is closed, delete it. Leave the g-files alone for now: they are your real programs.
6
Restart and look again
Repeat the folder check. If Ground.exe or the shortcut is back, something restarts it: check Task Scheduler (Task Scheduler Library) and the Startup apps list for entries pointing at AppData.

Scan with Microsoft Defender or another well-known antivirus that is already installed; the check is free.
Do the repair only after a clean restart and a second clean scan.
Keep the infected .exe files until you know the g-twin is intact.

Don't

Download "Ground.exe fixer" or cleaner tools from search results. A fixer is how the 2021 log's user ended up with a Ground-Fixer.rar, and we do not know what it contained.
Rely on System Restore: a restore point made after the infection holds the infected files too.
Delete the hidden g-files: they are the originals of your programs.

The first removal pass takes minutes; the repair of infected programs is what takes time, which our old guide had the other way round.

Repairing the programs it replaced

A removal tool deletes the virus. It does not promise to bring back the programs it replaced, so check them yourself. For each infected program you have two ways, and the first is the safer one.

Option	How	When to use it
Reinstall or repair the program	Uninstall it in Settings > Apps > Installed apps and install it again from the maker's site or store. For a game, the launcher's "verify files" option (Steam: Properties > Installed Files > Verify integrity) re-downloads replaced files	The default. Needs no guessing, and it also fixes what the virus changed besides the file name
Rename the hidden original back	With hidden files visible, delete the 522 KB `app.exe` and rename `gapp.exe` to `app.exe`	Only when the PC is clean, the g-file is the size the real program should be, and the program is large or cannot be reinstalled
Run a community script that renames the g-files	A 2017 Node.js script on GitHub does this in bulk. We did not run it and cannot vouch for it	Not recommended without reading it; renaming by hand for a few programs is safer

1
Check the Windows files
If a Windows tool no longer starts, open Command Prompt as administrator and run sfc /scannow, then, if it reports damage, DISM /Online /Cleanup-Image /RestoreHealth. The helper in the 2020 Microsoft thread advised the same System File Checker run. A repair install of Windows, keeping your files, is the last option.
2
Check your pictures
If your .jpg files show "I am Sorry" text, restore them from a backup made before the infection. Software cannot remove text that was written into the picture itself.
3
Scan again after the repair
Run one more full scan once the programs are back, and look at the folders for any gapp.exe that is left.

After the check: keep Windows clean

Get programs from the maker's site or the Microsoft Store, never from a crack or a torrent bundle.
Open e-mail attachments only from senders you expect, and check the sender's address.
Keep Windows Security on with real-time protection and Windows Update automatic.
Keep a backup of your files on a drive that is disconnected afterwards: file infectors reach every drive that is plugged in.
After a clean-up, make a fresh copy of your important files and keep it offline.

Don't

Click unknown links or open unexpected attachments, even from a known sender whose account may be hacked.
Trust a PC as clean just because it does not feel slow: Microsoft says security alerts may be the only symptom.
Keep using a program whose .exe is 522 KB next to a hidden g-twin.

Questions about Ground.exe

Is Ground.exe a virus?

Yes. Ground.exe is the dropped copy of the Grenam file-infecting virus, which Microsoft calls Virus:Win32/Grenam.A and Trend Micro lists with %AppData%\Ground.exe as its copy.

It is not a Windows file and not part of a program you installed. It infects .exe files by moving each real program to a hidden g-prefixed name and putting a copy of itself in its place.

Two forum cases with scan logs, in 2019 and 2021, show the same file name in AppData. The file is not ransomware and does not encrypt anything, but it should be removed, and the programs it replaced need repair.

How do I remove Ground.exe?

Remove the virus first, then repair what it replaced. End Ground.exe in Task Manager, delete the Ground.lnk shortcut from the Startup folder (Win + R, shell:startup), then run a Microsoft Defender full scan and the offline scan from Windows Security. Microsoft's page on the virus lists Defender among the tools that detect and remove it.

Restart and check that %AppData%\Ground.exe and the shortcut are gone. Only then reinstall the programs that the virus replaced, or rename their hidden g-copies back. Do not repair first, because a copy that is still running infects the repaired files again.

What does Ground.exe do?

It infects programs. For each .exe it finds, starting at drive C: and including attached and network drives, it copies the real program to a hidden file named g plus the original name, and then copies itself under the original name with the original icon.

Run an infected program and the virus starts first and then launches the hidden original, so everything seems to work. It handles 123 files per run.

It also starts with Windows, which is why deleting the process alone does not last. Some variants write "I am Sorry" onto JPG images.

Why does Ground.exe keep coming back after I delete it?

Because something starts it again. In the 2021 BleepingComputer scan log the cause was a Ground.lnk shortcut in the Startup folder that pointed at the copy in AppData\Roaming. Other variants use a registry entry, according to PCrisk.

Delete the shortcut and any start-up entry first, then the file, then restart and look again. If it returns, check Task Scheduler and Startup apps, run the offline Microsoft Defender scan, and consider that another program, the one that dropped it, is recreating it.

Why do my programs now have a g in front of their names?

Those are your real programs. The virus moved each original to a hidden file named g plus the original name, and replaced the normal name with a copy of itself. Make hidden and protected files visible in File Explorer and you will see both files side by side.

Do not delete the g-files. After the virus is removed, reinstall the program, or delete the 522 KB infected file and rename the g-file back to its original name. Reinstalling is safer because it also fixes anything else the virus touched.

Does a System Restore or Safe Mode remove Ground.exe?

No, neither is a removal. A restore point made after the infection contains the infected files, and a restore point made before it does not repair programs infected later.

Safe Mode is not needed because Microsoft Defender can remove the virus in normal Windows, and its offline scan runs before Windows loads, which is the same advantage Safe Mode was meant to give.

Use a full scan and the offline scan, then repair the programs. If you want an extra safety net before cleaning, copy your documents to an external drive first, and disconnect that drive again before you scan.

Is Ground.exe ransomware or a crypto-miner?

Neither, according to the analyses we read. Our 2020 guide compared it with ransomware and mentioned crypto-mining, but Microsoft and Trend Micro describe a file infector: it replaces programs and keeps starting itself. It does not encrypt files or ask for money.

The one routine that touches your pictures writes "I am Sorry" text onto JPG files. The program that delivered the virus can be something else, so a scan should look for further malware, and if it finds a stealer or a miner, treat that as the bigger problem.

Can I clean the infected files with a script from GitHub?

There is a 2017 Node.js script that renames the hidden g-files back to their original names. We did not run it. Its own page says it does not remove the virus, only cleans infected files, so it is useful only after the virus is gone.

Running a stranger's script on every program on your PC is a risk of its own, and reading the code first is not something most people can do. Reinstalling a handful of programs, or renaming a few g-files by hand, is simpler and safer.

How did Ground.exe get on my PC?

Microsoft and Trend Micro say it is dropped by other malware, or arrives as an e-mail attachment or a download from a malicious site. PCrisk adds software cracks, and our 2020 guide named pirated packages and torrent downloads. Which one applies to you, we cannot tell.

Think about what you installed or opened on the day the first alert appeared, and check your Downloads folder and Installed apps by install date. Finding the dropper matters because it may still be on the PC after Ground.exe is gone.

Will Fortect remove Ground.exe?

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For Ground.exe, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.

About the author

Olivia Morelli

Ransomware analyst

Olivia Morelli is News Editor at 2-Spyware.com. She covers topics such as computer protection, latest malware trends, software vulnerabilities, data breaches, and more. Olivia is particularly interested in ransomware viruses and enjoys writing in-depth articles about them. She is worried about the relentless growth of cybercrime, and she believes that awareness is the key factor in the fight against cybercrime. Therefore, she seeks to help people by sharing her knowledge about the latest scams, viruses, potentially unwanted programs, and their distribution methods. Olivia’s content is always based on rigorous research, however, she is known for her ability to provide technical information in an understandable language. Nothing can distract her when she immerses herself in work. Outside of work, she is busy studying as she pursues a Bachelor’s Degree in Computer Science. When she’s not working or coding, she tries to find time for herself as she believes that solitude is the soul’s holiday. Loves coffee and long haul flights.

More guides by Olivia Morelli

Sources

Microsoft Security Intelligence: Win32/Grenam (family page) (read October 6, 2026)
Microsoft Security Intelligence: threat search for Win32/Grenam (read October 6, 2026)
Microsoft Security Intelligence: Virus:Win32/Grenam.A (read October 6, 2026)
Trend Micro Threat Encyclopedia: Virus.Win32.GRENAM.B (read October 6, 2026)
Malpedia: Grenam (malware family) (read October 6, 2026)
PCrisk: Win32/Grenam malware (detection names) (read October 6, 2026)
BleepingComputer forum: Ground.exe Virus (May 2021) (read October 6, 2026)
Malwarebytes forum: Ground.exe Grenam.A (July 2019) (read October 6, 2026)
Microsoft Q&A: Ground.exe (21 March 2020) (read October 6, 2026)
GitHub: Ground.exe Cleaner (August 2017) (read October 6, 2026)
Microsoft Learn: Microsoft Defender offline scan (read October 6, 2026)
Microsoft Learn: Use the System File Checker tool (read October 6, 2026)