How to remove Ghost Antivirus (Uninstall instructions)

Ghost Antivirus is a rogue security software, it is a false anti-spyware application that is generally installed in the user’s computer by dangerous trojans (such as Zlob and false video codecs), but it can also be installed manually by the victim.

Once your computer is infected with this parasite, it will immediately displays security warnings, alerts and system scans stating that your computer is heavily infected. These warnings are all false and are only displayed to make you think your computer is truly infected and that it is necessary to buy the full version of the software to remove the so-called infections.

Make sure to not fall in this scam, if your computer is infected with Ghost Antivirus, it is recommended to remove it immediately and to scan your system with a real security software.

Symptoms of infection

  • The process GhostAV.exe is running in your system
  • Slow computer performance
  • Repeated security warnings, alerts and system scans
  • Web sites that suddenly are shown on your desktop

Malicious web sites and urls:

1
2
3
4
Ghost-antivirus.com
Ghost-pay.com
Ghostantivirus.com
Ghostpays.com

When the program is executed, it creates the following files:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
C:\Program Files\Ghost Antivirus
C:\Program Files\Ghost Antivirus\GhostAV.exe
C:\Program Files\Ghost Antivirus\register.ico
C:\Program Files\Ghost Antivirus\unins000.dat
C:\Program Files\Ghost Antivirus\uninst.ico
C:\Program Files\Ghost Antivirus\web.ico
C:\Program Files\Ghost Antivirus\working.log
C:\Program Files\Ghost Antivirus\Languages
C:\Program Files\Ghost Antivirus\lib
C:\Program Files\Ghost Antivirus\lib\ghost.sql
C:\Program Files\Ghost Antivirus\lib\Infected.wav
C:\Program Files\Ghost Antivirus\lib\listing.cfg
C:\Program Files\Ghost Antivirus\lib\version.db
C:\Program Files\Ghost Antivirus\lib\WMILib.dll
%UserProfile%\Application Data\Ghost Antivirus
%UserProfile%\Application Data\Ghost Antivirus\lib
%UserProfile%\Application Data\Ghost Antivirus\lib\links.txt
%UserProfile%\Application Data\Ghost Antivirus\lib\properties
%UserProfile%\Application Data\Ghost Antivirus\lib\times.conf
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Ghost Antivirus.lnk
%AllUsers%\Desktop\Ghost Antivirus.lnk
%AllUsers%\Start Menu\Programs\Ghost Antivirus
%AllUsers%\Start Menu\Programs\Ghost Antivirus\Ghost Antivirus Home Page.lnk
%AllUsers%\Start Menu\Programs\Ghost Antivirus\Ghost Antivirus.lnk
%AllUsers%\Start Menu\Programs\Ghost Antivirus\Purchase License.lnk

The program creates the following registry entries:

1
2
3
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ghost Antivirus_is1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Ghost Antivirus

How to remove Ghost Antivirus (manual removal) ?

  • Terminate all the Ghost Antivirus processes
  • Unregister all the Ghost Antivirus DLLs
  • Delete all the Ghost Antivirus files
  • Delete all the Ghost Antivirus registry entries

How to remove Ghost Antivirus (automatic removal) ?

Random Posts

Previous Posts