Free malware removal tool to remove Ghost Antivirus

Written by Administrator | Thursday, 14 January 2010 14:42

Ghost Antivirus is another rogue antispyware, a scareware, that tries to get money from users by prompting them to register and buy their products. Some old malwares often return to the front of the stage.This is just a clone of Internet Antivirus Pro. Don't trust this bogus application and uninstall Ghost Antivirus as soon as possible from your system. Beware of this scam.

Ghost Antivirus

How to remove Ghost Antivirus (Uninstall Ghost Antivirus) :

Download this free removal tool for Ghost Antivirus
Extract it
Launch
Click on the delete button

Ghost Antivirus will be removed from your system in 10s. Restart your computer when it’s finished.

Processes :

GhostAV.exe

Files :

%CommonDesktop%\Ghost Antivirus.lnk
%CommonPrograms%\Ghost Antivirus\Ghost Antivirus Home Page.lnk
%CommonPrograms%\Ghost Antivirus\Ghost Antivirus.lnk
%CommonPrograms%\Ghost Antivirus\Purchase License.lnk
%AppData%\Ghost Antivirus\lib\links.txt
%AppData%\Ghost Antivirus\lib\properties
%AppData%\Ghost Antivirus\lib\times.conf
%AppData%\Ghost Antivirus\settings.ini
%AppData%\Ghost Antivirus\uill.ini
%AppData%\Ghost Antivirus\unins000.exe
%AppData%\Ghost Antivirus\Uninstall Ghost Antivirus.lnk
%AppData%\Microsoft\Internet Explorer\Quick Launch\Ghost Antivirus.lnk
%Profile%\Local Settings\Application Data\Microsoft\Windows\pguard.ini
%Profile%\Local Settings\Application Data\Microsoft\Windows\services.exe
%Profile%\Local Settings\Temp\Perflib_Perfdata_c24.dat
%Profile%\Local Settings\Temp\~DFD58C.tmp
%InternetCache%\Content.IE5\ARCHK58V\background_bottom[1].png
%InternetCache%\Content.IE5\ARCHK58V\background_top[1].png
%InternetCache%\Content.IE5\ARCHK58V\blank[1].gif
%InternetCache%\Content.IE5\ARCHK58V\download[1].png
%InternetCache%\Content.IE5\ARCHK58V\update__[1].exe
%InternetCache%\Content.IE5\GZKBKX05\ghost_small[1].png
%InternetCache%\Content.IE5\GZKBKX05\name_small[1].png
%InternetCache%\Content.IE5\GZKBKX05\shop_bottom[1].png
%InternetCache%\Content.IE5\GZKBKX05\shop_but_lifetime[1].png
%InternetCache%\Content.IE5\GZKBKX05\shop_but_year[1].png
%InternetCache%\Content.IE5\KH8PWDY5\ghost[1].png
%InternetCache%\Content.IE5\KH8PWDY5\name[1].png
%InternetCache%\Content.IE5\KH8PWDY5\shop_bag[1].png
%InternetCache%\Content.IE5\KH8PWDY5\style[1].css
%InternetCache%\Content.IE5\U9S3SVUL\ghost-pay[2].htm
%InternetCache%\Content.IE5\U9S3SVUL\iepngfix[1].htc
%InternetCache%\Content.IE5\U9S3SVUL\shop_center[1].png
%InternetCache%\Content.IE5\U9S3SVUL\shop_top[21].png
%ProgramFiles%\Ghost Antivirus\GhostAV.exe
%ProgramFiles%\Ghost Antivirus\iGSh.png
%ProgramFiles%\Ghost Antivirus\iMSh.png
%ProgramFiles%\Ghost Antivirus\iPSh.png
%ProgramFiles%\Ghost Antivirus\lib\ghost.sql
%ProgramFiles%\Ghost Antivirus\lib\ia080618x.db
%ProgramFiles%\Ghost Antivirus\lib\Infected.wav
%ProgramFiles%\Ghost Antivirus\lib\listing.cfg
%ProgramFiles%\Ghost Antivirus\lib\version.db
%ProgramFiles%\Ghost Antivirus\lib\WMILib.dll
%ProgramFiles%\Ghost Antivirus\register.ico
%ProgramFiles%\Ghost Antivirus\unins000.dat
%ProgramFiles%\Ghost Antivirus\uninst.ico
%ProgramFiles%\Ghost Antivirus\web.ico
%ProgramFiles%\Ghost Antivirus\working.log

Registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- Ghost Antivirus="c:\program files\Ghost Antivirus\GhostAV.exe" /s
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
- 3P_UDEC="[Folder of installation]\GhostAntivirusInstall_37_0_.exe" 0;C;

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- FirstRunDisabled=0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
- AVPath=\\.\root\SecurityCenter:AntiVirusProduct.instanceGuid="{437669B6-EEBF-48EA-8A17-67801A279313}"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
- URIAPRO[1.1.3.9]=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ghost Antivirus_is1
- Inno Setup: Setup Version=5.2.3
- Inno Setup: App Path=c:\program files\Ghost Antivirus
- InstallLocation=c:\program files\Ghost Antivirus\
- Inno Setup: Icon Group=Ghost Antivirus
- Inno Setup: User=net-studio.org
- Inno Setup: Selected Tasks=desktopicon,quicklaunchicon
- Inno Setup: Deselected Tasks=
- DisplayName=Ghost Antivirus (1.1.3.9)
- DisplayIcon=c:\program files\Ghost Antivirus\GhostAV.exe
- DisplayVersion=1.1.3.9
- Publisher=Ghost Antivirus (1.1.3.9)
- URLInfoAbout=http://ghostantivirus.com/
- HelpLink=http://ghostantivirus.com/
- URLUpdateInfo=http://ghostantivirus.com/
- NoModify=1
- NoRepair=1
- InstallDate=20100114
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
- taskmgr.exe
- taskmgr.exe\RealDebugger=
- taskmgr.exe\Debugger=?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
- RealLogonType=1

Add comment

Free malware removal tool for AntiMalware Pro

Free malware removal tool for KeepCop

Free malware removal tool for Secure Warrior

Free malware removal tool for Windows Protection Suite

Free malware removal tool to get rid of BlockWatcher

Free malware removal tool to get rid of GreatDefender

Free malware removal tool to get rid of SaveArmor

Free malware removal tool to get rid of SysDefence

Free malware removal tool to remove Active Security

Free malware removal tool to remove Advanced Defender