How to remove Ghost Antivirus
Thursday, January 14th, 2010 at 1:45 amHome » Rogue Antispyware » Ghost Antivirus
Ghost Antivirus description
Ghost Antivirus is a new fraudulent program created by the same people who made Internet Antivirus Pro malware. The scam is promoted on large variety of counterfeit websites. Those are masked as either online scanners or as legitimate software download centers. Some of those websites may even install GhostAntivirus secretly.
Ghost Antivirus uses deceptive ways to make people pay $94.95 for a license of the program. It displays counterfeit security alerts. It also causes various other problems and then it offers fixing them after a victim gets the “full version”. Ghost Anti Virus blocks legitimate security programs and Windows Task Manager to prevent the removal. It also terminates Explorer.exe; this makes it difficult to boot into normal mode of Windows operating system.
Ghost Antivirus and alerts it loads are not to be trusted. Delete this malware as soon as possible.
Here are some of the fabricated warnings displayed by GhostAntivirus:
Ghost Antivirus – Threats detected!
Warning! Infections found!
Scan report
Trojan-IM.Win32.Faker.a
Virus.Win32.Faker.a
Trojan-PSW.BAT.Cunter
Trojan-PSW.VBS.Half
Trojan-PSW.Win32.Antigen.a
Trojan-PSW.Win32.Delf.d
Attention! Unregistered application cannot delete viruses, listed in the table above, it is recommended to register Ghost Antivirus in order to delete all viruses and for full system protection.
Attention! Your system is infected!
System alert
Your PC is still infected with dangerous viruses. It is strongly recommended to activate antivirus protection to prevent data loss and to avoid the theft of your credit card details. Click here to activate protection.
Ghost Antivirus Warning!
Harmful and malicious software detected
Online Scanner detected programs that might compromise your privacy or damage your computer.
Trojan-IM.Win32.Faker.a
Virus.Win32.Faker.a
Trojan.PSW.BAT.Cunter
Ghost Antivirus is a Rogue Antispyware software
How to manually remove Ghost Antivirus
To remove Ghost Antivirus spyware you must block Ghost Antivirus sites, stop and remove processes, unregister DLL files, search and delete all other Ghost Antivirus files and registry utility. Follow the Ghost Antivirus detection and removal instructions below.
The most typical software removal method is to remove Ghost Antivirus by using "Add or Remove Programs" service. However there may be hidden Ghost Antivirus files, running processes and registries in your computer, so Ghost Antivirus may recreate all other files after reboot.
Ghost Antivirus manual removal instructions
Block Ghost Antivirus sites:
softwareanti.com
softwarejar.com
softwarerising.com
softwaresecure.net
softwarespyware.net
softwarethe.net
softwarethreats.com
softwarethreats.net
softwarexp.net
softwarespam.net
ghost-antivirus.com
ghost-pay.com
ghostantivirus.com
ghostpays.com
thesecurebill.com
thesoftbill.com
softwarerising.net
softwareanti.net
softwaredefense.net
Read more how to block Ghost Antivirus sites
Stop and remove Ghost Antivirus processes:
onin.exe
services.exe
unins000.exe
GhostAV.exe
Read more how to kill Ghost Antivirus processes
Locate and delete Ghost Antivirus registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ghost Antivirus_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
HKEY_CURRENT_USER\Software\Microsoft\FTP "SearchDir" = "c:\program files\Ghost Antivirus\"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run "onin"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Ghost Antivirus"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce "3P_UDEC"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent "URIAPRO[1.1.3.9]"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe "Debugger" = "?"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe "RealDebugger" = "?"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "RealLogonType" = "1"
Read more how to delete Ghost Antivirus registry entries
Download RegistryBooster 2010 to scan errors caused by Ghost Antivirus
Search and unregister Ghost Antivirus DLL libraries:
WMILib.dll
Read more how to unregister Ghost Antivirus DLL files
Detect and delete other Ghost Antivirus files:
c:\Program Files\Ghost Antivirus\
c:\Program Files\Ghost Antivirus\GhostAV.exe
c:\Program Files\Ghost Antivirus\register.ico
c:\Program Files\Ghost Antivirus\unins000.dat
c:\Program Files\Ghost Antivirus\uninst.ico
c:\Program Files\Ghost Antivirus\web.ico
c:\Program Files\Ghost Antivirus\working.log
c:\Program Files\Ghost Antivirus\Languages\
c:\Program Files\Ghost Antivirus\lib\
c:\Program Files\Ghost Antivirus\lib\ghost.sql
c:\Program Files\Ghost Antivirus\lib\Infected.wav
c:\Program Files\Ghost Antivirus\lib\listing.cfg
c:\Program Files\Ghost Antivirus\lib\version.db
c:\Program Files\Ghost Antivirus\lib\WMILib.dll
c:\WINDOWS\system32\.dll
c:\WINDOWS\system32\.dll
c:\Documents and Settings\All Users\Desktop\Ghost Antivirus.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Ghost Antivirus\
c:\Documents and Settings\All Users\Start Menu\Programs\Ghost Antivirus\Ghost Antivirus Home Page.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Ghost Antivirus\Ghost Antivirus.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Ghost Antivirus\Purchase License.lnk
%UserProfile%\Application Data\Ghost Antivirus\
%UserProfile%\Application Data\Ghost Antivirus\settings.ini
%UserProfile%\Application Data\Ghost Antivirus\uill.ini
%UserProfile%\Application Data\Ghost Antivirus\unins000.exe
%UserProfile%\Application Data\Ghost Antivirus\Uninstall Ghost Antivirus.lnk
%UserProfile%\Application Data\Ghost Antivirus\lib\
%UserProfile%\Application Data\Ghost Antivirus\lib\links.txt
%UserProfile%\Application Data\Ghost Antivirus\lib\properties
%UserProfile%\Application Data\Ghost Antivirus\lib\times.conf
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Ghost Antivirus.lnk
%UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iGSh.png
%UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iMSh.png
%UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\iPSh.png
%UserProfile%\Local Settings\Application Data\Microsoft\Windows\pguard.ini
%UserProfile%\Local Settings\Application Data\Microsoft\Windows\services.exe
\onin.exe
We strongly recommend you to use spyware remover to track Ghost Antivirus and automaticaly remove Ghost Antivirus processes, registries and files as well as other spyware threats.
Trackbacks
- Remove Ghost Antivirus – Threats detected! pop-up
- Remove Ghost Antivirus System alert pop-up
- Remove Ghost Antivirus Warning pop-up






Ghost Antivirus