Description of Ghost Antivirus and consequences of its residing on your PC

Ghost Antivirus (GhostAntivirus) is a real disaster and its annoying ads is only a scintilla of the harm it makes. Ghost Antivirus may enter targeted computer system as a trojan or virus payload and as a  software downloaded and installed by user’s choice when he takes it for legit antivirus. The rogue is a self-launching program that cannot be stopped by user as it denies access to Task Manager while it is running and does not respond to user’s attempts of closing it in regular way. Further on, aiming at disabling antispyware that can remove Ghost Antivirus hackers provided for <random>onin.exe bundled with Ghost Antivirus that:
– interferes with legit software, first of all, with true antispyware in order to avoid their proper functioning or disabling them completely; however, other applications may be also disordered or fail to start;
– hijacks web-browser and deprives users of the access to websites providing remedy against Ghost Antivirus.
Click here to start free scan and remove Ghost Antivirus, related executables and other infections. If the link is banned, please reboot in safe mode and try again.

Ghost Antivirus Technical Details

  • Full name: Ghost Antivirus, GhostAntivirus, Ghost-Antivirus
  • Version: 2009
  • Type: Rogue anti-spyware
  • Origin: Russian Federation

Ghost Antivirus screenshot (click to enlarge):

Ghost Antivirus

Signs of being infected with Ghost Antivirus:

Ghost Antivirus infection is a member of old, in terms of IT, rogue antispyware family. It is commonly known as Internet Antivirus Pro family named after its pioneer member.
Members of the family may share nag screens and alerts and run according to the same schedule. However, Ghost Antivirus is of no visual similarity to Internet Antivirus Pro.
Signs of Ghost Antivirus infection are quite clear and visible immediately after its installation. It shows its nag screen and then pretends to scan your PC listing legit and valuable files among Ghost Antivirus scan results. Remove Ghost Antivirus adware and please do not try to delete the files it has marked as computer parasites, for their deletion may result in system collapse and disordering as there are important system files among them.
Click here to get rid of Ghost Antivirus adware and both related and independent infections.

Automatic Removal of Ghost Antivirus from your PC:

Please reboot in safe mode to remove Ghost Antivirus. This advice is applicable also for manual Ghost Antivirus removal.
Click the link below to download Ghost Antivirus removal tool and detect and remove every malicious resident of your computer system.

Ghost Antivirus Removal Tool

Manual Removal of Ghost Antivirus:

Removal of Ghost Antivirus according to this guide shall be executed only by experienced users able to manage dll files deletion and System Registry.  Ghost Antivirus is protected from manual removal until Windows is set into safe mode. Hence you need to reboot in safe mode prior to Ghost Antivirus removal. A general safety requirement for malware removal, applicable, of course, for Ghost Antivirus removal, is to disable Internet connection and do not start and use any software until Ghost Antivirus removal steps are executed in full.

Remove Ghost Antivirus files and dll’s:

ghostav.exe
register.ico
unins000.dat
uninst.ico
web.ico
working.log
ghost.sql
Infected.wav
listing.cfg
version.db
WMILib.dll
[random symbols].dll
Ghost Antivirus.lnk
Ghost Antivirus Home Page.lnk
Purchase License.lnk
settings.ini
uill.ini
unins000.exe
Uninstall Ghost Antivirus.lnk
links.txt
properties
times.conf
iGSh.png
iMSh.png
iPSh.png
pguard.ini
services.exe
onin.exe

Unregister Ghost Antivirus registry values:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ghost Antivirus_is1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
HKEY_CURRENT_USER\Software\Microsoft\FTP “SearchDir” = “c:\program files\Ghost Antivirus\”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run “<random>onin”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Ghost Antivirus”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce “3P_UDEC”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent “URIAPRO[1.1.3.9]”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe “Debugger” = “?”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe “RealDebugger” = “?”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon “RealLogonType” = “1”

Ghost Antivirus Remover with free scan