Ghost Ransomware

What is Ghost Ransomware?

Ghost Ransomware enciphers victim’s files, appends the .ghost extension to them, and then opens a window with a ransom note in which the hackers “apologize for the inconvenience.” Losing your precious files or important documents could be an inconvenience indeed. Not to mention, the cybercriminals ask to pay a ransom of 0.08116 BTC, which currently is around 422 US dollars. It is not a particularly small sum, and as you probably realize it yourself, there are no guarantees you will receive decryption tools the hackers promise even if you pay what they ask for in time. Therefore, it seems to us the safer choice would be to erase Ghost Ransomware with the instructions placed at the end of the text or a legitimate antimalware tool. To learn more about the malicious application, we invite you to continue reading.

Where does Ghost Ransomware come from?

Malicious applications like Ghost Ransomware can be spread in many different ways. One of the most popular methods is uploading malicious installers on various file-sharing web pages or sending them via Spam emails. Thus, it means you have to be careful with suspicious email attachments or data downloaded from untrustworthy sources, such as torrent or other P2P file-sharing web pages. The easiest way to identify potential threats and get warned about them is to employ a legitimate antimalware tool. If you do, you should use it every time you download or receive material from unreliable sources. Scanning files do not take long, and it can prevent you from receiving various harmful programs.

How does Ghost Ransomware work?

The first thing users who encounter Ghost Ransomware should know is that it might not stop working until the computer gets turned off. Our researchers at Anti-spyware-101.com say the malicious application could launch itself automatically with the operating system once the machine gets restarted. That is because the malware might create particular files in the Windows Registry upon its installation. While running the threat should look for data it is programmed to encrypt, such as documents, pictures, etc.

The user may not realize his files are being encrypted, but once Ghost Ransomware finishes the encryption process, he should be notified about what happened with a red warning message called Ghost. In it, the malware’s developers ask to pay a ransom in Bitcoins. Apparently, after making the payment, the victims should email them the proof of it to receive decryption tools. Of course, there are no guarantees they will send the needed decryption tools even if they promise it. Thus, as we said at the beginning of the article making the payment could be risky, and it is not something we would recommend doing.

How to eliminate Ghost Ransomware?

Since the malware might create a bit of data on the infected device, removing it from it might not be an easy task, especially for inexperienced users. However, if you are still determined to delete Ghost Ransomware manually, you could use the instructions located below. Another way to make sure the threat gets erased is to scan the device with a legitimate antimalware tool. Once it detects the malicious application and other possible threats, the tool should let you get rid of it by pressing the displayed removal button.

Erase Ghost Ransomware

1. Tap Ctrl+Alt+Delete.
2. Open Task Manager and check the Processes tab.
3. Find a process named GhostService.exe.
4. Select this process and click End Task.
5. Leave your Task Manager.
6. Press Windows key+E.
7. Find the provided locations:
   %TEMP%
   %USERPROFILE%Desktop
   %USERPROFILE%Downloads
8. Search for the malware’s launcher, right-click it and select Delete.
9. Go to this location: %HOMEDRIVE%
10. Search for the listed files:
    GhostForm.exe
    GhostHammer.dll
    GhostFile.dll
11. Right-click the listed files and select Delete.
12. Find this directory: %APPDATA%
13. Locate a folder called Ghost that contains: Ghost.bat, GhostHammer.dll, GhostService.exe.config, GhostService.pdb, and GhostService.vshost.exe.
14. Right-click this folder and pick Delete.
15. Leave File Explorer.
16. Tap Windows key+R, type Regedit and choose OK.
17. Go to these locations:
    HKCU\SYSTEM\ControlSet001\services
    HKCU\SYSTEM\CurrentControlSet\services
18. Find keys called GhostService, right-click them and press Delete.
19. Leave Registry Editor.
20. Empty Recycle bin.
21. Restart the computer. Download Removal Tool100% FREE spyware scan and
    tested removal of Ghost Ransomware*