Ghostify

Ghostify is a potentially unwanted program that is officially promoted at gostify.com. Of course, it is not likely that many users will find this PUP on their own. It is more likely that they will be pointed to it using promotional techniques (e.g., via pop-up ads), or it will be bundled with other programs. As you might realize already, malware could be bundled along with this potentially unwanted program, which is why you have to be exceptionally careful whenever you install unfamiliar software. If you already suspect that malicious threats might have invaded your operating system, we advise installing a malware scanner. A reliable, up-to-date, and free malware scanner is available via the download link below. Install it and perform a full system scan to check if there are other infections that, possibly, must be deleted from your computer. If not, focus on the removal of Ghostify.

According to the official information, Ghostify is meant to disable geographical restrictions when streaming video on Netflix, Hulu, BBC iPlayer, and Pandora. Our researchers warn that this PUP functions in a similar manner as DNS.Unlocker, which is a known infection whose removal is discussed in a different report. Even though the program works, it is extremely suspicious and strange. For one, the official installer works in a strange way, as you are not permitted to choose specific components. Also, the names of files representing the PUP are random, and this might prevent you from identifying and deleting the app successfully. In our case, these files were stored in folders named “GTFPOQUOTT” and “GTFPOQUOTT Updater.” If that was not enough, the suspicious program is also capable of silently adding a Chrome extension. Needless to say, illegal activity is never a good sign, and this might be a good reason to delete Ghostify.

When the suspicious Ghostify is activated, it silently connects to the Internet without your permission and changes TCP/IP settings. A new DNS address is added. Although this might enable access to the desired video-streaming websites, you have to be extremely cautious about the software that can initiate such changes. Needless to say, if they are made without your permission, you should remove the software responsible for them without further hesitation. Even if Epikai Ltd (the developer of Ghostify and its clone Vidsqaure) makes these changes with your permission, you have to be extremely careful. One of the most important things you can do is to analyze legal information, such as the Privacy Policy. Of course, checking reviews created by independent parties is also a great way to learn more about suspicious and unfamiliar services. If you only pay attention to the official information, you could be tricked.

The Privacy Policy we have analyzed it available at http://www.gostify.com/privacy.html. This document indicates that personally identifiable information is not collected while you use Ghostify services, which is always a good thing. Unfortunately, some things are more disconcerting. For example, it is stated that the PUP can record information to assist with online advertising. Anonymous information is allegedly recorded and shared with parties who are linked to retail, ad networks, advertising companies, etc. Are these third parties revealed? Of course, they are not, and that is what makes them suspicious. Do they have good intentions? Does Ghostify work as an advertising platform? If you are introduced to pop-ups and banner ads after installing this potentially unwanted program, we advise interacting with them with caution. In fact, it would be best not to interact with them at all.

One of the main reasons why Ghostify is classified as a potentially unwanted program is that its removal is quite complex. Although it is not difficult, a lot of users can be tricked into thinking that the PUP is gone when, in reality, it is not. First and foremost, you cannot uninstall this program because certain elements are left behind. If you want to delete Ghostify manually, follow the instructions below. If you do not think you can get rid of this program on your own, you can always install an anti-malware tool. Make sure you install a tool that will recognize this program as a potential threat.

Ghostify Removal

Windows 10/Windows 8/Windows 7/Windows Vista:

1. Launch RUN (simultaneously tap Win+R keys on the keyboard).
2. Enter Control Panel into the dialog box and click OK to open a menu.
3. Move to the Uninstall a program menu and Uninstall the unwanted app.

Windows XP

1. Click the Start menu icon on the left of the Taskbar at the bottom of the screen.
2. Open Control Panel and then double-click Add or Remove Programs.
3. Select the undesirable program and click the Remove button.

Delete leftovers:

1. Launch Explorer by tapping Win+E keys.
2. Enter %LOCALAPPDATA%\Google\Chrome\User Data\ (or %UserProfile%\Local Settings\Application Data\Google\Chrome\User Data\) into the bar at the top.
3. Open the Default folder (or your {unique name} profile folder) and then open Extensions.
4. Delete the folder named oaocmnfllndpbbmjmniielgaanaifehp.
5. Go back to the Default folder.
6. Delete the files called Preferences and Secure Preferences.
7. Now, open the Local Storage folder.
8. Delete the files named http_www.gostify.com_0.localstorage and http_www.gostify.com_0.localstorage-journal.
9. Launch RUN by tapping Win+R keys.
10. Type regedit.exe into the dialog box and click OK.
11. Navigate to HKLM\SOFTWARE\Wow6432Node\Google\Chrome\NativeMessagingHosts (or HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\).
12. Delete the key named com.oaocmnfllndpbbmjmniielgaanaifehp.uid.
13. Navigate to HKLM\SOFTWARE\Wow6432Node\ (or HKLM\SOFTWARE\).
14. Delete the key named GTFPOQUOTT Updater.
15. Navigate to HKLM\CurrentControlSet\services\ and repeat step 14.
16. Navigate to HKLM\SYSTEM\ControlSet001\services\ and repeat step 14.
17. Navigate to HKLM\SYSTEM\ControlSet002\services\ and repeat step 14.