Ghostify Removal Guide

Do you know what Ghostify is?

Why did you install Ghostify onto your Windows operating system? You must have decided to let this PUP (potentially unwanted program) in after learning that it can enable access to video-streaming websites that you would generally have no access to due to your geographical location. Just like Vidsqaure – another PUP that was created by Epikai Ltd. – this program changes DNS settings to ensure that you can access websites that are locked in your region. For example, you might gain access to hulu.com or netflix.com. Although the program does work, there are some things that our research team wants to warn you about. If you realize that you cannot trust this potentially unwanted program, you might decide to remove it. Do not rush to delete Ghostify in a regular manner because the process is quite tricky, and we have created a full guide that shows how to eliminate it from your operating system manually.

The official website representing Ghostify is gostify.com. As you might notice, there’s a discrepancy between the names, and we are still not sure what the purpose of that is. According to our research team, Epikai might be trying to cover up the program. For example, when you install it, the folders that the PUP creates do not have obvious names. Instead, they are random, and this might prevent you from deleting the program manually. According to our research, the PUP is most likely to be dropped to %ProgramFiles(x86)% or %ProgramFiles% folder (depending on the operating system), and the folders are likely to have the “GTF” string at the beginning of their names. This is how you locate the suspicious program. Did you know that it also installs a browser extension? At the moment, it appears that this extension is only compatible with the Google Chrome browser, and it is named “Ghostify Hide Geo FREE.” We advise removing this extension.Ghostify Removal GuideGhostify screenshot
Scroll down for full removal instructions

The clone of Ghostify, known by the name “Vidsqaure,” has already been reviewed on our website, and it is classified as an advertising-supported program (adware) because it showcases advertisements. Can the PUP we are discussing show ads as well? According to the Privacy Policy, Ghostify can record information that might help third-party advertisers, but there is no information suggesting that it displays ads. Obviously, if you notice that, you should not interact with the ads. Also, note that these advertisements could be displayed by third-party malware. Although the PUP has an official installer, it could also be introduced to you via third-party installers that pack other programs as well. If you do not have enough experience to be able to identify malware yourself, we advise employing a trusted malware scanner. Do not ignore the malicious infections active on your operating system because they could be extremely dangerous.

There is no denying that some suspicious activity is involved with Ghostify, which is why we advise considering its elimination. As we have warned you already, getting rid of this PUP can be tricky. If you uninstall it like a normal app, leftovers will remain present, and you have to erase them as well. The manual Ghostify removal guide might seem lengthy and complicated, but we are sure that anyone can handle it. If you are having issues, let us know via the comments section below. Also, remember that an anti-malware tool can automatically erase the PUP from your operating system in no time. This tool is especially helpful if other threats have been found on your computer.

Delete Ghostify from Windows

N.B. It is recommended that you uninstall “GTF[random letters]” and “GTF[random letters] Updater” first.

Windows XP:

  1. Click the Start icon on the Taskbar and open Control Panel.
  2. Double-click Add or Remove Programs and then Remove the unwanted application.
  3. Erase leftovers (see the guide below).

Windows Vista or Windows 7:

  1. Click the Windows icon on the Taskbar and then open Control Panel.
  2. Move to the Uninstall a program menu and Uninstall the unwanted application.
  3. Erase leftovers (see the guide below).

Windows 8 or Windows 10:

  1. Launch RUN (tap Win+R keys), enter Control Panel, and click OK.
  2. In the Uninstall a program menu, right-click the unwanted app, and select Uninstall.
  3. Erase leftovers (see the guide below).

Erase the leftovers of Ghostify:

  1. Simultaneously tap Win+E to access Windows Explorer.
  2. Type %LOCALAPPDATA%\Google\Chrome\User Data\ or %UserProfile%\Local Settings\Application Data\Google\Chrome\User Data\ (if you are on Windows XP) in the bar above and tap Enter.
  3. If you have multiple profiles, open your chrome profile folder, or move to Default.
  4. Right-click and Delete the files named Preferences and Secure Preferences.
  5. Open the Extensions folder and Delete the folder called Oaocmnfllndpbbmjmniielgaanaifehp.
  6. Go back and open the Local Storage folder.
  7. Right-click and Delete these files:
    • http_www.gostify.com_0.localstorage
    • http_www.gostify.com_0.localstorage-journal
  8. Simultaneously tap Win+R to launch RUN and enter regedit.exe to access Registry Editor.
  9. Right-click and Delete the key called com.oaocmnfllndpbbmjmniielgaanaifehp.uid in these paths:
    • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Chrome\NativeMessagingHosts\
    • HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\NativeMessagingHosts\
  10. Right-click and Delete the key called GTF[random letters] Updater in these paths:
    • HKEY_LOCAL_MACHINE\SOFTWARE\
    • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\

In non-techie terms:

Even though Ghostify is not a dangerous infection, it is very suspicious; starting with how it enters your operating system and ending with its removal. Considering that this program can record and share data about your virtual behavior with unknown parties and because its elimination is tricky and confusing, we classify this app as a potentially unwanted program. You can get rid of it using the manual removal guide above, or you can install an automated anti-malware tool instead. The latter option is recommended by our research team, especially if you are dealing with other threats, and if you want better protection for your operating system.