Help Needed

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Has anyone any idea what Gh0stl.exe is. I keep getting a security notice asking me if I want to permit or block but no matter what I do the notice keeps popping up. I'm using Norton Internet Security 2005 and Systemworks 2004. I've looked up on google but nothing came up.

 

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Er - ghostl.exe or ghost1.exe? There is a difference....

And the random digit replacement - is that exact? Because if so it is something nasty...

Harry.

 

The way it is coming up in the security alert is Gh0stl.exe (ghostl)

 

That is most confusing. Does it really spell it in two different ways like that? How about a cut'n'paste of the whole message?

If it is really like that then I suspect some trojan.

Harry.

 

it's just spelt Gh0stl.exe. (excuse the colour, saved it this way to save on space)

 

I think I've fixed it. I was looking through Add Remove programs and some idiot had installed mirc (IRC). The Gh0stl thing disappeared once I had uninstalled it. Thanks Anyway.

 

OK - I see what you mean. I suspect this is a trojan. Search for it first in msconfig->startup. If not there try the registry. Also search in the file-system.

Report the path to it. The path may give a clue as it its provenance.

Harry.

 

Do you notice anything happen if you end that process?

 

Great! It was possibly a mIRC script or similar - that app attracts a lot of nasties unfortunately.

Harry.

 

The computer didn't act any different once I ended that process. All seems fine now. Cheers