Published Feb 15, 2016 | Updated Sep 15, 2017

Win32/Ghokswa

Severe |Detected with Windows Defender Antivirus

Aliases: No associated aliases

Summary

Windows Defender  detects and removes this unwanted software.

This threat installs a modified version of Chrome and/or Firefox browsers, replacing any existing copy of these that were already installed on the system.

These modified copies have different search and home page settings that the user may be unable to change, and update components that may download additional unwanted software.

This threat is usually installed by Trojan:Win32/Xadupi.

This threat is part of a suite of malware and unwanted software families that is also called "Fireball". Read about this threat group in the Windows Security blog: 

Understanding the true size of “Fireball”

Find out ways that malware can get on your PC.

 

This program poses a high threat to your PC.

Remove programs

You might need to manually remove this program:

If an uninstaller is not available, does not work properly, or you do not want to use it, you can use the following free tools to detect and remove this program and other potentially unwanted software from your PC:

Use cloud protection

The Microsoft Active Protection Service (MAPS) uses cloud protection to help guard against the latest malware threats. It’s turned on by default for Microsoft Security Essentials and Windows Defender for Windows 10. 

Get more help

You can also see our advanced troubleshooting page or search the Microsoft virus and malware community for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Follow us