We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names
Win32/Ghokswa
Aliases: No associated aliases
Summary
Windows Defender detects and removes this unwanted software.
This threat installs a modified version of Chrome and/or Firefox browsers, replacing any existing copy of these that were already installed on the system.
These modified copies have different search and home page settings that the user may be unable to change, and update components that may download additional unwanted software.
This threat is usually installed by Trojan:Win32/Xadupi.
This threat is part of a suite of malware and unwanted software families that is also called "Fireball". Read about this threat group in the Windows Security blog:
Understanding the true size of “Fireball”
Find out ways that malware can get on your PC.
This program poses a high threat to your PC.
Remove programs
You might need to manually remove this program:
If an uninstaller is not available, does not work properly, or you do not want to use it, you can use the following free tools to detect and remove this program and other potentially unwanted software from your PC:
- Windows Defender for Windows 8.1 and Windows 10, or Microsoft Security Essentials for Windows 7 and Windows Vista
- Microsoft Safety Scanner
Use cloud protection
The Microsoft Active Protection Service (MAPS) uses cloud protection to help guard against the latest malware threats. It’s turned on by default for Microsoft Security Essentials and Windows Defender for Windows 10.
Get more help
You can also see our advanced troubleshooting page or search the Microsoft virus and malware community for more help.
If you’re using Windows XP, see our Windows XP end of support page.
