GhostWall removal (HELP!)

Discussion in 'Other Ghost Security Software' started by Enlou, Sep 15, 2006.

Thread Status:
Not open for further replies.
  1. Enlou

    Enlou Registered Member

    Sep 15, 2006
    Ok, so I tried this because it looked like it was suggested somewhere over on

    It is very functional and I really enjoy the capabilities of it, but I've noticed that it's far easier for me to just block ports with my router. Therefore I decided to keep it in a "drawer" (not use it, but keep it handy just in case).

    I have removed it from the hidden devices in the device manager, I've removed every trace of the file I could find. BUT IT STILL RUNS. I just spent 2 days (right after rebooting) blaming people at Qwest saying that they were blocking my inbound ports because I KNEW that I had removed GW. It was still rearing its head. After breaking down, opening GW, clicking "Allow All" (which doesn't work once you reboot), my servers all started receiving connections again. Not only that, but somehow since opening it (first tried it at work) there are a few remote desktop destinations that I can no longer access, no matter how hard I try. Please PLEASE somebody tell me how to remove every tiny little aspect of this application.

    I'm sorry to be so crass, I really am, but I tried emailing the writers behind the software to no avail... I emailed from my home email and my work email and have gotten no responses at all.
  2. gottadoit

    gottadoit Security Expert

    Jul 12, 2004
    Sorry to hear you are having trouble with manually disabling GhostWall

    Another alternative to manually disabling it that you could use if you wish would be to save the rules file and simply use the uninstall routine. If you wish to use it again at a later point in time then reinstall (the same version) and copy the rules back again. This has the advantage of not requiring you to find out how it works and basically achieves much the same goal

    The rules file is in your Windows installation directory called ghstwall.fir, in my case this is C:\WINDOWS\system32\ghstwall.fir and the file can be copied while GhostWall is running

    If you wish to manually disable GhostWall you need to disable the driver and remove the Run key for the GUI, and then reboot.

    The driver entry is under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ghstwall and if GhostWall is still installed you should see some entries in there. You can use Device Manager to change the Driver Startup property from Automatic to Disabled (and that changes the value of Start from 2 to 4) to stop the driver from becoming active during boot

    The other thing that you need to do in order to stop GhostWall starting again is to make sure that you don't have the GUI in the Run key ( In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run there will be a value called GhostWall if the Gui is still set to auto-start ). You could also check for and remove the startup entry using the Sysinternals autostarts tool.
Thread Status:
Not open for further replies.