← Back to Ghost Claw

Antivirus & SmartScreen Help

Last updated: April 29, 2026

Short version: Ghost Claw is currently distributed without a code signing certificate, so Windows SmartScreen and some antivirus tools may flag the installer or sidecar processes on first run. This is a false positive. We're working on code signing so this stops happening.

Why this happens

Ghost Claw ships as a Windows installer plus several small sidecar processes — one for WhatsApp messaging, one for window control, one for text-to-speech, one for screen context, one for a local voice synthesizer. Each is a separate .exe file that runs in the background.

Antivirus engines flag executables based on three signals:

  1. Code signature. Ghost Claw is currently unsigned. Signed executables get the benefit of the doubt; unsigned ones get scrutinized.
  2. Publisher reputation. Brand-new publishers have zero reputation. Reputation builds as more users download and run the software successfully.
  3. Behavioral heuristics. The window-control sidecar uses Win32 APIs to move and resize windows, which on the surface looks like the kind of thing remote-access malware does. It isn't — but a heuristic engine can't tell.

Combine "unsigned + new publisher + system-control behavior" and you get false positives. Ghost Claw does not contain malware. The full source is in our public repository; you can audit every line.

Updating from Ghost Claw V5, and the slow first start

Updating from V5? The V6 installer removes the old Ghost Claw V5 folder for you and installs into %LOCALAPPDATA%\Ghost Claw V6. Your settings, API keys and memory are kept — they live in %APPDATA%\com.ghostclaw.app.v5, which does not change. If you earlier added an antivirus exclusion for the V5 folder, add one for the V6 folder as well (below).

First start can take a few minutes. Ghost Claw unpacks tens of thousands of files (its built-in Python voice and AI engines) the first time it runs after installing or updating, and your antivirus scans each one as it appears. A progress bar shows what it is doing. It only happens once per update; adding the exclusions below makes it much faster.

What to do — by antivirus vendor

Avast / AVG
  1. Open Avast → Menu (top-right) → Settings.
  2. Go to General → Exceptions.
  3. Click Add Exception and add this folder:
    %LOCALAPPDATA%\Ghost Claw V6
  4. Also add: %APPDATA%\com.ghostclaw.app.v5 (Ghost Claw's data folder).
  5. Click Add Exception and confirm. Restart Ghost Claw.

If Avast already quarantined a file, go to Protection → Virus Chest, find the Ghost Claw entry, and choose Restore and add exception.

Microsoft Defender (built into Windows)
  1. Open Windows Security (search the Start menu).
  2. Click Virus & threat protection.
  3. Under Virus & threat protection settings, click Manage settings.
  4. Scroll to Exclusions and click Add or remove exclusions.
  5. Click Add an exclusion → Folder, then add:
    %LOCALAPPDATA%\Ghost Claw V6
  6. Repeat for: %APPDATA%\com.ghostclaw.app.v5
  7. If Defender quarantined a file, go to Protection history → find the entry → Allow on device.
Norton 360 / Norton Antivirus
  1. Open Norton → Settings.
  2. Click Antivirus → Scans and Risks tab.
  3. Find Exclusions / Low Risks → Items to Exclude from Scans → Configure.
  4. Add the folder: %LOCALAPPDATA%\Ghost Claw V6
  5. Also add it under Items to Exclude from Auto-Protect, SONAR and Download Intelligence Detection.
  6. Click Apply and restart Ghost Claw.
McAfee Total Protection
  1. Open McAfee → PC Security.
  2. Click Real-Time Scanning → Excluded Files.
  3. Click Add file and select each .exe in %LOCALAPPDATA%\Ghost Claw V6 (the main app and each sidecar).
  4. Save and restart Ghost Claw.
Bitdefender
  1. Open Bitdefender → Protection panel.
  2. Click Antivirus → Settings tab → Manage Exceptions.
  3. Click + Add an Exception.
  4. Paste: %LOCALAPPDATA%\Ghost Claw V6 and select all protection features.
  5. Click Save and restart Ghost Claw.
Kaspersky
  1. Open Kaspersky → Settings (gear icon, bottom-left).
  2. Go to Security settings → Threats and Exclusions.
  3. Click Manage exclusions → Add.
  4. Browse to %LOCALAPPDATA%\Ghost Claw V6 and add the folder.
  5. Tick all Protection components and save.

SmartScreen ("Windows protected your PC")

If Windows shows a blue "Microsoft Defender SmartScreen prevented an unrecognized app from starting" dialog when you run the installer:

  1. Click More info.
  2. Click Run anyway.

SmartScreen reputation is per-publisher. As more people download and run Ghost Claw, the warning fades — but it'll likely appear for early adopters until we ship a code-signing certificate.

Reporting a false positive

If your antivirus is still blocking Ghost Claw, you can help us — and every other user with the same AV — by submitting a false-positive report. Each vendor has a form:

What we're doing about it

Code signing is on the roadmap. Once Ghost Claw is signed by a recognized certificate authority, AV engines and SmartScreen will trust it without exceptions. In the meantime, we're submitting false-positive reports to the major vendors with each release.

Contact

If your AV is blocking Ghost Claw and the steps above didn't help, email us at GhostClaw.team@gmail.com with your AV name, version, and (if possible) a screenshot of the warning.