← Back to Ghost Claw

Antivirus & SmartScreen Help

Last updated: April 29, 2026

Short version: Ghost Claw is currently distributed without a code signing certificate, so Windows SmartScreen and some antivirus tools may flag the installer or sidecar processes on first run. This is a false positive. We're working on code signing so this stops happening.

Why this happens

Ghost Claw ships as a Windows installer plus several small sidecar processes — one for WhatsApp messaging, one for window control, one for text-to-speech, one for screen context, one for a local voice synthesizer. Each is a separate .exe file that runs in the background.

Antivirus engines flag executables based on three signals:

  1. Code signature. Ghost Claw is currently unsigned. Signed executables get the benefit of the doubt; unsigned ones get scrutinized.
  2. Publisher reputation. Brand-new publishers have zero reputation. Reputation builds as more users download and run the software successfully.
  3. Behavioral heuristics. The window-control sidecar uses Win32 APIs to move and resize windows, which on the surface looks like the kind of thing remote-access malware does. It isn't — but a heuristic engine can't tell.

Combine "unsigned + new publisher + system-control behavior" and you get false positives. Ghost Claw does not contain malware. The full source is in our public repository; you can audit every line.

What to do — by antivirus vendor

Avast / AVG
  1. Open Avast → Menu (top-right) → Settings.
  2. Go to General → Exceptions.
  3. Click Add Exception and add this folder:
    %LOCALAPPDATA%\Ghost Claw V5
  4. Also add: %APPDATA%\com.ghostclaw.app.v5 (Ghost Claw's data folder).
  5. Click Add Exception and confirm. Restart Ghost Claw.

If Avast already quarantined a file, go to Protection → Virus Chest, find the Ghost Claw entry, and choose Restore and add exception.

Microsoft Defender (built into Windows)
  1. Open Windows Security (search the Start menu).
  2. Click Virus & threat protection.
  3. Under Virus & threat protection settings, click Manage settings.
  4. Scroll to Exclusions and click Add or remove exclusions.
  5. Click Add an exclusion → Folder, then add:
    %LOCALAPPDATA%\Ghost Claw V5
  6. Repeat for: %APPDATA%\com.ghostclaw.app.v5
  7. If Defender quarantined a file, go to Protection history → find the entry → Allow on device.
Norton 360 / Norton Antivirus
  1. Open Norton → Settings.
  2. Click Antivirus → Scans and Risks tab.
  3. Find Exclusions / Low Risks → Items to Exclude from Scans → Configure.
  4. Add the folder: %LOCALAPPDATA%\Ghost Claw V5
  5. Also add it under Items to Exclude from Auto-Protect, SONAR and Download Intelligence Detection.
  6. Click Apply and restart Ghost Claw.
McAfee Total Protection
  1. Open McAfee → PC Security.
  2. Click Real-Time Scanning → Excluded Files.
  3. Click Add file and select each .exe in %LOCALAPPDATA%\Ghost Claw V5 (the main app and each sidecar).
  4. Save and restart Ghost Claw.
Bitdefender
  1. Open Bitdefender → Protection panel.
  2. Click Antivirus → Settings tab → Manage Exceptions.
  3. Click + Add an Exception.
  4. Paste: %LOCALAPPDATA%\Ghost Claw V5 and select all protection features.
  5. Click Save and restart Ghost Claw.
Kaspersky
  1. Open Kaspersky → Settings (gear icon, bottom-left).
  2. Go to Security settings → Threats and Exclusions.
  3. Click Manage exclusions → Add.
  4. Browse to %LOCALAPPDATA%\Ghost Claw V5 and add the folder.
  5. Tick all Protection components and save.

SmartScreen ("Windows protected your PC")

If Windows shows a blue "Microsoft Defender SmartScreen prevented an unrecognized app from starting" dialog when you run the installer:

  1. Click More info.
  2. Click Run anyway.

SmartScreen reputation is per-publisher. As more people download and run Ghost Claw, the warning fades — but it'll likely appear for early adopters until we ship a code-signing certificate.

Reporting a false positive

If your antivirus is still blocking Ghost Claw, you can help us — and every other user with the same AV — by submitting a false-positive report. Each vendor has a form:

What we're doing about it

Code signing is on the roadmap. Once Ghost Claw is signed by a recognized certificate authority, AV engines and SmartScreen will trust it without exceptions. In the meantime, we're submitting false-positive reports to the major vendors with each release.

Contact

If your AV is blocking Ghost Claw and the steps above didn't help, email us at GhostClaw.team@gmail.com with your AV name, version, and (if possible) a screenshot of the warning.