Virus Ground.exe

 Ground.exe is a notoriously frustrating piece of malware. It behaves like a file-infecting companion virus. Once it gets into a computer, it copies itself into the background (usually in the AppData\Roaming folder), modifies startup registries, and actively renames standard executable files by prepending a "g" to their name (e.g., hiding the real chrome.exe and creating a malicious gchrome.exe or Ground.exe).  

YouTube

+ 1

Because it continually reinfects active processes, simply right-clicking "Delete" or ending the task normally will not work—it will just regenerate on the next boot.  

Reddit

To vanish Ground.exe permanently from Windows 7, a systematic, isolated approach must be taken.

Step 1: Isolate the Machine & Boot into Safe Mode

Because the virus actively spreads and regenerates via running Windows processes, its main execution path must be cut off.

Disconnect from the Internet: Unplug the Ethernet cable or disconnect from Wi-Fi immediately to prevent the virus from communicating with a command server.

Restart into Safe Mode:

Shut down your computer completely.

Turn it back on and immediately start tapping the F8 key repeatedly before the Windows 7 logo appears.  

2-Spyware.com

In the Advanced Boot Options menu that pops up, use the arrow keys to select Safe Mode with Networking and press Enter.  

2-Spyware.com

Step 2: Terminate and Unhide the Core Virus Files

Once inside Safe Mode, standard background tasks are suppressed, allowing you to intercept the virus source.

Expose Hidden Files:

Open any folder, click on Organize (top left), and select Folder and search options.

Go to the View tab.

Select "Show hidden files, folders, and drives".

Uncheck "Hide protected operating system files (Recommended)". Click Apply and OK.

Clean Registry Startup Keys:

Press Windows Key + R, type regedit, and hit Enter.

Navigate to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Look at the data fields on the right. If you see any entries linking to Ground.exe or random strings executing out of AppData, right-click and Delete them.

Repeat this check in: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Wipe Temporary Directories:

Press Windows Key + R, type %appdata%, and press Enter. Look for Ground.exe or any strange folders created around the time of infection and shift-delete them.  

2-Spyware.com

Do the same by opening Windows Key + R and clearing out %temp% and %localappdata%.

Step 3: Run Targeted Remediation Scanners

A normal system file check cannot fix companion viruses because they physically replicate across your software ecosystem. You need aggressive signature scanners to clean the remaining instances.

Since you are in Safe Mode with Networking, you can download these clean diagnostic tools:

Run Malwarebytes AdwCleaner: Download and run a scan via AdwCleaner. It specializes in knocking out persistent baseline adware and background browser hijackers that drop files like Ground.exe.

Run Malwarebytes Anti-Malware (Full Scan): Open Malwarebytes, navigate to Settings > Security, and ensure "Scan for rootkits" is turned on. Run a comprehensive scan. Delete everything it quarantines.  

YouTube

Kaspersky Virus Removal Tool (KVRT): If the file reinfection loop persists, download the free Kaspersky Virus Removal Tool. It runs completely without installation and is highly effective at catching companion/file-infecting payloads that alter standard .exe files.

Step 4: Fix Your Altered Executables (The "g" Files)

Once the main Ground.exe engine is deleted, you may notice that some applications fail to launch or their icons appear transparent. This happens because the virus renamed your actual apps to hidden names starting with a g (e.g., gchrome.exe or gspotify.exe).  

GitHub

Go to the installation directory of any broken application (e.g., C:\Program Files\).

Look for the hidden executable files starting with g.

If the scanner did not delete the decoy file, delete the fake, infected file (usually labeled the original application name).

Rename the healthy g file back to its normal name (e.g., change gchrome.exe back to chrome.exe).

(Alternatively, simply uninstalling the broken apps and doing a fresh download/reinstall will completely clear out the corrupted remnants).  

GitHub

Important Security Note for Windows 7

Windows 7 officially reached its End of Life (EOL) years ago, meaning it no longer receives security updates or patches from Microsoft. This makes the operating system highly vulnerable to modern file-injectors, rootkits, and execution exploits like Ground.exe. If your hardware supports it, it is strongly recommended to back up your critical data onto an external drive and upgrade the machine to a newer, securely supported operating system.