What is Ground.exe?
Ground.exe is usually located in the 'c:\users\%USERNAME%\appdata\roaming\' folder.
Some of the anti-virus scanners at VirusTotal detected Ground.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Digital signatures [?]
Ground.exe is not signed.
VirusTotal report
49 of the 56 anti-virus programs at VirusTotal detected the Ground.exe file. That's a 88% detection rate.
| Scanner | Detection Name |
|---|---|
| Ad-Aware | Worm.Generic.377772 |
| Agnitum | Worm.Delf!Wx7rd8ORFOc |
| AhnLab-V3 | Win32/Unruy.534016 |
| ALYac | Worm.Generic.377772 |
| Antiy-AVL | Virus/Win32.Renamer.j |
| Arcabit | Worm.Generic.D5C3AC |
| Avast | Win32:Agent-AODJ [Trj] |
| AVG | Worm/Delf.KHX |
| Avira | W32/Tapin |
| AVware | Virus.Win32.Grenam.a (v) |
| Baidu-International | Virus.Win32.Renamer.j |
| BitDefender | Worm.Generic.377772 |
| Bkav | W32.FakeExeYHPtv.Worm |
| CAT-QuickHeal | W32.Grenam.A |
| ClamAV | WIN.Virus.Gnamer |
| Comodo | Worm.Win32.Delf.nj |
| Cyren | W32/Renamer.A.gen!Eldorado |
| DrWeb | Trojan.Inject1.28681 |
| Emsisoft | Worm.Generic.377772 (B) |
| ESET-NOD32 | Win32/Delf.NRJ |
| F-Prot | W32/Renamer.A.gen!Eldorado |
| F-Secure | Worm.Generic.377772 |
| Fortinet | W32/Renamer.BQT!tr |
| GData | Worm.Generic.377772 |
| Ikarus | Virus.Win32.Renamer |
| Jiangmin | Worm/Delf.yg |
| K7AntiVirus | Trojan ( 000c8b551 ) |
| K7GW | Trojan ( 000c8b551 ) |
| Kaspersky | Virus.Win32.Renamer.j |
| Kingsoft | Win32.Troj.Generic.(kcloud) |
| Malwarebytes | Trojan.Renamer.DF |
| McAfee | W32/Gnamer |
| McAfee-GW-Edition | BehavesLike.Win32.Dropper.hh |
| Microsoft | Virus:Win32/Grenam.A |
| MicroWorld-eScan | Worm.Generic.377772 |
| NANO-Antivirus | Trojan.Win32.Renamer.lnwkz |
| nProtect | Trojan/W32.Agent.534016.BS |
| Panda | Trj/Renamer.H |
| Qihoo-360 | Win32/Virus.afa |
| Rising | PE:Trojan.Win32.Generic.129D5E3F!312303167 |
| Sophos | W32/Renamer-K |
| Symantec | W32.Tapin |
| TheHacker | Trojan/Delf.nrj |
| TotalDefense | Win32/HLLO.Grenam.A |
| TrendMicro | TROJ_AGENT_005249.TOMB |
| TrendMicro-HouseCall | TROJ_AGENT_005249.TOMB |
| VBA32 | Worm.Delf |
| VIPRE | Virus.Win32.Grenam.a (v) |
| Zillya | Worm.Delf.Win32.869 |
Ground.exe removal instructions
The instructions below shows how to remove Ground.exe with help from the FreeFixer removal tool. Basically, you install FreeFixer, scan your computer, check the Ground.exe file for removal, restart your computer and scan it again to verify that Ground.exe has been successfully removed. Here are the removal instructions in more detail:
- Download and install FreeFixer: http://www.freefixer.com/download.html
- Start FreeFixer and press the Start Scan button. The scan will finish in approximately five minutes.
- When the scan is finished, locate Ground.exe in the scan result and tick the checkbox next to the Ground.exe file. Do not check any other file for removal unless you are 100% sure you want to delete it. Tip: Press CTRL-F to open up FreeFixer's search dialog to quickly locate Ground.exe in the scan result.
c:\users\%USERNAME%\appdata\roaming\Ground.exe 
- Scroll down to the bottom of the scan result and press the Fix button. FreeFixer will now delete the Ground.exe file.
- Restart your computer.
- Start FreeFixer and scan your computer again. If Ground.exe still remains in the scan result, proceed with the next step. If Ground.exe is gone from the scan result you're done.
- If Ground.exe still remains in the scan result, check its checkbox again in the scan result and click Fix.
- Restart your computer.
- Start FreeFixer and scan your computer again. Verify that Ground.exe no longer appear in the scan result.
Hashes [?]
| Property | Value |
|---|---|
| MD5 | e6977110d32b66dcef04d0ba9da12009 |
| SHA256 | 9d0ac16c9393c0acaa0deabe4dbbf4782f758e02f4034937f991cf1ec747c002 |
Error Messages
These are some of the error messages that can appear related to ground.exe:
ground.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
ground.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
ground.exe has stopped working.
End Program - ground.exe. This program is not responding.
ground.exe is not a valid Win32 application.
ground.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
What will you do with Ground.exe?
To help other users, please let us know what you will do with Ground.exe:
What did other users do?
The poll result listed below shows what users chose to do with Ground.exe. 95% have voted for removal. Based on votes from 59 users.
NOTE: Please do not use this poll as the only source of input to determine what you will do with Ground.exe.
Comments
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
Binary bijay writes
M start loosing my personal data even it start auto downloadng others virus and malware today one of my friend vopy a movie from my laptop turn out he found 90 malware after scanning pendrive what should i have to do
# 15 Jul 2016, 11:16
Virus info writes
But this virus also copies into Office. It also added text I'm sorry!!!! on the images
# 21 Mar 2026, 23:39
Virus info writes
The virus also damages every images. It also damages other image with full data but it blanks on downloaded files and hided bfsvc.exe and has gbfsvc. It infected other programs but shrinked icon resolution. I has seen it in computers but it infected. But it also writed 522 kb data but examples: bfsvc.exe as gbfsvc.ico and gbfsvc.exe, it also shrink icon on windows folders but it rewrites itself. It has some copies but it releaseds the virus. I told that is self-writing virus that damages Office files but it blackens dwm.exe on the screen, then it freezes in sometimes. I see the version with rounded play button icon but it is from unknown file but it is programs of office or openoffice but I does not know what program has that icon but it modified exe files into virus. It writes exe with its info and it retains half of exe file contents, it will infect windows files like wallpapers and bfsvc.exe. It also infects computer and then it black screens every month and every other days. It also has been found in some computers everywhere.
# 21 Mar 2026, 23:57
Virus info writes
In computer rooms, I found an secret, it has an play button icon, when run, it reopens. This is an stealthy malware. If i run this, this ruined system. This has regenerative. It also hides bfsvc.exe as added "g" suffix. This is coded by an unknown virus author in Europe (the continent of the creator). The creator is created it in 2020's, in 2010's, it is only rename, it also drops custom version of the I'm sorry. This text is pixelated, but it is the image adding, the EXE contains malicious image text, this text is very from an image. This virus affects system, but this virus needs removal.
# 31 May 2026, 20:29
Paulo writes