SPYW_GATOR.B

Category - Antivirus & Security | Printer-friendly version

SPYW_GATOR.B

This spyware program monitors the sites visited by the user and forwards the gathered data back to its home company's servers.

It is also capable of carrying out the following routines:

1. Send spam email (e.g. special offers) and other advertisements.
2. Open sites that are capable of modifying the Internet Explorer startup and search pages.

Alias: AdvWare.Gator

This spyware is a legal software and includes automatic uninstall feature. It runs on Windows 95, 98, ME, NT, 200, and XP.

Uninstalling the Spyware Program

This spyware has an uninstall feature that may be utilized to uninstall it from the system. You may also use the Add/Remove Programs feature found in the Control Panel, and uninstall this application.

Terminating the Spyware Program

This procedure terminates the running spyware process from memory. You will need the name(s) of the file(s) detected earlier.

1. Open Windows Task Manager.
On Windows 95/98/ME systems, press
CTRL+ALT+DELETE
On Windows NT/2000/XP systems, press
CTRL+SHIFT+ESC, then click the Processes tab.
2. In the list of running programs*, locate the spyware file or files detected earlier.
3. Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
4. Do the same for all detected spyware files in the list of running processes.
5. To check if the spyware process has been terminated, close Task Manager, and then open it again.
6. Close Task Manager.

*NOTE: On systems running Windows 95/98/ME, Task Manager may not show certain processes. You may use a third party process viewer to terminate the process. Otherwise, continue with the next procedure, noting additional instructions.

Removing Autostart Entries from the Registry

Removing autostart entries from registry prevents the spyware from executing during startup. In this procedure, you will need the name/s of the file/s detected earlier.

1. Open Registry Editor. Click Start>Run, type Regedit then hit Enter.
2. In the left panel, double click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry or entries whose data value is the spyware path and file name of the file/s detected earlier.
4. Close Registry Editor.

NOTE: If you were not able to terminate the spyware process from memory as described in the previous procedure, restart your system.

Removing Additional Entries from the Registry

1. Open Registry Editor. To do this, click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, delete the following keys:
HKEY_CLASSES_ROOT>CLSID>{21FFB6C0-0DA1-11D5-A9D5-
00500413153C}
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com
3. Close Registry Editor.

Removing Component Files

On Windows 9x/NT

1. Click Start>Find>Files and Folders.
2. In the Named input box, type: CMEII GMT
3. In the Look In drop-down list, select the drive which contains Windows, then press Enter.
4. Once located, delete the folders.

On Windows 2000/ME/XP

1. Click Start>Search>For Files and Folders.
2. In the Search for files and folders named input box, type:
CMEII GMT
3. In the Look In drop-down list, select the drive which contains Windows, then press Enter.
4. Once located, delete the folders.

Resetting Internet Explorer Homepage and Search Page

This procedure restores the Internet Explorer homepage and search page to the default settings.

1. Close all Internet Explorer windows.
2. Open Control Panel. Click Start>Settings>Control Panel.
3. Double-click the Internet Options icon.
4. In the Internet Properties window, click the Programs tab.
5. Click the “Reset Web Settings…” button.
6. Select “Also reset my home page.” Click Yes.
7. Click OK.

How To Test Your Firewall