Remove Gator

What is Gator ?

Gator is distributed by the company Claria (previously named Gator Advertising and Information Network), and is one of the earliest and most widespread spyware. It can help you fill out forms and remembers passwords.This software also occasionally displays pop up ads on your computer screen based on your online behavior similar to other GAIN softwares.GAIN tracks user browsing habits, downloads and displays undesirable commercial advertisements. Once executed, it creates several folders and files, drops infected objects in default system directory and modifies the registry, so that the threat runs on every Windows startup.

Gator variants

Gator/A covers all versions of Gator software before it became 'GAIN'. These old variants have not been researched, so the removal instructions here may not work for them. This is distributed with the 'Gator eWallet' program, an application used to fill in web forms. eWallet is now a separate program.

Gator/GAIN includes versions (3.1.x-4.0.x) of the current system, an independent adware network.

Gator/Trickler is an installer program which fetches Gator/GAIN gradually, using only a small part of the bandwidth available. GAIN is now distributed with all Gator.com applications, including eWallet and Precision Time/Date Manager. It is also widely bundled with third-party software, particularly peer-to-peer file-sharing programs.

Gator/PDP is an ActiveX control used to install Gator.com applications which bundle Gator/Trickler. When Gator software itself has started loading, the installer control is removed. It is installed as drive-by download on web pages, particularly hidden pop-ups. It is also known as IEGator or PDPPlugin, after its filename.

Gator behavior

Shows ads
StaysResident
Connects to the internet

Gator Removal Instructions:

These instructions are for Gator/GAIN. If the script has detected that you have a Gator/PDP and/or Gator/Trickler version, see 'Partial install removal'.

First go to Add/Remove Programs in the Control Panel and remove any Gator.com applications - Date Manager, Precision Time or Gator eWallet. (These will try to restart Gator/GAIN.) If you are lucky, Gator may actually uninstall by itself at this point. If so, skip the following paragraph.

Otherwise, open the registry (Start->Run->regedit) and find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Select it and, on the right hand side, right-click the 'CMESys' entry and click 'Delete'. In some earlier variants there might also be a 'GMT' entry; you can delete that one, too. Restart the computer and open the Common Files folder inside Program Files. Delete the 'CMEII' and 'GMT' folders.

If Gator was installed by Precision Time/Date Manager you may also have a 'WebPT' or 'WebDM' folder inside Program Files containing the Gator/Trickler program; this can also be deleted.

If you like, you can clean up by opening the registry and deleting the keys:

HKEY_CLASSES_ROOT\CLSID\
HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com
HKEY_LOCAL_MACHINE\SOFTWARE\GatorTest
Partial install removal
For Gator/PDP, open the Downloaded Program Files folder (inside the Windows folder). The Gator/PDP control is called 'PdpPlg Class' in version 4094, 'PdpPi Class' in version 5094, and 'DFRun Class' in other versions. Right-click this entry and choose 'Remove'. Check that no Gator/Trickler instance is loaded.

For Gator/Trickler, open the registry (Start->Run->regedit) and choose the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. On the right-hand side, look for an entry whose filename contains 'trickler' or sometimes 'fsg_'.

Note the full filename so that, after restarting the computer, you can come back and delete it.

Gator Removal