Page 1 of 2 12>
Topic Options
#66716 - 2002-06-11 09:57 PM Removal of Comet Cursor and Gator
Kdyer Offline
KiX Supporter
*****

Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
Anybody have any automated or background way to remove these?

I know that Ad-aware will pull keys/files from the systems, but you have to initiate a scan to do so.

Thanks,

Kent
_________________________
Utilize these resources:
UDFs (Full List)
KiXtart FAQ & How to's

Top
#66717 - 2002-06-11 10:03 PM Re: Removal of Comet Cursor and Gator
Radimus Moderator Offline
Moderator
*****

Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
http://www.pchell.com/support/gator.shtml
_________________________
How to ask questions the smart way <-----------> Before you ask

Top
#66718 - 2002-06-11 10:05 PM Re: Removal of Comet Cursor and Gator
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
mm...

I've done by removing comets files.
this way it has gone away.

don't remember what other things needed, but...
_________________________
!

download KiXnet

Top
#66719 - 2002-06-11 10:09 PM Re: Removal of Comet Cursor and Gator
Radimus Moderator Offline
Moderator
*****

Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
http://cexx.org/gator.htm

Gator GAIN (GMT.exe, CMESys.exe, GAIN_TRICKLER_*.EXE) - Pops up advertising, apparently a new Gator product. A security hole in some versions allows Web sites to install arbitrary software on your computer. This URL will detect GAIN. Gator recommends on its Web site to contact support@gator.com for removal instructions. Gator software may be quietly installed by drive-by download.

[ 11 June 2002, 22:11: Message edited by: Radimus ]
_________________________
How to ask questions the smart way <-----------> Before you ask

Top
#66720 - 2002-06-11 10:12 PM Re: Removal of Comet Cursor and Gator
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
radimus,
good, I did the same to gator too!
it's pain in the hole which name I may not bronounce in here.
_________________________
!

download KiXnet

Top
#66721 - 2002-06-11 10:16 PM Re: Removal of Comet Cursor and Gator
Radimus Moderator Offline
Moderator
*****

Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
http://bbspot.com/News/2001/08/gator.html
_________________________
How to ask questions the smart way <-----------> Before you ask

Top
#66722 - 2002-06-11 10:23 PM Re: Removal of Comet Cursor and Gator
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
I actually missed the last part of the topic of the thread...

time to go to bed?

this part was really nice:
quote:
Mr. Quillin continued, "We also take exception to the reports that Gator is difficult to uninstall. We list in our readme.txt file the simple steps required to remove the program. The first step requires a program called fdisk which every user has on their computer system."
_________________________
!

download KiXnet

Top
#66723 - 2002-06-11 10:28 PM Re: Removal of Comet Cursor and Gator
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
just came to my mind.
there is not even one installation found on our corp. lan.

so hard enough firewalling in nat tables seems to keep these out.
_________________________
!

download KiXnet

Top
#66724 - 2002-06-13 07:56 PM Re: Removal of Comet Cursor and Gator
Kdyer Offline
KiX Supporter
*****

Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
Spent some time on this..

What do you think of this?

Thanks go out to Doc on this..

code:
 ;Well...

;Kinda close..

;I am getting the following error message
;C:\Program Files\Gator.com\OFFERC~1 - The process cannot access the file because
; it is being used by another process.
; -- Author: Kent Dyer
; -- Date: 13 June 2002
; -- Thanks DOC for the inspiration!
; -- Ref. - http://kixtart.org/board/ultimatebb.php?ubb=get_topic;f=2;t=003427
BREAK ON
CLS
;Block Gator
;REF - http://www.winguides.com/registry/display.php/1014/
$Domainblock = "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains"
IF 1 <> keyexist($Domainblock+"\gator.com")
$RC = addkey($Domainblock+"\gator.com")
$RC = writevalue($Domainblock+"\gator.com","*",4,"REG_DWORD")
$RC = addkey($Domainblock+"\gatoradvertisinginformationnetwork.com")
$RC = writevalue($Domainblock+"\www.gatoradvertisinginformationnetwork.com","*",4,"REG_DWORD")
$RC = addkey($Domainblock+"\www.offercompanion.com")
$RC = writevalue($Domainblock+"\www.offercompanion.com","*",4,"REG_DWORD")
ENDIF
IF 1 = keyexist("HKLM\SOFTWARE\Gator.com")

;Process - GATOR.EXE
;Process - CMESys.exe
;Process - GMT.exe

;First, we want to terminate Gator and related apps
$gator = "GATOR.EXE"
$cmesys = "CMESys.exe"
$gmt = "GMT.exe"

$appl = Split("$GATOR~~$CMESYS~~$GMT", "~~")

;FOR EACH $element IN $appl
; FOR EACH $process IN GetObject("winmgmts:{impersonationLevel=impersonate}").execquery("select * from Win32_Process where Name='$appl'")
; $rc = $process.terminate
; NEXT
;NEXT
FOR EACH $process IN GetObject("winmgmts:{impersonationLevel=impersonate}").execquery("select * from Win32_Process where Name='$gator'")
$rc = $process.terminate
NEXT
;--
FOR EACH $process IN GetObject("winmgmts:{impersonationLevel=impersonate}").execquery("select * from Win32_Process where Name='$cmesys'")
$rc = $process.terminate
NEXT
;--
FOR EACH $process IN GetObject("winmgmts:{impersonationLevel=impersonate}").execquery("select * from Win32_Process where Name='$gmt'")
$rc = $process.terminate
NEXT

;Let's remove some folders
$gmt = Readvalue("HKLM\SOFTWARE\Gator.com\Gator\dyn","AppPath")
$cmesysii = Readvalue("HKLM\SOFTWARE\Gator.com\CMEII","AppPath")
?$cmesysii ; -- Current path..
;Let's do some trimming
$lcmesysii = Len($cmesysii) ; - Length of AppPath
;$Lcmesysii + " Length of AppPath"
$lcmesys = Len($cmesys) ; -- Length of CMESys.exe
;?$Lcmesys + " Length of CMESys.exe"
$nlen = $lcmesysii - $lcmesys
;$nlen + " New length"
$cmesysiipath= SUBSTR( $cmesysii, 1, $nlen-1 )
;?$cmesysiipath

;Find Gator on the system
$gator = Readvalue("HKLM\SOFTWARE\Gator.com\AppInfo\Gator","lockfiles")
;C:\Program Files\Gator.com\Gator\Gator.exe
$offset = INSTR( $gator, ".com" ) ;Determine position
?$offset
$gatorpath= SUBSTR( $gator, 1, $offset+3 )
?$gatorpath

$gatorpath = "C:\Program Files\Gator.com"

;Determine path to Start menu

; I know this different for Win9x..
$startmenu = READVALUE("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","Common Programs")
;C:\Documents and Settings\All Users\Start Menu\Programs\GAIN
;C:\Documents and Settings\All Users\Start Menu\Programs\Gator eWallet
;C:\Documents and Settings\All Users\Start Menu\Programs\OfferCompanion

; -- Take the Read-only attributes off the directories
;;$RC = SETFileAttr("$Startmenu\GAIN\",128)
;;?$RC
;;$RC= SETFileAttr("$Startmenu\Gator eWallet\",128)
;;?$RC
;;$RC= SETFileAttr("$Startmenu\OfferCompanion\",128)
;;?$RC

;gETS $K
IF @inwin=1
; -- Pull the read-only flags from the folders
;$attrgator=SHELL'%comspec% /c ATTRIB -R $gatorpath /S /D '
;$attrgmt=SHELL'%comspec% /c ATTRIB -R $gmt /S /D '
;$attrcmesysii=SHELL'%comspec% /c ATTRIB -R $cmesysiipath /S /D '
;$attrgain=SHELL'%comspec% /c ATTRIB -R $Startmenu\GAIN /S /D '
;$attrewallet=SHELL'%comspec% /c ATTRIB -R $Startmenu\Gator eWallet /S /D '
;$attroffer=SHELL'%comspec% /c ATTRIB -R $Startmenu\OfferCompanion /S /D '

SHELL '%comspec% /c RD /S /Q "$gatorpath"'
SHELL '%comspec% /c RD /S /Q "$gmt"'
SHELL '%comspec% /c RD /S /Q "$cmesysiipath"'
SHELL '%comspec% /c RD /S /Q "$Startmenu\GAIN"'
SHELL '%comspec% /c RD /S /Q "$Startmenu\Gator eWallet"'
SHELL '%comspec% /c RD /S /Q "$Startmenu\OfferCompanion"'
ELSE
SHELL '%comspec% /c %WINDIR%\COMMAND\DELTREE /Y $gatorpath'
SHELL '%comspec% /c %WINDIR%\COMMAND\DELTREE /Y $gmt'
SHELL '%comspec% /c %WINDIR%\COMMAND\DELTREE /Y $cmesysiipath'
SHELL'%comspec% /c %WINDIR%\COMMAND\DELTREE /Y $Startmenu\GAIN'
SHELL'%comspec% /c %WINDIR%\COMMAND\DELTREE /Y $Startmenu\Gator eWallet'
SHELL'%comspec% /c %WINDIR%\COMMAND\DELTREE /Y $Startmenu\OfferCompanion'
ENDIF

;Let's remove Keys from the registry
$rc = DELTREE("HKLM\SOFTWARE\Gator.com")
$rc = DELTREE("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{456BA350-947F-4406-B091-AA1C6678EBE7}")
$rc = DELTREE("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C8DBEC0-8052-11d5-A9D5-00500413153C}")

$index = 0
:loop1
$keyname = ENUMKEY("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\", $index)
IF @error = 0
; ? "Name found: $KeyName"
IF instr($keyname,"gator")
$rc = DELTREE($keyname)
ENDIF
$index = $index + 1
GOTO Loop1
ENDIF

;;$RC = DELTREE("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/IEGator.dll\.Owner")

?"Process is complete"
RETURN
ELSE
RETURN ; -- Gator does not exist or has been removed
ENDIF

Thanks,

Kent

[ 13 June 2002, 20:41: Message edited by: kdyer ]
_________________________
Utilize these resources:
UDFs (Full List)
KiXtart FAQ & How to's

Top
#66725 - 2002-06-13 08:14 PM Re: Removal of Comet Cursor and Gator
Radimus Moderator Offline
Moderator
*****

Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
in the addkey/writevalue section, the writevalue() are missing a parameter
_________________________
How to ask questions the smart way <-----------> Before you ask

Top
#66726 - 2002-06-13 08:42 PM Re: Removal of Comet Cursor and Gator
Kdyer Offline
KiX Supporter
*****

Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
Doh!

Fixed..

Kent
_________________________
Utilize these resources:
UDFs (Full List)
KiXtart FAQ & How to's

Top
#66727 - 2002-06-13 09:14 PM Re: Removal of Comet Cursor and Gator
Kdyer Offline
KiX Supporter
*****

Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
Thinking about this with regard to - http://www.winguides.com/registry/display.php/1014/ ..

www.gatoradvertisinginformationnetwork.com

We maybe able to change to - gatoradvertisinginformationnetwork.com
Since the restriction is for *

www.offercompanion.com

Again, we maybe able to change to - offercompanion.com
Since the restriction is for *

Cheers!

Kent
_________________________
Utilize these resources:
UDFs (Full List)
KiXtart FAQ & How to's

Top
#66728 - 2002-06-13 09:23 PM Re: Removal of Comet Cursor and Gator
Radimus Moderator Offline
Moderator
*****

Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
I hate to leave a good thing alone... I'm still waiting for gator to send me 'removal' instructions... not just uninstall instructions

Till then (untested, and based on kent's code)
code:
$HKCUSMWCV   = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion"
$HKLMSMWCV = "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion"
$Domainblock = "$HKLMSMWCV\Internet Settings\ZoneMap\Domains"

IF not KEYEXIST("$Domainblock\gator.com")
regwrite("$Domainblock\gator.com","*",4,"REG_DWORD")
regwrite("$Domainblock\gatoradvertisinginformationnetwork.com","*",4,"REG_DWORD")
regwrite("$Domainblock\offercompanion.com","*",4,"REG_DWORD")
endif
IF keyexist("HKEY_LOCAL_MACHINE\Software\Gator.com")
$gatorproc="GATOR.EXE","CMESYS.EXE","GMT.EXE"
for each $app in $gatorproc
Endproc("@wksta",$app)
next

endif

$gatordir=""
$gaindir =""
$offerdir=""
$rc = DELDIR("$gatordir")
$rc = DELDIR("$gaindir")
$rc = DELDIR("$offerdir")

if @inwin=1
$startmenu=readvalue("$HKCUSMWCV\Explorer\Shell Folders","Start Menu")
$rc = DELDIR("$startmenu\GAIN")
$rc = DELDIR("$startmenu\Gator eWallet")
$rc = DELDIR("$startmenu\OfferCompanion")
endif
$startmenu=readvalue("$HKLMSMWCV\Explorer\User Shell Folders","Common Start Menu")
$rc = DELDIR("$startmenu\GAIN")
$rc = DELDIR("$startmenu\Gator eWallet")
$rc = DELDIR("$startmenu\OfferCompanion")

$rc = DELTREE("HKEY_LOCAL_MACHINE\Software\Gator.com")
$rc = DELTREE("$HKLMSMWCV\Uninstall\{456BA350-947F-4406-B091-AA1C6678EBE7}")
$rc = DELTREE("$HKLMSMWCV\Uninstall\{6C8DBEC0-8052-11d5-A9D5-00500413153C}")

:loop1
$keyname = ENUMKEY("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\", $index)
IF not @error
IF instr($keyname,"gator") $rc = DELTREE($keyname) ENDIF
$index = $index + 1
GOTO Loop1
ENDIF

;**********************************************************************************************
Function regwrite($key,$value,$data,optional $type)
DIM $keyarray,$keypath,$loop,$rc
if not $type $type="REG_SZ" endif
$keyarray=split("$key","\")
for $loop=0 to ubound($keyarray)
$keypath=$keypath+$keyarray[$loop]+"\"
if not KEYEXIST("$keypath") $rc=addkey("$keypath") endif
next
if KEYEXIST("$key") $rc=writevalue("$key","$value","$data",$type) endif
endfunction

FUNCTION ENDPROC($COMPUTER,$PROC)
dim $GetObject, $Select
$GetObject="winmgmts:{impersonationLevel=impersonate}!//$COMPUTER"
$select="select * from Win32_Process where Name='$PROC'"
For each $Process in GetObject("$GetObject").ExecQuery("$select")
$Process.Terminate
Next
ENDFUNCTION

Function DelDir($Pathname)
Dim $Filename
$Filename = Dir($Pathname + "\*.*")
While $Filename <> "" And @ERROR = 0
If $Filename <> "." And $Filename <> ".."
If (GetFileAttr($Pathname + "\" + $Filename) & 16)
DelDir($Pathname + "\" + $Filename)
SetFileAttr($Pathname + "\" + $Filename, 128)
Rd ($Pathname + "\" + $Filename)
Else
SetFileAttr($Pathname + "\" + $Filename, 128)
Del ($Pathname + "\" + $Filename)
EndIf
EndIf
$Filename = Dir()
Loop
EndFunction



[ 14 June 2002, 00:42: Message edited by: Radimus ]
_________________________
How to ask questions the smart way <-----------> Before you ask

Top
#66729 - 2002-06-13 11:13 PM Re: Removal of Comet Cursor and Gator
Radimus Moderator Offline
Moderator
*****

Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
lookie, Gator wrote back...
quote:

Apparently you do not understand, I am not walking around to 2000 PCs every day and going to add/remove programs and looking to see if they got hit with something while surfing.

What files does Gain, gator, etc install.
Where are they located?
What registry entries do these programs create?

I do not need you to recite your help file... I need your programmers.

Additionally, what networks(internet domains) do your software programs communicate to



-----Original Message-----
From: support@gator.com [mailto:support@gator.com]
Sent: Thursday, June 13, 2002 5:17 PM
To:
Subject: RE: need to remove all traces of all versions of gator software [#5588504]

Conrad,

You should be able to easily remove the program(s) by using the Windows Add/Remove Programs Control Panel.

To access the Add/Remove Programs Control Panel, follow these steps,

From the Windows Start button, select Settings, and then Control Panel.

When the Control Panel window opens, double-click on the Add/Remove Programs icon.

Locate the program you wish to uninstall in the list of installed programs, click on it one time, and then click on the Add/Remove button.

Follow the on screen instructions, when the uninstall program has completed, close all open windows.

*Note, we also distribute GAIN-supported software applications, or GAINware. If you have GAINware on your computer, viewing the following link, while your computer is connected to the Internet, may be helpful to you:
http://www.gatoradvertisinginformationnetwork.com/about-gain.html.

This link is a new GAINware feature that will trigger the display of a window that will list all of our software, and third party GAIN-supported software, that may be installed on the computer that you are on at the time you use this link. The window will also provide instructions for the removal of all such software. So long as any such software is installed on the computer, The Gator Corporation will be capable of delivering highly relevant GAIN branded popup advertisements based on web sites viewed. A few minutes after all such software has been uninstalled (via Windows Add/Remove Programs), the software module responsible for the delivery of advertising will self-delete.

Bob

------- Original Message --------
From:
To: support@gator.com
Subject: RE: need to remove all traces of all versions of gator software [#5588504]
Date: 06/13/02 10:30:32

Basically, I need all of them. Security policies on the LAN require ALL
spy-ware, adware, tracking, etc that could in any way send any data OUT of
our network or log user activity.

Specifically, trickler as it comes with webshots, but there are bound to be
others. And offer companion. Therefore I need them all.

It isn't specifically against gator, as IM software is getting banned, as
well as webshots, comet-cursor, cydoor, etc.

<<...OLE_Obj...>>

-----Original Message-----
From: support@gator.com [mailto:support@gator.com]
Sent: Tuesday, June 11, 2002 5:04 PM
To:
Subject: need to remove all traces of all versions of gator software
[#5588504]

Conrad;

Which of our program(s) do you have; Gator eWallet, OfferCompanion, Date
Manager, Precision Time, etc.?

Also, do you have a 3rd party GAIN supported application?

To view a list of products that are part of GAIN and installed on the
computer you are currently using, you can go to:

http://www.gatoradvertisinginformationnetwork.com/about-gain.html

Rex
Gator Corp.

------- Original Message --------
From:
To: support@gator.com
Subject: need to remove all traces of all versions of gator software
Date: 06/11/02 13:51:58

conrad wheeler wrote:
I need the reg keys, dlls, exes, and such to safely remove gator, tricker,
gain, etc from the State governments network/computers.

the uninstaller is not an option...

Operating System: win_2000
Browser: ie_6
Gator eWallet version number: Unknown
Problem: install_uninstall


_________________________
How to ask questions the smart way <-----------> Before you ask

Top
#66730 - 2002-06-13 11:24 PM Re: Removal of Comet Cursor and Gator
Kdyer Offline
KiX Supporter
*****

Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
Rad,

Thanks for the clean up on this and it looks awesome!

A comment:

http://www.winguides.com/registry/display.php/1014/ shows us that we need to use a * and not a "" as that would only show a @ or default value..
quote:

regwrite("$Domainblock\gator.com","*",4,"REG_DWORD")
regwrite("$Domainblock\gatoradvertisinginformationnetwork.com","*",4,"REG_DWORD")
regwrite("$Domainblock\offercompanion.com","*",4,"REG_DWORD")

I maybe wrong on this.

Thanks,

Kent
_________________________
Utilize these resources:
UDFs (Full List)
KiXtart FAQ & How to's

Top
#66731 - 2002-06-13 11:32 PM Re: Removal of Comet Cursor and Gator
Kdyer Offline
KiX Supporter
*****

Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
Rad,

The information that I was able to get was both from Ad-Aware and my copying and comparing reg keys..

Interesting info from Gator..

Kent
_________________________
Utilize these resources:
UDFs (Full List)
KiXtart FAQ & How to's

Top
#66732 - 2002-06-14 12:31 AM Re: Removal of Comet Cursor and Gator
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11628
Loc: CA
So Kent, does either your code or Rad's code completely remove the application?

Update please when you get a chance.

Top
#66733 - 2002-06-14 12:40 AM Re: Removal of Comet Cursor and Gator
Radimus Moderator Offline
Moderator
*****

Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
mine doesn't delete the installation directory, as I don't have the default dirs.

I also haven't tested it. Tomorrow I'll start remote scanning my LAN looking for a gator process.

I was hoping the gator would have actually provided real data ( i know, hope in one hand ...)
_________________________
How to ask questions the smart way <-----------> Before you ask

Top
#66734 - 2002-06-14 05:51 AM Re: Removal of Comet Cursor and Gator
Kdyer Offline
KiX Supporter
*****

Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
Doc,

When I did run it, GATOR was removed with the exception of:

quote:

C:\Program Files\Gator.com\OFFERC~1 - The process cannot access the file because it is being used by another process.

However, when I went in a looked for files under - C:\PROGRAM FILES\GATOR.COM the Offer Companion folder was there, but no files.

Kinda wierd..

(1) We terminate all processes setup by Gator.
(2) We determine where Gator is installed.
(3) Upon determination of where Gator is installed, we delete the folders and the Start Menu Folders.
(4) We then remove the Registry info.

Hmmm... Does this mean we have to force restart and then on restart, it pulls the folder?

Thanks!

Kent
_________________________
Utilize these resources:
UDFs (Full List)
KiXtart FAQ & How to's

Top
#66735 - 2002-06-14 05:54 AM Re: Removal of Comet Cursor and Gator
Lonkero Administrator Offline
KiX Master Guru
*****

Registered: 2001-06-05
Posts: 22346
Loc: OK
really seems that running process has oplocked that folder.
maybe not for...
what about runonce-key?
_________________________
!

download KiXnet

Top
Page 1 of 2 12>


Moderator:  Glenn Barnas, NTDOC, Arend_, Jochen, Radimus, Allen, ShaneEP, Ruud van Velsen, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 657 anonymous users online.
Newest Members
M_Moore, BeeEm, min_seow, Audio, Hoschi
17883 Registered Users

Generated in 0.083 seconds in which 0.036 seconds were spent on a total of 13 queries. Zlib compression enabled.

Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org