#66716 - 2002-06-11 09:57 PM
Removal of Comet Cursor and Gator
|
Kdyer
KiX Supporter
   
Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
|
Anybody have any automated or background way to remove these?
I know that Ad-aware will pull keys/files from the systems, but you have to initiate a scan to do so.
Thanks,
Kent
|
|
Top
|
|
|
|
#66717 - 2002-06-11 10:03 PM
Re: Removal of Comet Cursor and Gator
|
Radimus
Moderator
   
Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
|
|
|
Top
|
|
|
|
#66719 - 2002-06-11 10:09 PM
Re: Removal of Comet Cursor and Gator
|
Radimus
Moderator
   
Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
|
http://cexx.org/gator.htm
Gator GAIN (GMT.exe, CMESys.exe, GAIN_TRICKLER_*.EXE) - Pops up advertising, apparently a new Gator product. A security hole in some versions allows Web sites to install arbitrary software on your computer. This URL will detect GAIN. Gator recommends on its Web site to contact support@gator.com for removal instructions. Gator software may be quietly installed by drive-by download. [ 11 June 2002, 22:11: Message edited by: Radimus ]
|
|
Top
|
|
|
|
#66721 - 2002-06-11 10:16 PM
Re: Removal of Comet Cursor and Gator
|
Radimus
Moderator
   
Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
|
|
|
Top
|
|
|
|
#66724 - 2002-06-13 07:56 PM
Re: Removal of Comet Cursor and Gator
|
Kdyer
KiX Supporter
   
Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
|
Spent some time on this..
What do you think of this?
Thanks go out to Doc on this..
code:
;Well...
;Kinda close..
;I am getting the following error message ;C:\Program Files\Gator.com\OFFERC~1 - The process cannot access the file because ; it is being used by another process. ; -- Author: Kent Dyer ; -- Date: 13 June 2002 ; -- Thanks DOC for the inspiration! ; -- Ref. - http://kixtart.org/board/ultimatebb.php?ubb=get_topic;f=2;t=003427 BREAK ON CLS ;Block Gator ;REF - http://www.winguides.com/registry/display.php/1014/ $Domainblock = "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains" IF 1 <> keyexist($Domainblock+"\gator.com") $RC = addkey($Domainblock+"\gator.com") $RC = writevalue($Domainblock+"\gator.com","*",4,"REG_DWORD") $RC = addkey($Domainblock+"\gatoradvertisinginformationnetwork.com") $RC = writevalue($Domainblock+"\www.gatoradvertisinginformationnetwork.com","*",4,"REG_DWORD") $RC = addkey($Domainblock+"\www.offercompanion.com") $RC = writevalue($Domainblock+"\www.offercompanion.com","*",4,"REG_DWORD") ENDIF IF 1 = keyexist("HKLM\SOFTWARE\Gator.com")
;Process - GATOR.EXE ;Process - CMESys.exe ;Process - GMT.exe
;First, we want to terminate Gator and related apps $gator = "GATOR.EXE" $cmesys = "CMESys.exe" $gmt = "GMT.exe"
$appl = Split("$GATOR~~$CMESYS~~$GMT", "~~")
;FOR EACH $element IN $appl ; FOR EACH $process IN GetObject("winmgmts:{impersonationLevel=impersonate}").execquery("select * from Win32_Process where Name='$appl'") ; $rc = $process.terminate ; NEXT ;NEXT FOR EACH $process IN GetObject("winmgmts:{impersonationLevel=impersonate}").execquery("select * from Win32_Process where Name='$gator'") $rc = $process.terminate NEXT ;-- FOR EACH $process IN GetObject("winmgmts:{impersonationLevel=impersonate}").execquery("select * from Win32_Process where Name='$cmesys'") $rc = $process.terminate NEXT ;-- FOR EACH $process IN GetObject("winmgmts:{impersonationLevel=impersonate}").execquery("select * from Win32_Process where Name='$gmt'") $rc = $process.terminate NEXT
;Let's remove some folders $gmt = Readvalue("HKLM\SOFTWARE\Gator.com\Gator\dyn","AppPath") $cmesysii = Readvalue("HKLM\SOFTWARE\Gator.com\CMEII","AppPath") ?$cmesysii ; -- Current path.. ;Let's do some trimming $lcmesysii = Len($cmesysii) ; - Length of AppPath ;$Lcmesysii + " Length of AppPath" $lcmesys = Len($cmesys) ; -- Length of CMESys.exe ;?$Lcmesys + " Length of CMESys.exe" $nlen = $lcmesysii - $lcmesys ;$nlen + " New length" $cmesysiipath= SUBSTR( $cmesysii, 1, $nlen-1 ) ;?$cmesysiipath
;Find Gator on the system $gator = Readvalue("HKLM\SOFTWARE\Gator.com\AppInfo\Gator","lockfiles") ;C:\Program Files\Gator.com\Gator\Gator.exe $offset = INSTR( $gator, ".com" ) ;Determine position ?$offset $gatorpath= SUBSTR( $gator, 1, $offset+3 ) ?$gatorpath
$gatorpath = "C:\Program Files\Gator.com"
;Determine path to Start menu
; I know this different for Win9x.. $startmenu = READVALUE("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders","Common Programs") ;C:\Documents and Settings\All Users\Start Menu\Programs\GAIN ;C:\Documents and Settings\All Users\Start Menu\Programs\Gator eWallet ;C:\Documents and Settings\All Users\Start Menu\Programs\OfferCompanion
; -- Take the Read-only attributes off the directories ;;$RC = SETFileAttr("$Startmenu\GAIN\",128) ;;?$RC ;;$RC= SETFileAttr("$Startmenu\Gator eWallet\",128) ;;?$RC ;;$RC= SETFileAttr("$Startmenu\OfferCompanion\",128) ;;?$RC
;gETS $K IF @inwin=1 ; -- Pull the read-only flags from the folders ;$attrgator=SHELL'%comspec% /c ATTRIB -R $gatorpath /S /D ' ;$attrgmt=SHELL'%comspec% /c ATTRIB -R $gmt /S /D ' ;$attrcmesysii=SHELL'%comspec% /c ATTRIB -R $cmesysiipath /S /D ' ;$attrgain=SHELL'%comspec% /c ATTRIB -R $Startmenu\GAIN /S /D ' ;$attrewallet=SHELL'%comspec% /c ATTRIB -R $Startmenu\Gator eWallet /S /D ' ;$attroffer=SHELL'%comspec% /c ATTRIB -R $Startmenu\OfferCompanion /S /D '
SHELL '%comspec% /c RD /S /Q "$gatorpath"' SHELL '%comspec% /c RD /S /Q "$gmt"' SHELL '%comspec% /c RD /S /Q "$cmesysiipath"' SHELL '%comspec% /c RD /S /Q "$Startmenu\GAIN"' SHELL '%comspec% /c RD /S /Q "$Startmenu\Gator eWallet"' SHELL '%comspec% /c RD /S /Q "$Startmenu\OfferCompanion"' ELSE SHELL '%comspec% /c %WINDIR%\COMMAND\DELTREE /Y $gatorpath' SHELL '%comspec% /c %WINDIR%\COMMAND\DELTREE /Y $gmt' SHELL '%comspec% /c %WINDIR%\COMMAND\DELTREE /Y $cmesysiipath' SHELL'%comspec% /c %WINDIR%\COMMAND\DELTREE /Y $Startmenu\GAIN' SHELL'%comspec% /c %WINDIR%\COMMAND\DELTREE /Y $Startmenu\Gator eWallet' SHELL'%comspec% /c %WINDIR%\COMMAND\DELTREE /Y $Startmenu\OfferCompanion' ENDIF
;Let's remove Keys from the registry $rc = DELTREE("HKLM\SOFTWARE\Gator.com") $rc = DELTREE("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{456BA350-947F-4406-B091-AA1C6678EBE7}") $rc = DELTREE("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C8DBEC0-8052-11d5-A9D5-00500413153C}")
$index = 0 :loop1 $keyname = ENUMKEY("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\", $index) IF @error = 0 ; ? "Name found: $KeyName" IF instr($keyname,"gator") $rc = DELTREE($keyname) ENDIF $index = $index + 1 GOTO Loop1 ENDIF
;;$RC = DELTREE("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/IEGator.dll\.Owner")
?"Process is complete" RETURN ELSE RETURN ; -- Gator does not exist or has been removed ENDIF
Thanks,
Kent [ 13 June 2002, 20:41: Message edited by: kdyer ]
|
|
Top
|
|
|
|
#66725 - 2002-06-13 08:14 PM
Re: Removal of Comet Cursor and Gator
|
Radimus
Moderator
   
Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
|
in the addkey/writevalue section, the writevalue() are missing a parameter
|
|
Top
|
|
|
|
#66726 - 2002-06-13 08:42 PM
Re: Removal of Comet Cursor and Gator
|
Kdyer
KiX Supporter
   
Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
|
|
|
Top
|
|
|
|
#66728 - 2002-06-13 09:23 PM
Re: Removal of Comet Cursor and Gator
|
Radimus
Moderator
   
Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
|
I hate to leave a good thing alone... I'm still waiting for gator to send me 'removal' instructions... not just uninstall instructions
Till then (untested, and based on kent's code)
code:
$HKCUSMWCV = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion" $HKLMSMWCV = "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion" $Domainblock = "$HKLMSMWCV\Internet Settings\ZoneMap\Domains"
IF not KEYEXIST("$Domainblock\gator.com") regwrite("$Domainblock\gator.com","*",4,"REG_DWORD") regwrite("$Domainblock\gatoradvertisinginformationnetwork.com","*",4,"REG_DWORD") regwrite("$Domainblock\offercompanion.com","*",4,"REG_DWORD") endif IF keyexist("HKEY_LOCAL_MACHINE\Software\Gator.com") $gatorproc="GATOR.EXE","CMESYS.EXE","GMT.EXE" for each $app in $gatorproc Endproc("@wksta",$app) next
endif
$gatordir="" $gaindir ="" $offerdir="" $rc = DELDIR("$gatordir") $rc = DELDIR("$gaindir") $rc = DELDIR("$offerdir")
if @inwin=1 $startmenu=readvalue("$HKCUSMWCV\Explorer\Shell Folders","Start Menu") $rc = DELDIR("$startmenu\GAIN") $rc = DELDIR("$startmenu\Gator eWallet") $rc = DELDIR("$startmenu\OfferCompanion") endif $startmenu=readvalue("$HKLMSMWCV\Explorer\User Shell Folders","Common Start Menu") $rc = DELDIR("$startmenu\GAIN") $rc = DELDIR("$startmenu\Gator eWallet") $rc = DELDIR("$startmenu\OfferCompanion")
$rc = DELTREE("HKEY_LOCAL_MACHINE\Software\Gator.com") $rc = DELTREE("$HKLMSMWCV\Uninstall\{456BA350-947F-4406-B091-AA1C6678EBE7}") $rc = DELTREE("$HKLMSMWCV\Uninstall\{6C8DBEC0-8052-11d5-A9D5-00500413153C}")
:loop1 $keyname = ENUMKEY("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\", $index) IF not @error IF instr($keyname,"gator") $rc = DELTREE($keyname) ENDIF $index = $index + 1 GOTO Loop1 ENDIF
;********************************************************************************************** Function regwrite($key,$value,$data,optional $type) DIM $keyarray,$keypath,$loop,$rc if not $type $type="REG_SZ" endif $keyarray=split("$key","\") for $loop=0 to ubound($keyarray) $keypath=$keypath+$keyarray[$loop]+"\" if not KEYEXIST("$keypath") $rc=addkey("$keypath") endif next if KEYEXIST("$key") $rc=writevalue("$key","$value","$data",$type) endif endfunction
FUNCTION ENDPROC($COMPUTER,$PROC) dim $GetObject, $Select $GetObject="winmgmts:{impersonationLevel=impersonate}!//$COMPUTER" $select="select * from Win32_Process where Name='$PROC'" For each $Process in GetObject("$GetObject").ExecQuery("$select") $Process.Terminate Next ENDFUNCTION
Function DelDir($Pathname) Dim $Filename $Filename = Dir($Pathname + "\*.*") While $Filename <> "" And @ERROR = 0 If $Filename <> "." And $Filename <> ".." If (GetFileAttr($Pathname + "\" + $Filename) & 16) DelDir($Pathname + "\" + $Filename) SetFileAttr($Pathname + "\" + $Filename, 128) Rd ($Pathname + "\" + $Filename) Else SetFileAttr($Pathname + "\" + $Filename, 128) Del ($Pathname + "\" + $Filename) EndIf EndIf $Filename = Dir() Loop EndFunction
[ 14 June 2002, 00:42: Message edited by: Radimus ]
|
|
Top
|
|
|
|
#66729 - 2002-06-13 11:13 PM
Re: Removal of Comet Cursor and Gator
|
Radimus
Moderator
   
Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
|
lookie, Gator wrote back... quote: Apparently you do not understand, I am not walking around to 2000 PCs every day and going to add/remove programs and looking to see if they got hit with something while surfing.
What files does Gain, gator, etc install. Where are they located? What registry entries do these programs create?
I do not need you to recite your help file... I need your programmers.
Additionally, what networks(internet domains) do your software programs communicate to
-----Original Message----- From: support@gator.com [mailto:support@gator.com] Sent: Thursday, June 13, 2002 5:17 PM To: Subject: RE: need to remove all traces of all versions of gator software [#5588504]
Conrad,
You should be able to easily remove the program(s) by using the Windows Add/Remove Programs Control Panel.
To access the Add/Remove Programs Control Panel, follow these steps,
From the Windows Start button, select Settings, and then Control Panel.
When the Control Panel window opens, double-click on the Add/Remove Programs icon.
Locate the program you wish to uninstall in the list of installed programs, click on it one time, and then click on the Add/Remove button.
Follow the on screen instructions, when the uninstall program has completed, close all open windows.
*Note, we also distribute GAIN-supported software applications, or GAINware. If you have GAINware on your computer, viewing the following link, while your computer is connected to the Internet, may be helpful to you: http://www.gatoradvertisinginformationnetwork.com/about-gain.html.
This link is a new GAINware feature that will trigger the display of a window that will list all of our software, and third party GAIN-supported software, that may be installed on the computer that you are on at the time you use this link. The window will also provide instructions for the removal of all such software. So long as any such software is installed on the computer, The Gator Corporation will be capable of delivering highly relevant GAIN branded popup advertisements based on web sites viewed. A few minutes after all such software has been uninstalled (via Windows Add/Remove Programs), the software module responsible for the delivery of advertising will self-delete.
Bob ------- Original Message -------- From: To: support@gator.com Subject: RE: need to remove all traces of all versions of gator software [#5588504] Date: 06/13/02 10:30:32
Basically, I need all of them. Security policies on the LAN require ALL spy-ware, adware, tracking, etc that could in any way send any data OUT of our network or log user activity.
Specifically, trickler as it comes with webshots, but there are bound to be others. And offer companion. Therefore I need them all.
It isn't specifically against gator, as IM software is getting banned, as well as webshots, comet-cursor, cydoor, etc.
<<...OLE_Obj...>>
-----Original Message----- From: support@gator.com [mailto:support@gator.com] Sent: Tuesday, June 11, 2002 5:04 PM To: Subject: need to remove all traces of all versions of gator software [#5588504]
Conrad;
Which of our program(s) do you have; Gator eWallet, OfferCompanion, Date Manager, Precision Time, etc.?
Also, do you have a 3rd party GAIN supported application? To view a list of products that are part of GAIN and installed on the computer you are currently using, you can go to: http://www.gatoradvertisinginformationnetwork.com/about-gain.html
Rex Gator Corp. ------- Original Message -------- From: To: support@gator.com Subject: need to remove all traces of all versions of gator software Date: 06/11/02 13:51:58
conrad wheeler wrote: I need the reg keys, dlls, exes, and such to safely remove gator, tricker, gain, etc from the State governments network/computers.
the uninstaller is not an option...
Operating System: win_2000 Browser: ie_6 Gator eWallet version number: Unknown Problem: install_uninstall
|
|
Top
|
|
|
|
#66730 - 2002-06-13 11:24 PM
Re: Removal of Comet Cursor and Gator
|
Kdyer
KiX Supporter
   
Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
|
Rad,
Thanks for the clean up on this and it looks awesome!
A comment:
http://www.winguides.com/registry/display.php/1014/ shows us that we need to use a * and not a "" as that would only show a @ or default value.. quote:
regwrite("$Domainblock\gator.com","*",4,"REG_DWORD") regwrite("$Domainblock\gatoradvertisinginformationnetwork.com","*",4,"REG_DWORD") regwrite("$Domainblock\offercompanion.com","*",4,"REG_DWORD")
I maybe wrong on this.
Thanks,
Kent
|
|
Top
|
|
|
|
#66731 - 2002-06-13 11:32 PM
Re: Removal of Comet Cursor and Gator
|
Kdyer
KiX Supporter
   
Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
|
Rad,
The information that I was able to get was both from Ad-Aware and my copying and comparing reg keys..
Interesting info from Gator..
Kent
|
|
Top
|
|
|
|
#66733 - 2002-06-14 12:40 AM
Re: Removal of Comet Cursor and Gator
|
Radimus
Moderator
   
Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
|
mine doesn't delete the installation directory, as I don't have the default dirs.
I also haven't tested it. Tomorrow I'll start remote scanning my LAN looking for a gator process.
I was hoping the gator would have actually provided real data ( i know, hope in one hand ...)
|
|
Top
|
|
|
|
#66734 - 2002-06-14 05:51 AM
Re: Removal of Comet Cursor and Gator
|
Kdyer
KiX Supporter
   
Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
|
Doc,
When I did run it, GATOR was removed with the exception of:
quote:
C:\Program Files\Gator.com\OFFERC~1 - The process cannot access the file because it is being used by another process.
However, when I went in a looked for files under - C:\PROGRAM FILES\GATOR.COM the Offer Companion folder was there, but no files.
Kinda wierd..
(1) We terminate all processes setup by Gator. (2) We determine where Gator is installed. (3) Upon determination of where Gator is installed, we delete the folders and the Start Menu Folders. (4) We then remove the Registry info.
Hmmm... Does this mean we have to force restart and then on restart, it pulls the folder?
Thanks!
Kent
|
|
Top
|
|
|
|
Moderator: Glenn Barnas, NTDOC, Arend_, Jochen, Radimus, Allen, ShaneEP, Ruud van Velsen, Mart
|
0 registered
and 601 anonymous users online.
|
|
|