Categories: Adware

Adware.Gator removal instruction

The Adware.Gator is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Adware.Gator virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Reads data out of its own binary image
  • Installs a browser addon or extension
  • Drops a binary and executes it
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
  • Network activity contains more than one unique useragent.
  • Installs itself for autorun at Windows startup
  • Exhibits possible ransomware file modification behavior
  • Creates a hidden or system file
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

Related domains:

raven.veloz.com
www.flowgo.com
update.thunderdownloads.com
www.hugedomains.com
ocsp.digicert.com
crl4.digicert.com
crl3.digicert.com

How to determine Adware.Gator?


File Info:

crc32: 668D8C1Fmd5: 9c6da4fae2b7d6607c93c928fcb444f2name: kylesmomisabeeeach.exesha1: 81d96e697ad98f41cdd095a1505f03b5ff162434sha256: 378e28aca645de011fbfa560efe53e28cb531b660d4b0275a29c159c1dc60c13sha512: 300c4e733273ad306286335dd79af8b6c3c0966135b856ea0f6be5e21d1cb57bca01f820964833819c323a642fefe015465776e41e30782a4416227e7fcd5afessdeep: 49152:xEhLYLHonetkFktgBPvTLi4ksZ6YTxyw6uUHog8u4AQLsVl5:mhMzoybgBPbesoYpzU2uaLsVl5type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: WebDevAZFileDescription: Kyles Mom is a BeeeachFileVersion: CompanyName: WebDevAZ

Adware.Gator also known as:

MicroWorld-eScan Gen:Adware.Heur.ns3@RmL@z9gi
FireEye Gen:Adware.Heur.ns3@RmL@z9gi
Malwarebytes Adware.Gator
VIPRE Trojan.Win32.Generic!BT
AegisLab Adware.Win32.Sidesearch.2!c
BitDefender Gen:Adware.Heur.ns3@RmL@z9gi
Cybereason malicious.ae2b7d
Cyren W32/AdInstall.A.gen!Eldorado
Symantec Adware.Keenval
TrendMicro-HouseCall TROJ_GEN.R002C0RH420
Avast Win32:Adware-gen [Adw]
Kaspersky not-a-virus:AdWare.Win32.Sidesearch.d
Alibaba TrojanDownloader:Win32/Keenval.e9d0039b
NANO-Antivirus Riskware.Win32.Sidesearch.fbakcz
ViRobot Spyware.Keenval.Do.2323800
Rising Downloader.Keenval!8.3161 (CLOUD)
Ad-Aware Gen:Adware.Heur.ns3@RmL@z9gi
Sophos Generic PUA MH (PUA)
F-Secure Adware.ADWARE/Adware.Gen
DrWeb Trojan.KeenValAd
TrendMicro TROJ_GEN.R002C0RH420
Emsisoft Gen:Adware.Heur.ns3@RmL@z9gi (B)
APEX Malicious
F-Prot W32/AdInstall.A.gen!Eldorado
Avira ADWARE/Adware.Gen
MAX malware (ai score=100)
Arcabit Adware.Heur.EAD1131
ZoneAlarm not-a-virus:AdWare.Win32.Sidesearch.d
Microsoft Trojan:Win32/Vigorf.A
Cynet Malicious (score: 85)
McAfee Artemis!9C6DA4FAE2B7
Cylance Unsafe
Panda Adware/SideSearch
ESET-NOD32 a variant of Win32/Adware.SideSearch.F
Fortinet Adware/SideSearch
Tencent Win32.Adware.Sidesearch.Hvjh
Ikarus not-a-virus:AdWare.Win32.NewDotNet
GData Gen:Adware.Heur.ns3@RmL@z9gi
AVG Win32:Adware-gen [Adw]
Paloalto generic.ml
Qihoo-360 Win32/Trojan.Dropper.6c8

How to remove Adware.Gator?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Recent Posts

Win32:VB-YWM [Trj] removal guide

The Win32:VB-YWM [Trj] is considered dangerous by lots of security experts. When this infection is…

21 mins ago

Virus.Win32.Texel.k removal guide

The Virus.Win32.Texel.k is considered dangerous by lots of security experts. When this infection is active,…

26 mins ago

Application.Agent.ATT removal tips

The Application.Agent.ATT is considered dangerous by lots of security experts. When this infection is active,…

26 mins ago

About “Trojan-Downloader.Win32.Upatre.cdsp” infection

The Trojan-Downloader.Win32.Upatre.cdsp is considered dangerous by lots of security experts. When this infection is active,…

26 mins ago

What is “MSIL/GenKryptik.GLOG”?

The MSIL/GenKryptik.GLOG is considered dangerous by lots of security experts. When this infection is active,…

26 mins ago

Win32/TrojanDownloader.Delf.QU removal

The Win32/TrojanDownloader.Delf.QU is considered dangerous by lots of security experts. When this infection is active,…

32 mins ago