How to Remove Gator/GMT/GAIN from your PC

[Shiloch Veneficus]

I saw this article written by someone else on a forum I visit regularly. What caught my eye about it was that I know I've performed this unorthodox uninstall so many times not just on my on computers, but on several other people's as well. It is unbelievable how many places have this on their site, and how many different ways it can get on your PC, and it is quite possibly one of the most annoying things I've ever had to deal with. It only brings me to wonder how many other people must be suffering from the same thing, so I'm going to paste the entire article here so you can take care of it yourself.

------------------------------------------



I was at a friend's house not too long ago and went on his a computer for a few minutes to check out his Diablo 2 character. To my horror, there in his system tray sat probably three dozen colorful buttons, of which I didn't recognize half. What's worse: I did, however, recognize two pale white eyes belonging to a creature with green skin staring out at me. The symbol of the infamous Gator Corporations evil spyware master work, GAIN.

I’m amazed by the number of people that are still forced to be constantly pestered with Gator’s ads, as well as their diabolical marketing schemes. For those who don’t realize it, Gator’s programs are taking information from everything you do on your PC and sending it back to its maker. In essence, it’s a virus in disguise.

First of all, realize the program is already running. In Windows, it’s impossible to delete a program that’s already running. And because GAIN is running already, you’ll need to stop it first before deleting. To do this, press CTRL-ALT-DELETE simultaneously once, which will bring up the taskmanager. In Windows XP, click the Processes Tab, and look for the entry “GMT.exe” under Image Name. Select it, then click End Process in the bottom left of the window. Click OK for any warnings that may appear.

Now that we’ve successfully terminated the program, we can delete the program files.

The first folder to be deleted resides in the location C:/Program Files/Common Files. Navigate to that folder, and delete the folder named “GMT” by selecting it and pressing SHIFT-DELETE. Select ‘Yes’ when the warning appears.

[Shiloch's note: You may need to end a process called "CMESys.exe" in your Task Manager before performing this next step.]

Next, do the same for the folder “CMEII”, also located in C:/Program Files/Common Files.

Now, navigate to C:\Documents and Settings\All Users\Start Menu\Programs and delete the item “GAIN”.

Except for a few remaining registry keys that won’t do any harm without the program files to support them, GAIN’s gone for good.
_________________
Sage Shiloch Venzolmes - Arch Convoker - Walkers
QUALITY, not quantity.

[Zazzul]

http://www.safer-networking.org/index.php?page=download

Here is a link to a FREE program called Spybot Search & Destroy. I am the IS Manager at my job, and made this a manditory program on my Network compters and servers. This software REMOVES and if selected (Immunites) PREVENTS GAIN and others like it from your computer and frees up your memory tables for more importanat things, like EQ =)

Just download it, Install it, Run it, and make sure to update it before you run the scans and immunities. This even removes the registry entry of such harmful spyware programs, and most of the major Viruses to. This will even fix some small security issues with Windows in general. It really is a great program. I hope this helps at least one person and stops those nausty legallized viruses from ruining a perfectly good EQ Computer.


Zazzul Hammerfists / Daggun Wildfire @ Vazaelle

[Shiloch Veneficus]

I strongly recommened Spybot, also.

The problem with it and the reason I posted this article is because while Spybot is capable of removing some cases and installations of GMT, it is not able to keep up with the ever-changing GMT system of installation. Running the bot myself, I often times find it will not remove what's necessary to get Gator off of the system.

I've also had two cases (in a history of 150 or so) where Spybot has done its "removal" of GMT and the system became unusable after the next restart. Because these were recent experiences (I'm certain Spybot will catch on and update the bot definitions), I think the safest way to remove it is to stop the processes yourself, delete the files, and leave the registry keys.
_________________
Sage Shiloch Venzolmes - Arch Convoker - Walkers
QUALITY, not quantity.

[Tylandi]

Ad Aware is also highly reccomended....get it here


http://www.lavasoftusa.com/support/download/

I use both this and spybot...between the two of them they get everything.

[Shiloch Veneficus]

Everything being a highly contentious and volatile term.

Warning: The reason I have not promoted either 'spybot' program is because they have problems of their own, in some scenarios can make things worse, and if you really have no idea what you're doing, you can accidentally trash a lot of stuff you might want to keep. (i.e. your message board settings, your Yahoo.com personal page layout, saved passwords, etc.)

Both programs scan and edit areas of your computer that are critical to basic functions (like the registry, boot scripts, etc). Neither program is supported by any computer manufacturer, nor by Microsoft, so choosing to use it is truly at your own risk. This because the "definitions" written by these guys don't always make sense.

I've had Spybot remove DLL's for "spyware" but fail to remove the registry entries, causing boot failures and unrecoverable corrupted registries.

As a rule, I do NOT run either program as an constantly-running checker, I only use them when there's a problem, and I usually only fix what I think is the problem.

Just so you know before you get download-happy -- follow the good 'ol-fashioned rules:
1. Don't fix it if it ain't broke.
2. You just might need to format.
_________________
Sage Shiloch Venzolmes - Arch Convoker - Walkers
QUALITY, not quantity.

[Hildar]

LAVASOFT (Ad-Aware) is spy-ware!!! It will remove other spyware so that only it remains. Companies pay LAVASOFT to send popups. I tanked Ad-Aware and popups (for non web surfing events) went completely away. To get rid of the other non web surfing popups go to services and completely disable MESSENGER.