Fed up with Gator....How to block???

Posted on 2004-08-24
Medium Priority
Last Modified: 2010-04-11
I need to block gator at my firewall.  Everyday, I get more and more Snort alerts with Gator and I have had it with chasing down these "infected" systems.

Does anyone have any suggestions.


Question by:Craig Sharp
LVL 49

Expert Comment

ID: 11881228

check this


LVL 15

Expert Comment

ID: 11881363
Get this software:


"Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests.
Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
Restrict the actions of potentially dangerous sites in Internet Explorer.

SpywareBlaster can help keep your system spyware-free and secure, without interfering with the "good side" of the web.

And unlike other programs, SpywareBlaster does not have to remain running in the background.

It works great, i have it installed and it works perfectly.

Expert Comment

ID: 11885108
It depends what kind of firewall you have.  The best way to block gator at the network/firewall level is with an intelligent firewall or proxy.  Check Point calls this "Application Intelligence" but it's basically just stateful inspection at the application level.  Some other proxies and devices can do it.

To look for gator, look at the HTTP packets for "User-Agent" = "^Gator" and block that.  As I said Check Point FW-1 NG AI can do it.  But so can some other proxies.

The Firewall Audit Checklist

Preparing for a firewall audit today is almost impossible.
AlgoSec, together with some of the largest global organizations and auditors, has created a checklist to follow when preparing for your firewall audit. Simplify risk mitigation while staying compliant all of the time!


Author Comment

by:Craig Sharp
ID: 11888229
We have a PIX and it does not have anything close to intelligence.  I am thinking of writing a module for Snort using PERL that will automatically add the rules to the firewall for selected alerts.

Expert Comment

ID: 11890198
I would also use Adaware by Lavasoft, to get rid of any spyware you have.
LVL 79

Accepted Solution

lrmoore earned 2000 total points
ID: 11896426
You are correct that the PIX cannot block these connections, but if you have a Cisco router in front of the PIX you would be able to use NBAR (Network Based Application Recognition) to block it..

Expert Comment

ID: 11958226
You can always edit your HOSTS file to block anything from gator.com or its relatives...

You can google how to add exceptions to c:\windows\system32\drivers\etc\hosts

It's the best bet and your web browser will simply never display anything from Gator, nor will any application.

Author Comment

by:Craig Sharp
ID: 11958912
Hi all.  Thanks for the replies.  I have accepted lrmoore's response as the NBAR is very close to what I need.  We have a complete Cisco infrastructure and this will be a good fit.

Featured Post

Managing Security Policy in a Changing Environment

The enterprise network environment is evolving rapidly as companies extend their physical data centers to embrace cloud computing and software-defined networking. This new reality means that the challenge of managing the security policy is much more dynamic and complex.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

It's not just another paperwork submission. Serious planning and rigour to managing the whole thought processes need to be put in place. The intent is not on drilling into the details, but to share tips in getting the first thing right to kick-start…
Cloud computing is a model of provisioning IT services. By combining many servers into one large pool and providing virtual machines from that resource pool, it provides IT services that let customers acquire resources at any time and get rid of the…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
This video Micro Tutorial shows how to password-protect PDF files with free software. Many software products can do this, such as Adobe Acrobat (but not Adobe Reader), Nuance PaperPort, and Nuance Power PDF, but they are not free products. This vide…

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question