Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 372
  • Last Modified:

Fed up with Gator....How to block???

I need to block gator at my firewall.  Everyday, I get more and more Snort alerts with Gator and I have had it with chasing down these "infected" systems.

Does anyone have any suggestions.


Craig Sharp
Craig Sharp
1 Solution

check this


Get this software:


"Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests.
Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
Restrict the actions of potentially dangerous sites in Internet Explorer.

SpywareBlaster can help keep your system spyware-free and secure, without interfering with the "good side" of the web.

And unlike other programs, SpywareBlaster does not have to remain running in the background.

It works great, i have it installed and it works perfectly.
It depends what kind of firewall you have.  The best way to block gator at the network/firewall level is with an intelligent firewall or proxy.  Check Point calls this "Application Intelligence" but it's basically just stateful inspection at the application level.  Some other proxies and devices can do it.

To look for gator, look at the HTTP packets for "User-Agent" = "^Gator" and block that.  As I said Check Point FW-1 NG AI can do it.  But so can some other proxies.

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Craig SharpLead Enginneer - Unix Server TeamAuthor Commented:
We have a PIX and it does not have anything close to intelligence.  I am thinking of writing a module for Snort using PERL that will automatically add the rules to the firewall for selected alerts.
I would also use Adaware by Lavasoft, to get rid of any spyware you have.
You are correct that the PIX cannot block these connections, but if you have a Cisco router in front of the PIX you would be able to use NBAR (Network Based Application Recognition) to block it..
You can always edit your HOSTS file to block anything from gator.com or its relatives...

You can google how to add exceptions to c:\windows\system32\drivers\etc\hosts

It's the best bet and your web browser will simply never display anything from Gator, nor will any application.
Craig SharpLead Enginneer - Unix Server TeamAuthor Commented:
Hi all.  Thanks for the replies.  I have accepted lrmoore's response as the NBAR is very close to what I need.  We have a complete Cisco infrastructure and this will be a good fit.

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now