This is not a virus or trojan. It is a direct-marketing adware application. This application generates advertisements while connected to the Internet.

This application comes bundled with many other programs, which usually discloses the fact that it is ad-supported.  Users agree to have the Adware installed in the license agreement, although they may not realize at first that this file was packaged with the product they installed.

Installation
Exact filenames and installation locations may vary from version to version.  This description is simply meant as a guide and is based on the Trickler component distributed by Gator.com.

Upon installation of the program, a registry run key is created to load the program at system startup:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
  Run "Trickler"

Several other registry entries are created:

• HKEY_CLASSES_ROOT\CLSID\
  {21FFB6C0-0DA1-11D5-A9D5-00500413153C}
• HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com

This "Trickler" component is responsible for downloading any updates to this adware application.

The detection of this type of file is not automatically activated. Users who would like to check for the presence of this kind of files on their system should run the command line scanner with the /PROGRAM switch.
Please note that VirusScan 7, and higher, has also an option, which enables users to detect this kind of program automatically (see below).

Detection
For VirusScan 4.x users who would like to detect this program on their system, they can run the command line scanner with the /PROGRAM switch.

1. Click the START button
2. Click RUN
3. Type COMMAND and hit ENTER
4. Type:
   
   c:\progra~1\common~1\networ~1\viruss~1\4.0.xx\scan.exe c: /program /sub
   
   and hit ENTER.

Users running VirusScan 7 or later can also enable application or joke detection via the configuration option "Find potentially unwanted programs" (Advanced section - see example below), within the VirusScan GUI as shown below:

Corporate Users:

This applies for the VirusScan 7 Enterprise On-Access scanner too.

This does not apply for the VirusScan 7 Retail On-Access scanner.

Removal
Users who wish to remove this application should contact Gator.com.  The following pages may be of use:

• http://www.gator.com/help/gatorfaq.html
• http://www.offercompanion.com/help/ocfaq.html
• http://www.claria.com/help/
• http://www.gator.com/