Adware.GatorClone performs the following actions when executed:
- Creates a randomly named .dll file in the %Temp% folder and injects the file into running processes. This .dll file will restart the adware program if the adware program is terminated.
- Adds the value:
<Filename of Adware> = <Path to Adware>
to the registry key:
- Contacts a remote server for advertisements and instructions, and displays pop-up ads.