Gumbler

[Frank Hagan]

There's an exploit "out there" called "Gumbler" that spreads itself to webmaster's web sites from their personal computers. The virus uses your FTP credentials to upload infections to your sites, injecting obfuscated javascript into html, js and other files on the server. It spreads itself when browsers visit the pages.

There's a story on it at Cnet.com that says some pretty major web properties (on linux servers) have been compromised: tennis.com, variety.com and coldwellbanker.com.

I checked, and my virus scanner on my personal PC (AVG Free) does detect the virus as "Gumbler" and will quarantine it if found. So far, no infection for me. Its recommended that webhosts make sure their development PCs are free of the virus by maintaining regular anti-virus updates and regularly scanning.

As for checking websites, I found one "site scanner" that checks for the obfuscated javascript (it actually checks all pages and links on the site). It is at http://unmaskparasites.com

You can also check Google's evaluation of your sites by appending your site name (generally without the "http://www" portion) to http://www.google.com/safebrowsing/d...e=yoursite.com

[AndrewT]

This is actually very common. We get tickets from at least a couple of customers each week where this has occurred.

Edit: Thanks for the post btw. It will certainly prove helpful to others.

[Frank Hagan]

I sent an email out to all my customers today, advising them to check their PCs (I had "scanned" each site with the online tool to verify they were OK).

[ZYV]

Yeah, unfortunately, this is very common over here as well. Careless lame webmasters save the FTP passwords in their clients and when they catch the virus while browsing for porn or whatever, it decodes the passwords from the cache, because it is stored with reversible encryption w/o key.

Then the virus takes over their website and they start whining that Kaspersky complains that their website was hacked.

What are you doing when this occurs, by the way? I just tell them buy porn on DVDs next time instead and bill a fee for cleaning.

[Frank Hagan]

None of my customers has been affected this time around. I took over an account that was infected with some obfuscated javascript, and Google had tagged the site as infected. Every index.html and index.php file on the site had the script in it.

I think in that case it was actually an injection through PostNuke, a CMS that gets hacked quite a bit if you aren't up to date.

I probably wouldn't accuse my customers of visiting porn sites; coldwellbanker.com was one that was spreading it this time (Coldwell Banker is a large financial firm here in the states). What they can do is either 1) scan frequently (daily), or 2) not store their FTP password in their FTP client.