Gumblar Malware Active Again!
Posted: Tuesday, December 15, 2009
by Angeline Mabute
http://www.techienow.com
ScanSafe researchers see a renewed activity of Gumblar. It has crashed thousands of websites and blogs like Wordpress, Drupal, Joomla and other PHP platforms. Gumblar is a multifunctional malware that spread through attacking PCs while visiting hacked Web pages. It can steal FTP (File Transfer Protocol) credentials and also hijack Google searches which replace results on infected computers with links to other malicious sites. Gumblar malware was first seen last May 2009.
Gumblar checks to see if the victim's PC is running unpatched versions of Adobe Systems' Reader and Acrobat programs. If so, the machine will be compromised by a so-called drive-by download. In this way, Gumblar will infect visitors with variety of online attacks. Users experience error messages while using Wordpress and other PHP-based sites which are generated because of a bug in the Gumblar's malicious code injected in the sites warning the site owners that their site is infected.
Usually, domain names that have been used for malicious purposes are being suspended by domain name registrars. Like what happened to gumbler.cn, where Gumblar got its name, the time that it came out in May of this year. Since those domains are blacklisted, malware writers usually change domains their software looks to for instructions. But for some reason, the gumblar.cn domain was now released and is in use again. The botnet will begin infecting computers again.
Dennis Sinegubko, independent security researcher, discovered that it was really Gumblar's fault. The authors made some changes to their web code resulting to the current version of Gumblar damaging Wordpress blogs and other websites.
According to Landesman, web sites that are still infected with Gumblar can now call back to the newly activated domain allowing those infected PCs to be updated with new malware.
Gumblar is active again! Gumblar has crashed thousands of blogs and websites like Wordpress, Drupal, Joomla and other PHP-based sites. It can attack your PC and steals personal information from you. Protect your PC now before any online attacks like Gumblar do the damage, contact Techie Now. We can provide the PC support services you need virus and spyware removal, performance optimization, installation and configuration, and general repair. Worry no more, Techie Now can help you secure your PC.
This Article has been viewed 230 times. (Not updated in real-time.)
Top-level comments on this article: (1 total)Thanks JP, I'd love to write more to give knowledge to others.
We want your comments! If you can read this, you don't have javascript enabled, so you can't use this comment system. Please enable javascript.