Thursday, 4. June 2009, 07:20:22
Gumblar trojan, Gumblar.cn, gumblar.a, gumblar virus
...
Security watch says the site involved in this issues including their name servers are being shutdown
About the Gumblar malware from the website
The client malware is not your average malware: it sits in the browser process and looks for Google searches, substituting malicious ones for the legit ones. It also looks for FTP credentials, which appears to be the way it compromises web sites. Nothing was wrong on Google's end; the malicious activities all occurred on client PCs and 3rd party web servers.
Read more here and Here
Friday, 29. May 2009, 13:32:18
gumblar, Gumblar.cn, gumblar.a
IF your site is affected with this Trojan, there is a higher chance to get blacklisted in Google, and since Firefox is using same recommendation that also block your site.
Normally this will affect index, home,defualt (can be php,html,htm etc). There is a chance that it will affect others files too. What it does is it will inject an iframe tag (normally just after the opening of body tag). To fix this
1. Download all the files from the server for easy search, if u dont have server access for search
2. search for iframe <iframe src=”link” width=2 height=4 style=”visibility: hidden”></iframe> (iframe tag and hidden visiblity is there on all tags i have sen till now, the width and height also may vary)
that link may vary since i have seen more than one type of link there.
3. remove all those iframes
4. Replace the server files with the edited ones
5. Remove write permission of all files and folders (755 in Linux), if you need write permission to a folder and if there is a file named in the first step, make sure that file can not be edited.
6. make sure that your ftp client does not save ftp passwords
7. Change the ftp passwords
6 and 7 am not sure whether it is needed or not, but doing that will be a great.
If your site is already black listed, go to Google webmaster and request a review after doing all these issues.
http://krishnan.co.in/blog/post/Gumblarcn-Trojan-How-to-Fix.aspx
http://krishnan.co.in/blog/post/gumblarcn-Trojan.aspx
WIDGETIZE