Information on the Gumblar Virus

[Wayne Luke]

There is a new virus that is affecting a variety of PHP driven websites out there. The method of injection isn't completely known at this time. It has been noticed to affect vBulletin sites amongst others including Drupal, WordPress, phpBB, PhotoPost, SMF and others.

This is not due to a vBulletin Vulnerability.

Please see these sites for more information:
http://uk.news.yahoo.com/16/20090515...w-6315470.html
http://www.pcworld.com/article/16489...g_malware.html
http://blog.scansafe.com/journal/200...another-9.html

See this site for some specifics including tips on removing this virus:
http://blog.unmaskparasites.com/2009...jected-script/
http://blog.scansafe.com/journal/200...umblar-qa.html

If necessary, we can assist on helping with compromised websites but ultimately the security of your website requires security of your local workstations and you will need to make sure that they are secure.

[Jake Bunce]

As part of your PC security measures I personally recommend this browser addon for Firefox users:

https://addons.mozilla.org/en-US/firefox/addon/722

It restricts active javascript to trusted sites only. It starts with a small white list which you can then add to. It adds a little "S" icon in the bottom right of your browser which you can click to display scripting options for the current page. It separates javascript allowances by the domain name of the resource. A single web page can have multiple javascript resources so you can be selective about which resources to allow.

[Wayne Luke]

Update. It is felt that this virus is being spread through exploits in older versions of Adobe Flash and Adobe Reader. You need to make sure to keep all software up to date.

http://www.guardian.co.uk/technology...google-malware

If you're worried about the safety of your site then please visit here:
http://www.unmaskparasites.com/

Here are instructions on how to remove this virus:
http://www.webologist.co.uk/2009/05/...to-remove.html

Please note that Macintosh users are not invulnerable to similar attacks or even a variant of the Gumblar virus due to an unpatched and published exploit in the Java Virtual Machine shipped by Apple. For information on this please see:
http://landonf.bikemonkey.org/code/m....20090519.html