Gumblar Virus in my Templates

[Tauhid]

Hello,

I cleaned up all the php files still some users are complaining that some virus detection problems are still rising through their browser and virus scanners. Basically, I found out the malicious code that is inserted into the templates of my site. Those codes dont appear in the forum however, but does appear in the classifieds and gallery sections. The templates are being pulled from vbulletin so I belive a simple template edit might fix it. But I am not sure where I can find this code, I searched the header template, forumhome, footer and many other templates, nowhere could be found.

Any guess where this code is from? Please let me know, its troubling and getting rid off my web visitors. My templates are heavily edited and a new template installation might just scare people away.

<Edit: I removed this code because it was giving some people false positives from there virus software when trying to view this thread. - Steve>

[Wayne Luke]

It is most likely not in your actual templates. You can verify this by running this query:

select template from template where template like '%unescape%';

If any templates are returned than you will need to manually edit them. However this is usually inserted by an infected web server and the machine your site is hosted on would need to be cleared of the infection.

[Tauhid]

As I found out, this is not even in the templates, the viruses are probably still there in the server...I installed a completely new style, still the same problems. Where in the server can these codes be found?

[Biker]

This is something the host needs to accomplish.

[Zachery]

Its possible its burried in a parsed template, and not in an unparosed template.

[Tauhid]

Its possible its burried in a parsed template, and not in an unparosed template.

anyway to fix that?

[Zachery]

Checking the database manually though something like phpmyadmin.

Start with large common templates: header, footer, headinclude, spacer_open, forumdisplay.

[Tauhid]

this issue has been solved now, a fresh upload of the gallery files and the classified files was enough!

[shazzz]

We had this virus and chances are sadly it will come back. We have now had re uploaded 3 times and found that it has spread throughout again as it gets into your FTP and other places... our server was then hit as it spread throught


Its even made it onto the news pages

http://uk.news.yahoo.com/16/20090515/ttc-gumblar-attack-explodes-across-the-w-6315470.html

[Noctavia]

I too am having these problems.

If you use Filezilla, you can sort the files by last edited time and locate the culprit files. For me it's been Global.php file (so just reupload) and a .js file that needs to be deleted. Takes 2 mintes to fix, just extremely frustrating to be doing it every day...

[shazzz]

I too am having these problems.

If you use Filezilla, you can sort the files by last edited time and locate the culprit files. For me it's been Global.php file (so just reupload) and a .js file that needs to be deleted. Takes 2 mintes to fix, just extremely frustrating to be doing it every day...

its took us over a week and we only just re opened, its also in your HTML files, they have hidden it in there as well

we found it almost every index. HTML file... it said something about fucntion srcipt iframe or hidden i frames and also we lost our arcade as it was in the games as well, so ended up duming the arcade and going too re build then go through all the files as checked in 10 and it was in the games as well and we had 2000 games and so was no way was going too go through them all......

so its not just in your PHP files and it dont show doing a search, we tried on 3 browsers and its hid a lot deeper than you beleive, but really go and check your index.html files for hidden scripts and links as well

[Tauhid]

Basically, the viruses started attacking my site for two weeks. I was on my vacation in california and one of my other administrators who uses the ftp access just to upload some random videos and photos had been using the account. His computer was most probably affected by viruses as a result, the password was cracked and the hackers got access to the whole public_html directory.

This virus is so dangerous that it has done serious damage to my site:

1) Almost every single php file of vbulletin, photopost gallery/classifieds, joomla, vbadvanced etc were injected with viruses containing weird if statements and (functions)...
2) The templates were injected with a basic php code starting with (function() and some weird numbers. You cannot remove them by installing new styles or anything. You need to upload fresh files from all your scripts to let these viruses go.
3) Javascript files were running crazy javascript codes that are really big in size as well.

My main problem is:

1. A bad name for my site since my users think that the administration of the site is weak and viruses can attack the site easily.
2. Google already listed my site as harmful to a user's computer and god knows how long will it take for them to review my site as completely clean.
3. Although I checked through WHM & CPANEL, my site contains no trojan viruses, I had to run some online virus check on my server too. I recommend using this: http://www.blacklistdoctor.com

Make sure you check your raw ftp log, I got the IP Addresses used to hack my site already but little can be done against the hackers. I deleted all extra ftp accounts and kept one root one with a difficult new password. I almost gave up on my site and if these viruses keep on coming, I will leave the web scene just for these hackers. I had enough and its tiring to clean up your beloved site where you put thousands of dollars of your hard earned money for nothing. Its frustrating but I am holding up till now because I have millions of users who depend on me and my team to maintain a quality website.