The 'Gumblar virus is hitting servers hard across the globe and as a result websites residing on these servers are at risk of infection. If you notice any suspicious hyperlinks (especially on your websites home page) or you discover that Google has blocked your site, please get in touch with us.
Novara (our hosting partner) have released an official statement regarding the Gumblar virus and how it attacks:
"
As part of an ongoing investigation, we have established that many hosted websites have been tampered with by an external attacker or group of attackers using FTP, among other means.
Our research has shown this to be a pattern of attacks, with specific attacks called 'Gumblar' and 'Martuz'. This is a problem reported by all major hosting companies at this time - it is not specific to Digiweb or Novara.
You can read more here:
- blog.unmaskparasites.com
- www.creativeireland.com
In general, these attacks occur when a PC is infected by a browser, flash or Adobe PDF exploit. Once infected, the infected PC will do things like searching for saved FTP passwords, install a keylogger and setup a packet sniffer to sniff for FTP details on your network. All passwords are then sent to external sites.
These external sites then attempt to FTP to your website, uploading new versions of your pages with hostile code (usually javascript and iframes). Anyone who then visits your site will too become infected if not fully patched up.
We STRONGLY RECOMMEND you take the following actions:
1. Identify any computers which use FTP to upload content to your websites.
2. Make sure that such computers are updated for Windows, Adobe Acrobat Reader (if installed) and Adobe Flash Plugin (if installed).
3. Reset all FTP passwords used by you for your websites.
4. Review your website content for suspicious data, in particular unfamiliar IFrames and Javascript.
We appreciate your help with this - this problem can only be tackled by all of us. "
To prevent future attacks and avoid vulnerabilities we ask that you keep your antivirus software up to date and scan your PC regularly.
As part of our protection against the virus we have changed many of our client's ftp passwords. So if you are having trouble connecting to your site using FTP please contact us and we will issue you with the new password.
Dominick is Fireball's jack of all trades. He's been part of the team since 2007 and has always been focused on great design, usability & SEO.
Find Out More »
Comments
There have been no comments made on this article. Why not be the first and add your own comment using the form below.
Leave a comment
We moderate comments so be polite, stay on topic and try to add value to the conversation.
* A valid email address is required however we will not share this with anyone.