Please login or register.

Login with username, password and session length
gfx gfx
76726 Posts in 13480 Topics by 1752 Members - Latest Member: bumm13 March 23, 2023, 01:21:55 am
WinMX World :: Forum  |  Discussion  |  WinMx World News  |  In the shadows of conficker lurks the "grumbler"

Author Topic: In the shadows of conficker lurks the "grumbler"  (Read 597 times)

0 Members and 1 Guest are viewing this topic.

Offline Forested665

  • Forum Member
  • Linux:2003 FreeBSD:2004 Debian/BSD developer:2006
In the shadows of conficker lurks the "grumbler"
« on: May 20, 2009, 03:22:37 am »
The attackers behind a series of rapidly spreading Web site compromises have begun using a new domain to deliver their malicious code, security experts say.
The attacks, collectively referred to as "Gumblar" by ScanSafe and "Troj/JSRedir-R" by Sophos, grew 188 percent over the course of a week, ScanSafe said late last week. The Gumblar infections accounted for 42 percent of all infections found on Web sites last week, Sophos said.
Over the weekend, the Chinese Web domain used to deliver the malicious responding, according to Unmask Parasites, a service used to detect malicious code embedded in Web pages. The attacks' malicious payload has, however, continued to be delivered from a different source, the domain, Unmask Parasites said Monday in an advisory.

"They have slightly modified the script and now inject a new version that loads malicious content from a new domain," Unmask Parasites said.
Changes to the script make it more difficult to identify and stop detection by the Google Chrome browser, Unmask Parasites said.
Gumblar was first detected in March and has spread more quickly since then, against the expectations of security experts.
"A typical series of website compromises reaches peak within the first week or so and subsequently begins declining in intensity as detection is added by signature vendors, user awareness increases and website operators begin cleaning the affected sites," ScanSafe senior security researcher Mary Landesman, said late last week in an advisory.
In the Gumblar attacks, the opposite is occurring, partly because Web site administrators themselves are affected by the attacks as they try to address the problem, ScanSafe said.
Sites affected include,, and, according to ScanSafe.
The attacks were carried out in multiple stages, beginning in March, when a number of Web sites were compromised and attack code embedded within them, ScanSafe said.
Then, in early May, as Web site operators began to clean up their sites, the attackers replaced the original malicious code with dynamically generated and heavily obfuscated JavaScript, meaning that the scripts change from page to page and are difficult for security tools to spot.
The scripts attempt to exploit vulnerabilities in Adobe's Acrobat Reader and Flash Player to deliver code that injects malicious search results when a user searches Google on Internet Explorer, ScanSafe said.
They also search the victim's system for FTP credentials that can be used to compromise further Web sites, the company said.
The malicious code embedded on a user's system was previously downloaded from, a Chinese domain associated with Russian and Latvian IP addresses, delivering code from servers based in the U.K., according to ScanSafe. That domain has now changed to

The simple solution is as always keep up to date and keep clean.
while to some this means run your scanners constantly, this isnt really a good choice. scanners and windows has an automated scheduler for a reason.
BSD -  The Daemons Are No Longer Just Inside My Head.

WinMX World :: Forum  |  Discussion  |  WinMx World News  |  In the shadows of conficker lurks the "grumbler"

©2005-2023 All Rights Reserved.
SMF 2.0.19 | SMF © 2021, Simple Machines | Terms and Policies
Page created in 0.032 seconds with 23 queries.
Helios Multi © Bloc
Powered by MySQL Powered by PHP Valid XHTML 1.0! Valid CSS!