Endpoint Protection

Hi

We are a web design company, and have a reseller hosting account with Names.co.uk. For the second time in 4 months my main website hosted with Names has been infected by the Gumblar ("or similar") virus.

The first time this happened, Tech Support at Names told me that I had security issues on my PC that had infected the website.  They told me to install Secunia PSI (which tracks out-of-date or unsecure/unpatched software such as Adobe Flash Player) on any office machines that connect via FTP to our website/s.  They also told me to change the FTP passwords, and to NEVER save the passwords in the FTP Application, typing them in manually every time I connect.

I changed the FTP password to a 21-character password including upper-and-lowercase letters, numbers, and symbols and I am the ONLY person to know this password, and it is not written down or saved in the FTP software.

And yet, yesterday my site was infected again with the Gumblar ("or similar") virus.

I have tried to look through local files for the malicious code but have not found anything at all.

Can anyone please confirm for me whether it's POSSIBLE I am being lied to by my hosting provider and that the security issue is not with me at all, but with them?  I am pulling my hair out trying to discover why this keeps happening and I just don't trust what I'm being told.  We host 40+ websites through this reseller account and it would be a nightmare to move to a new hosting company

And would Norton AV spot it if my PC, or a website we had viewed, was installing malicious code such as Gumblar?

Please, any help or advice to any of my questions would be greatly appreciated.

(I have Norton 360 Version: 3.8.0.41 installed across the office network on all 3 machines)

Go through this article
Antivirus software and the illusion of protection. 

This is the form for SEP 11.For Norton products pls post it in Norton community.
Norton Users Discussion Forum

Hi

Thanks for the response AravindKM, but that article you posted contains loads of good advice that I already use!

And with regard to posting in the Norton community (which I wll do anyway), it's not really a question about Norton, it's a question about the facts of the Gumblar virus and whether I'm being misinformed about it. 

You see, I don't believe the security vulnerability is with me - I believe it's with my Host, but I don't know enough about Gumblar (or it's ilk) to be able to judge.

Is there anyone on this forum that can advise?

Hello OH -

I have an e-commerce website -

The access seems to come through vulnerabilites in the website itself - at least that's how it happened for me - they got in through a vulnerability in my recently installed WordPress blog component.

This morning when I fired up my computer I was hit with a double-whammy.  My browser is set to load my main business website in one tab and the admin login page in another.  Admin page loaded just fine but there was nothing but a code/line error message showing up for my main website and it was basically offline.

As I began sending messages to my two website guys about the site being down, a Norton window popped up showing a "high" security threat.  When I opened to view the details it said that MY computer was attempting an attack and referenced "gumblar" in the information. 

I ran Norton immediately and it did not register any  malware.  Ran it again in safe mode with the same results. 

I ended up having to contact Norton and pay them to remove the virus. 

Meanwhile, McAfee running on my laptop never detected it - didn't register a threat when I went to the website nor was it picked up on full system scans whether running in "regular" or "safe mode."  

My husband uses AVG FREE 9.0 which immediately registered the threat when he went to the website - whether or not his computer was infected we don't know.  I can only assume that my laptop is now infected as my website loaded fully because of my start-up tab settings in my browser. 

So far, nothing I've downloaded has picked it up on the laptop - nor have I seen a warning or record of any threat in McAfee.

My webguys found the information below and used it to identify the problem files on the website.  While it won't stop a future attack, it is a good resource and allowed my guys to identify the infected files pretty quickly.
http://justcoded.com/article/gumblar-family-virus-removal-tool/ 
Be sure to scroll down and download the latest - the guy's trying to keep up with the latest gumblar changes.


A side-note:  After going through a couple of hours with Norton controlling my computer, they had me go to some of the websites I usually visit.  "My" website was up for testing so I went there first.  Immediately the "threat" popped up - which was good.   Checking the history in Norton, it registered "An intrustion attempt by <my computer name> was blocked.  Application path /DEVICE - yada, yada, yada" just like the original attack.  Norton said it was related to FireFox and told me "please don't worry about that."

I went to the website in both Google Chrome and IE8 - no warning popped up, but when I checked my history I was getting seeing the same "intrusion attempt" message.  Norton, who had control of my computer at the time, clicked the "don't tell me about this again" button.  At this point, I don't know if my computer is "gumblar-free" or not.  Sad considering that I paid more for their service today than I paid for the Norton Internet Security 2010 software.

If you do find a good server virus protection program or anything more about gumblar detection, prevention or removal - for computers OR websites, please post - and I'll do the same. 

I'm "low-tech" but get in the trenches with my guys as best I can.  Today I could do nothing but wait, watch and research solutions.
wg

 I am going to have to agree with WaterGir, and it is most likely some component on your page that is being exploited. If I were you I would check out this site http://www.hackthissite.org/. It is a site that teaches all the possible ways in which users can exploit websites. It is used manly as a teaching tool to show people how to hack websites and at the same time how to protect yourself against hacking. I am also curious as to how you got rid of gumblar in the first place. I mean are you sure you still were not infected?

Cheers
Grant

I have had 5 Grublar attacks in 1 month to my website.  My PC even got infected and NORTON never picked up on it.  I ran a malware bytes scan in safe mode and that detected and removed it.  However, 2 weeks later my email was hacked by someone in China.  I am guessing its the same hacker that hacked my site as that ip was from China, and another from India.  If you have given any FTP details to anyone, lets say a freelancer for hire, I would start there as the culprit, seems this group is pretty sophisticated and are posing as freelancers on websites for hire. 

I have had my code cleaned up 3 times.  Erros fixed, insertions deleted.

My question is, when you get a Grumblar on your website and PC.  What do you do?

My friend just had a Gumblar attack so I started doing some research. I found this which I belive is very interesting:
Trojan downloader Exploit.JS.Gumblar. According the Cisco, Gumblar represented 5 percent of all Web malware in 2Q10, down from 11 percent in 1Q10. Gumblar is a downloader that drops an encrypted file onto the victim's system. Gumblar runs that executable without user consent, injecting JavaScript into HTML pages to be returned by a Web server or displayed by a user's Web browser. The injected JavaScript usually contains an obfuscated exploit; early scripts downloaded more malware from gumblar.cn – thus giving this Trojan its name.

Cisco's 2Q10 list was generated by IronPort, which uses Sophos, Webroot, and McAfee malware detection engines. Other vendors use different naming conventions and publish slightly different lists that represent other monitored data sources. And next quarter there will be new lists -- probably composed largely of variants.

The purpose of such lists is not therefore to tell you which malwares to scan for. That job falls to continuously-updated anti-malware defenses, installed on desktops, servers, and gateways. Instead, use this list and others like it to identify and proactively fight trends that are likely to persist or grow and target your Web servers and users tomorrow.

On another note, I just tried to upgrade to the latest Norton from a site called antivirusfirewallsoftware.de which didn't work. Can it be dangerous to use such links? 

 

@  chandlerbing1,

I edited your link. Only upgrade your Norton product from a trusted Symantec site.

http://www.symantec.com/globalsites/index.jsp#

German site - http://www.symantec.com/de/de/norton/