Comments on: Gumblar-family virus removal tool

By: Dean

Dean — Thu, 17 Jun 2010 06:25:45 +0000

Thanks! If it only fixed up the file permissions and ownership

By: Paul

Paul — Sun, 11 Apr 2010 13:16:59 +0000

merci
thks

By: Flatlander

Flatlander — Tue, 06 Apr 2010 13:00:16 +0000

Excellent. First I got a bit afraid as I had many Failed messages, but it turned out that these are file with 0-byte length, which had been created by the virus. So now I just need to remove about a 100 files or so of length 0

Thanks, lifesaver!

By: Amin

Amin — Mon, 22 Mar 2010 06:15:03 +0000

Thanks for the script.. its working.. if some of you cant turn off magic quotes off can add this in the top of the curevir.php file.

if ( in_array( strtolower( ini_get( ‘magic_quotes_gpc’ ) ), array( ‘1′, ‘on’ ) ) )
{
$_POST = array_map( ’stripslashes’, $_POST );
$_GET = array_map( ’stripslashes’, $_GET );
$_COOKIE = array_map( ’stripslashes’, $_COOKIE );
}

By: JamBy

JamBy — Tue, 16 Mar 2010 13:04:55 +0000

This is a very very very cool stuff. Remove all from my site a minute…

THX

By: Sameer Shelavale

Sameer Shelavale — Wed, 10 Mar 2010 05:51:44 +0000

hey Chris,

The virues comes back because either you did not change FTP password after clean up OR one of your machine from which you are accessing FTP is infected.

Please clean up virus from your local machines as well and change FTP password

By: Jake

Jake — Tue, 23 Feb 2010 06:24:10 +0000

Hi Konstantin,

I’ve also been hit by what I believe to be a variant of the Gumblar virus, but I can’t quite be sure because it’s different from what others have posted here. Here’s what I see at the bottom of every index.php file in my web server:

Tried installing your script, but when I ran it I received the following message:

Warning: fopen(/home/mysite/public_html/!infected-1266906136.txt) [function.fopen]: failed to open stream: Permission denied in /home/mysite/public_html/curevir.php on line 328

Warning: fclose(): supplied argument is not a valid stream resource in /home/mysite/public_html/curevir.php on line 336
TOTAL: 0
START BACKUP:
END BACKUP!

Can you please tell me what I’m doing wrong?

By: Chris Brennan

Chris Brennan — Tue, 23 Feb 2010 05:27:08 +0000

Thank you very much for posting this script Konstantin. I’ve been freaking out all day once I realized that all 10 of my websites had been compromised and were now seeding viruses and malware to everyone who visited them. It took me a while to figure out how to implement your fix, and I just wanted to point out a couple of things to others who may have similar problems following the directions.

1. The only way I was successfully able to turn magic quotes off was by doing it through the .htaccess file. Editing this file may be more familiar than the other route to most people. Basically you just add this line to the .htaccess file in your root director: php_flag magic_quotes_gpc Off

I got the directions on that from this page: http://www.php.net/manual/en/security.magicquotes.disabling.php

2. You really do have to change the file permissions for everything to 777. He isn’t joking about that. Once you’ve done the above two steps the script does work pretty well though, as far as I can tell.

The only problem is that I can only figure out how to run it from the root directory given my limited technical knowledge, and I have found that there are other folders and files *outside* of the root directory that have been infected as well. With these all I have been able to do is go in and edit them manually.

This may be the reason why many people are reporting that the virus comes back after a day though, because they don’t clean the files outside of the root. At least, I’m hoping that that is the case since I *just* started cleaning all of my files, and there hasn’t been enough time to see if it will come back yet.

The last point that I wanted to make is that a lot of websites seem to say that this virus is propagated through unprotected passwords in Filezilla, because Filezilla doesn’t encrypt their passwords. I got rid of Filezilla today and found a new FTP program, but I was wondering if that was how everyone else got their websites infected as well? Did everyone get this on their sites due to Filezilla? The only other possibility for me is that some of my wordpress versions were kind of old. Other than that, I really don’t know how this happened. Any insight you guys can share as to the cause of this would be appreciated, so that we can all better avoid it in the future.

Many thanks.

By: victoria

victoria — Sun, 21 Feb 2010 00:09:14 +0000

Thanks for this your help has been invaluable especially as there seems to be very little out there for this obviously widespread attack!

By: Konstantin Boyko

Konstantin Boyko — Fri, 19 Feb 2010 18:03:46 +0000

Thanks to everyone for posting your variants of the code. I was busy with other things and haven’t had time for releasing new versions of the script. As far as I can see the hackers have learnt the javascript (or used some tool) and obfuscated their javascript code rather well. So now it is rather hard to write a regular expression for every variation and to cover all of them - since they modify it often. So I had to relase the version 1.3 which can be donwloaded here.

The main difference from all previous versions is that it is semi-automatic: you enter the code which you can see in your files and the script searches/replaces for it. You need to copy exact code which you have inside . There are also 2 options (buttons) - “Search” and “Search&Replace”. I recommend to run “Search” first and make sure that backup is working fine on your server and that your search string is correct.

Also you need to make sure that you have magic_quotes_gpc=Off in PHP settings for your server.

As always comments/contributions are kindly appreciated.