Gumblar Malware's Home Domain Active Again

Gumblar Malware's Home Domain Active Again

ScanSafe researchers are using IT Support and seeing renewed activity regarding Gumblar, a multifunctional piece of malware that spreads by attacking PCs visiting hacked Web pages.
Gumblar can steal FTP credentials as well as hijack Google searches, replacing results on infected computers with links to other malicious sites on the internet.

When the Gumblar malware was found in March, it looked for instructions on a server at gumblar.cn. That domain was taken offline at the time, but has been reactivated within the last 24 hours, wrote Mary Landesman, a senior IT security researcher with ScanSafe, on an IT company blog.

Gumblar checks to see if the victim's PC is running unpatched versions of Adobe Systems' Reader and Acrobat programs. If so, the machine will be compromised by a so-called drive-by download.