The Web site compromise attack known as Gumblar has added new domain names that are downloading malware onto unsuspecting computers, stealing FTP credentials to compromise more sites, and tampering with Web traffic, a security firm said on Thursday.

The Gumblar attack started in March with Web sites being compromised and attack code hidden on them. Originally, the malware downloaded onto computers accessing those sites came from the gumblar.cn domain, a Chinese domain associated with Russian and Latvian IP addresses that were delivering code from servers in the U.K., ScanSafe said last week.

As Web site operators cleaned up their sites, the attackers replaced the original malicious code with dynamically generated and obfuscated JavaScript, making it difficult for security tools to identify. The scripts attempt to exploit vulnerabilities in Adobe’s Acrobat Reader and Flash Player to deliver code that injects malicious search results when a user searches Google on Internet Explorer, as well as search the victim’s system for FTP credentials that can be used to compromise additional Web sites.

The domain was changed to martuz.cn before both domains were shut down. And now, the malware is coming from sites including liteautotop.cn and autobestwestern.cn, among others, according to ScanSafe.

“Fortunately, it appears the name servers themselves are being shut down,” the company said in a statement. “However, even after Gumblar-related attacks subside, cyber criminals will still possess the botnet of infected computers obtained via Gumblar.”

ScanSafe contends that Gumblar is worse than Conficker, a worm that spreads via a hole in Windows, through removable storage devices and network shares with weak passwords, as well as disables security software and installs fake antivirus software.

Gumblar, which was responsible for 37 percent of all malware blocked by ScanSafe during the first two weeks in May, has more intrusive behavior–it intercepts and monitors Web traffic, as well as installs a data-theft Trojan that steals usernames and passwords from infected computers, ScanSafe said.

In addition, once a Conficker infection is remediated there is no further spread of the worm. However, Gumblar can use the FTP credentials it steals to compromise even more Web sites, potentially exposing many more victims, the company said.

To find out if a computer is infected:

1) Locate sqlsodbc.chm in the Windows system folder (by default under Windows XP, the location is C:\Windows\System32\);

2) Obtain the Sha1 of the installed sqlsodbc.chm. FileAlyzer is a free tool that can be used to obtain the SHA1 of a file;

3) Compare the obtained Sha1 to the list located on the ScanSafe STAT Blog;

4) If the SHA1 and corresponding file size do not match with a pair on the reference list, it could be an indication of a Gumblar infection.

The most effective way to remedy an infection is to do a full reformat and reinstallation, according to ScanSafe. Passwords or login details that were stored or used on infected machines should also be changed.

On The Net : ZDNet

Today is my birthday. Just a mile marker on the road of life. A point in time to reflect on, and inflect on your decisions. Some were commendable to keep me safe, and some of which were perplexing and vexing as in not making any, for deep engraved fears on it’s consequences.

Everyone, for the most part, is out there, jostling, struggling, fighting, working, rushing, pushing, desiring and longing to do things; to get somewhere. So much to achieve. So little time. The turmoils of this world is continual. We never have the answers for any of our conflicts. And the planet is never short of the wise guys. We have more than a few experts. For every conceivable  problem, we have a solution. But, never enough will to fulfill it.

I still have another year before I can retire from civilization as I know it.  The bears in the woods beckon me. The call of raw nature hastens me to seek personal progress. The longing to steer clear of another ‘cerebrum,’ whether a thinking one or not, is the prize for my years of hard work. I will get there pretty soon. I deserve it.

But, I still have to answer to my past. And, I reflect upon it. Happy Birthday to me!

This memorial day, my salute to those who gave us their ultimate sacrifice and to those who bear enough courage in them to risk their lives to defend our freedoms. To those men and women in our armed services, I owe you more gratitude than toward any single person I know.

iChristchurch.com – A nice geo domain name is for sale.

Located on the east coast of the South Island, Christchurch – just like the rest of New Zealand – is a city of contrasts. It is a place where its residents continue to enjoy a healthy, active lifestyle amidst a natural environment world-renowned for its beauty.

A growing cosmopolitan ambiance also adds a touch of excitement without overt flashiness. Everywhere there is an understated elegance that speaks of times gone by and promises a future where anything is possible.

To purchase iChristchurch.com, or make an offer, leave a comment with your contact info. Thanks!

On The Net : Christchurch

ABC, your network should be ashamed of yourself. Not that I spend a dime’s worth of my time watching garbage on your network as with any other. But, what’s wrong is wrong. No wonder, no one is truthful and honest in America anymore. Your network, like any other is an embodiment of that.

I don’t care for the stars. Nor do I care for their little trophies. What I care is to be fair. First it was Lil Kim & Derek Hough. Eliminating them totally pissed me off. Even Tom Bergeron, the host, voiced his opinion on why they should have been standing on the dance floor in the finals!

Today, the show couldn’t have been rigged any further. Voting Cheryl Burke and Gilles Marini to 2nd place was the ultimate insult to all the competitors.

Fuck you ABC. Don’t waste your viewers time and your show’s dance competitors hard work and devotion. Broadcast a circus act with monkeys and elephants prancing to your advertiser’s 30 second commercial tunes. It will be just as entertaining. And with a little less nausea.

Those fucking scumbags over at Craigslist finally relented. Morons!

Assholes like these should not be able to profit from their ventures. To damn with their ‘free classifieds’. Nothing is free! There is always a price to pay.

Down with Craigslist. We can live without it.

Craigslist – The garbage site of the Internet

Craigslist – Classifieds for perverts and criminals

Craigslist – Any alternatives

Craiglist to drop “erotic services” ads

By Jason Szep

BOSTON (Reuters) – Online classified site Craigslist will replace its “erotic services” ads with a new adult category “to bar flagrant prostitution and porn,” the Connecticut attorney general’s office said on Wednesday.

Craigslist’s sex-service listings have faced intense scrutiny following the April 14 murder of 25-year-old masseuse Julissa Brisman, who advertised on Craigslist in Boston. Philip Markoff, a 23-year-old Boston University medical student, was charged with killing Brisman and with attacks on two other women he met through Craigslist.

Officials from Craigslist were not immediately available to comment.

The “erotic services” section will end within seven days and be replaced with a new section called “adult services” where every advertisement will be manually reviewed by Craigslist staff, Connecticut Attorney General Richard Blumenthal said in a statement.

In April, Blumenthal had asked Craigslist officials to eliminate photographs in the “erotic services” and similar sections of the site, hire staff to screen ads that blatantly violate Craigslist rules and offer incentives for people who flag and report prostitution advertisements.

Craigslist informed him of the changes on Tuesday night, Blumenthal said.

Craigslist, a 14-year-old online bazaar that generates more than 20 billion page views per month in 50 countries with a staff of just 28 people, is partially owned by online auctioneer eBay, which bought 25 percent in 2004.

Along with its free listings for just about anything — from apartments to furniture, jobs and cars — San Francisco-based Craigslist.org provides one of the largest and most controversial sex-service listings.

“We will be monitoring closely to make sure that this measure is more than a name change from erotic to adult and that the manual blocking is tough and effective to scrub prostitution and pornography,” said Blumenthal, who has led a task force with other attorneys general on Craigslist.

Tabloids dubbed Markoff “the Craigslist killer.”

The murder followed the killing of George Weber, a New York reporter knifed to death after responding to a personal ad he placed on Craigslist in March, and the early-April sentencing of Michael Anderson, a Minnesota man convicted of killing a woman who responded to a babysitting ad.

The Craigslist measures could set a precedent for similar sites, Blumenthal said.

“Closing the erotic services section — a blatant Internet brothel — should lead to other blocking and screening measures, and set a model for other sites, if Craigslist keeps its word,” Blumenthal said.

On The Net : Reuters