The mighty MARTUZ!

[jakecohen]

Martuz .cn - New Incarnation of the Gumblar Exploit. So What’s New? | Unmask Parasites. Blog.

A reincarnation of Gumblar....
Gumblar .cn Exploit - 12 Facts About This Injected Script | Unmask Parasites. Blog.

Every single one of my sites is infected.

You can find out if yours is if you are using a windows xp or older and any browser besides Chrome. When loading your website if you see Martuz.cn loading, everything on that FTP account is fucked.


ahh..

 

[barman]

had a variation of this happen to me last month. it's relatively easy to fix if you have backups, but a glorious pain in the ass.

don't save passwords in filezilla

 

[nvanprooyen]

Me too - it was a pain in the ass. I changed my FTP passwords, removed all the malicious code and started using WinSCP (SFTP). Haven't had any problems since.

 

[jakecohen]

had a variation of this happen to me last month. it's relatively easy to fix if you have backups, but a glorious pain in the ass.

don't save passwords in filezilla

so this is a problem with filezilla?

because sure enough, that's what im using right now../

 

[DreamMachine]

I don't open anything except port 80 on the public IP.

 

[zimok]

Both those sites are down, can you give more details how you got infected?

"When loading your website if you see Martuz.cn loading, everything on that FTP account is fucked."

Can't make sense of this..

 

[Caspah]

Both links are down.

 

[barman]

so this is a problem with filezilla?

because sure enough, that's what im using right now../

i dont know how specifically, but i think it was a rootkit that snagged all my saved passwords from filezilla. dont think the program makes a difference

 

[nvanprooyen]

Ya, pretty sure it's any FTP application that stores passwords unencrypted...