Gumblar webnet back ....

... as if it ever really vanished (nope, at least, not completely, as thousands of site owners have never cleaned up their sites, leaving the original infection and/or backdoors in place - woops!).

Read the write ups by FireEye and Unmkask Parasites;

Gumblar, not Gumby!
http://blog.fireeye.com/research/2009/10/gumblar-not-gumby.html

Revenge of the Gumblar
http://blog.unmaskparasites.com/2009/10/23/revenge-of-gumblar-zombies/

References

WordPress users: UPDATE! UPDATE! UPDATE!
http://hphosts.blogspot.com/2009/10/wordpress-users-update-update-update.html

Martuz.cn (aka Gumblar) and WordPress does not a good mix make ....
http://hphosts.blogspot.com/2009/05/martuzcn-aka-gumblar-and-wordpress-does.html

Live.com poisoning - Gumblar/Martuz isn't the only infection around .....
http://hphosts.blogspot.com/2009/05/livecom-poisoning-gumblarmartuz-isnt.html

gumblar.cn switches to martuz.cn (95.129.145.58 - netname: NET-VENTREX)
http://hphosts.blogspot.com/2009/05/gumblarcn-switches-to-martuzcn.html