Worm Spreads Via Google

A virus is using the Google search engine to find sites using a particular bulletin board system (phpBB), to infect them.

The worm is named Santy.A and does not affect individual computers like yours or mine (phew!). It rather infects servers hosting phpBB. Once in place, the virus attacks files with the extensions HTM, PHP, ASP, SHTM, JSP, and PHTM and overwrites them with the text “This site is defaced!!! This site is defaced!!! NeverEverNoSanity WebWorm generation”.

Santy.A is using a vulnerability in the PHP scripting language that was already patched, hence the importance of keeping up with security updates… It is hoped that Google can prevent the virus to spread further.

[pcworld]