BleepingComputer.com: Net worm using Google to spread

<img src='/images/misc/Virus.jpg' style='float:right' vspace='8' hspace='8'> <b>A Web worm that identifies potential victims by searching Google is spreading among online bulletin boards using a vulnerable version of the program phpBB, security professionals said on Tuesday. The Santy worm uses a flaw in the widely used community forum software known as the PHP Bulletin Board (phpBB) to spread, according to updated analyses. The worm searches Google for sites using a vulnerable version of the software, antivirus firm Kaspersky said in a statement.</b><br /><br />Published: December 21, 2004, 11:01 AM PST By Robert Lemos Staff Writer, CNET News.com<br /> <br /> Almost 40,000 sites may have already been infected. Using Microsoft's Search engine to scan for the phrase "NeverEverNoSanity"--part of the defacement text that the Santy worm uses to replace files on infected Web sites--returns nearly 39,000 hits.<br /> <br /> "Santy.a is spreading rapidly," antivirus firm Kaspersky stated in a new release published Tuesday. "However, this does not directly affect users. Although the worm infects Web sites, it does not infect computers used to view those sites."<br /> <br /> The worm sends Google a specific search request, essentially asking for a list of vulnerable sites. Armed with the list, the worm then attempts to spread to those sites using a PHP request designed to exploit the phpBB bulletin board software.<br /><br /> <div class='newslinks'><img src='http://www.bleepingcomputer.com/forums/public/style_images/1/cs_page.gif'>&nbsp;<b>Link: <a href='http://news.com.com/Net+worm+using+Google+to+spread/2100-7349_3-5499725.html?tag=nefd.lede target='_blank'><font color='red'>More details</font></a><br />