Net-Worm.Perl.Santy.a, the original version of the worm, targeted phpBB online bulletin boards and searched Google for “viewfiles.php,” which allowed the worm to find versions of the phpBB software earlier than 2.0.11.
“Santy.a is something of a novelty,” Anti-virus firm Kaspersky said at the time. “It creates a specially formulated Google search request which results in a list of sites running vulnerable versions of phpBB.”
Once the virus has located its targets and successfully infected a site, it searches for and overwrites files with .asp, .htm, .jsp, .php, .phtm, and .shtm extensions. In their place, the worm places files which contain the text, “This site is defaced!!! NeverEverNoSanity WebWorm generation.”
Google began filtering search requests soon after the worm was discovered and began to return results only for sites no longer vulnerable to the worm, but new versions of the worm that use AOL and Yahoo search engines began popping up late last week and were announced by the Internet Storm Center on Christmas Day.
The variants, referred to as Santy.b and Santy.c, operate differently than the original worm, according to anti-virus experts.
“It tries to pull several scripts from an affected forum,” wrote the ISC in its daily diary. “The forum could have been compromised and used as a base to attack others.”
Among other features included in the newer versions of Santy are the attempted installation of a bot that would grant an attacker control over the computer and may possibly allow for targeted distributed denial-of-service attacks.
Another new worm, originally referred to as Santy.e, was reported by the Kaspersky, which exploits PHP scripts called “PHP Scripts Automated Arbitrary File Inclusion,” and could be potentially dangerous to any website, even with updated versions of PHP and phpBB.
After an analysis of the worm by Kaspersky, though, the worm was found to contain different mechanisms by which it operated and was renamed to Spyki.b.
The worm was also tagged as being created by Brazilian hacking group Atrix Team.
Email sent. If you wish to send to another person, click here.
