New Santy Variants Learn to Use Yahoo, AOL

CYBERSPACE — The Santy Internet worm, which was discovered last week and used the Google search engine to find vulnerable websites, has evolved to spread via other search engines following Google’s crackdown on the worm’s distribution mechanism.

Net-Worm.Perl.Santy.a, the original version of the worm, targeted phpBB online bulletin boards and searched Google for “viewfiles.php,” which allowed the worm to find versions of the phpBB software earlier than 2.0.11.

“Santy.a is something of a novelty,” Anti-virus firm Kaspersky said at the time. “It creates a specially formulated Google search request which results in a list of sites running vulnerable versions of phpBB.”

Once the virus has located its targets and successfully infected a site, it searches for and overwrites files with .asp, .htm, .jsp, .php, .phtm, and .shtm extensions. In their place, the worm places files which contain the text, “This site is defaced!!! NeverEverNoSanity WebWorm generation.”

Google began filtering search requests soon after the worm was discovered and began to return results only for sites no longer vulnerable to the worm, but new versions of the worm that use AOL and Yahoo search engines began popping up late last week and were announced by the Internet Storm Center on Christmas Day.

The variants, referred to as Santy.b and Santy.c, operate differently than the original worm, according to anti-virus experts.

“It tries to pull several scripts from an affected forum,” wrote the ISC in its daily diary. “The forum could have been compromised and used as a base to attack others.”

Among other features included in the newer versions of Santy are the attempted installation of a bot that would grant an attacker control over the computer and may possibly allow for targeted distributed denial-of-service attacks.

Another new worm, originally referred to as Santy.e, was reported by the Kaspersky, which exploits PHP scripts called “PHP Scripts Automated Arbitrary File Inclusion,” and could be potentially dangerous to any website, even with updated versions of PHP and phpBB.

After an analysis of the worm by Kaspersky, though, the worm was found to contain different mechanisms by which it operated and was renamed to Spyki.b.

The worm was also tagged as being created by Brazilian hacking group Atrix Team.

Copyright © 2025 Adnet Media. All Rights Reserved. XBIZ is a trademark of Adnet Media.
Reproduction in whole or in part in any form or medium without express written permission is prohibited.

More News

Taylor Nicole Launches New Site Through YourPaysitePartner

Creator Taylor Nicole has launched her new official website through YourPaysitePartner (YPP).

Adult Networking Platform SpicyGigs.com Launches

SpicyGigs, a new adult industry networking platform, has officially launched.

Pineapple Support to Host 'Cream Pie Challenge' Fundraiser

Pineapple Support is hosting its Cream Pie Challenge through August to raise funds for mental health services for industry performers.

Kyrgyzstan President Signs Measure Outlawing Internet Porn

President Sadyr Japarov of Kyrgyzstan on Tuesday signed into law legislation outlawing online adult content in the country.

NC Legislature Overrides Veto of Extreme Anti-Adult Industry Bill

The North Carolina state legislature on Tuesday voted to override Gov. Josh Stein’s veto of a bill imposing regulations that industry observers have warned could push adult websites and platforms to ban most creators and content.

Report: VPN Downloads Soar in UK Following Age Verification Deadline

Virtual private network apps, which can be used to circumvent geo-specific age verification requirements, are topping Apple App Store downloads in the U.K. in the wake of new Online Safety Act rules, the BBC is reporting.

Strike 3 Holdings Sues Meta for Pirating Vixen Media Group Content to Train AI

Vixen Media Group owner Strike 3 Holdings filed suit in federal court this week, accusing Facebook parent company Meta of copyright infringement and alleging that Meta has extensively pirated VMG content to train its artificial intelligence models.

Pineapple Support, Streamate to Host 'Navigating Grief and Loss' Support Group

Pineapple Support and Streamate are hosting a free online support group to help performers cope with grief and loss.

Friday is Final AV Compliance Deadline in UK

Friday, July 25 marks U.K. media regulator Ofcom’s deadline for user-to-user services such as tube, cam and fan sites to implement its requisite “highly effective age assurance” measures for preventing minors from viewing adult content.

AEBN Publishes Popular Searches for May, June

AEBN has released the top search terms for the months of May and June from its straight and gay theaters in all 50 states and the District of Columbia.

Show More