Joined: 23 Jun 2004 Posts: 6594 Location: Planet Tampaxia,
Bloodhound Virus Posted: 12-22-04 14:39pm
Ok here goes.
I have emailed and pm'd admin
bloodhound is the name norton anti virus
(nav) gives to anything it doesn't
recognise. Nav will alsmost always bash
this before it can even quarantine it.
Consequently only nav will ever find a
bloodhound as it is nav's way of saying
"dunno what it is but I killed it for
you"
if you have nav or other anti virus
software the chances are you are ok simply
delelte any temporary files relating to it
as the were created by nav as it bashed
it.
Google is the culprit and unfortunately
ehealth being a phpbb board has been swept
along.
I run regular software and I haven't
picked up anything although I am behind a
firewall albeit a weak one.
The santy worm uses a flaw, announced last
week, in the software that interprets web
pages written in the widely used scripting
language php: hypertext preprocessor
(php). However, rather than attempt to
infect all web sites running php, the worm
instead targets a specific
application--the php bulletin board
(phpbb)--and searches google for
vulnerable sites, antivirus firm kaspersky
said in a statement.
Almost 40,000 sites may have already been
infected. Using microsoft's search engine
to scan for the phrase
"neverevernosanity"--part of the
defacement text that the santy worm uses
to replace files on infected web
sites--returns nearly 39,000 hits.
|
Kia
Supporter
Joined: 23 Jun 2004 Posts: 6594 Location: Planet Tampaxia,
Posted: 12-22-04 14:49pm
More research:-
"santy.A is spreading rapidly," antivirus
firm kaspersky stated in a new release
published tuesday. "however, this does
not directly affect users. Although the
worm infects web sites, it does not infect
computers used to view those sites."
after it has taken over a site, the worm
deletes all html, php, active server pages
(asp), java server pages (jsp), and secure
html pages, and replaces them with the
text, "this site is defaced!!! This site
is defaced!!! Neverevernosanity webworm
generation x," according to kaspersky.
For "x," the worm inserts a number
representing how far the current instance
of the program is descended from the
original worm release. Msn searches have
found 24th generations of the worm.