[clue-tech] php

Tue Dec 21 23:14:16 MST 2004

Damn worm has taken out like 40,000 sites last I
heard.  Google finally blocked it so it will die down,
unless someone respawns it.  damn phpBB

--- Jeff Falgout <jfalgout at ogov.net> wrote:

> Mike Staver wrote:
> 
> > Sigh.  I've been hit by a worm that takes
> advantage of the fact that 
> > Whitebox Linux does not have an updated php
> package available.
> >
> > NeverEverNoSanity WebWorm generation 9
> >
> > Every php file on my webserver has now been
> replaced by:
> >
> > <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
> > <HTML><HEAD>
> > <TITLE>This site is defaced!!!</TITLE>
> > </HEAD><BODY bgcolor="#000000" text="#FF0000">
> > <H1>This site is defaced!!!</H1>
> > <HR>
> > <ADDRESS><b>NeverEverNoSanity WebWorm generation
> 9.</b></ADDRESS>
> > </BODY></HTML>
> >
> > I can't find any info on this worm, so I shut down
> apache on my server 
> > until I can find an updated php rpm.  I ran the
> latest chkrootkit, but 
> > it didn't find anything - but then again, this
> worm appears to be very 
> > new since Google doesn't contain any search
> results for it yet.
> 
> 
> 
> Looks like this worm went national today on
> slashdot:
> 
>
http://it.slashdot.org/it/04/12/21/2135235.shtml?tid=220&tid=217&tid=169
> 
> Jeff
> _______________________________________________
> CLUE-tech mailing list
> CLUE-tech at clue.denver.co.us
> http://clue.denver.co.us/mailman/listinfo/clue-tech
> 

__________________________________ 
Do you Yahoo!? 
Yahoo! Mail - Find what you need with new enhanced search.
http://info.mail.yahoo.com/mail_250