The worm creates a specially formulated Google search request. This request will give a list of sites running vulnerable versions of phpBB. The worm then sends a request to all sites found, which contains an exploit for the vulnerability. When the server under attack processes the exploit, the worm penetrates the site and gains control. This process is then repeated.
The worm scans all site directories, and overwrites files with the following extensions:
.asp
.htm
.jsp
.php
.phtm
.shtm
with the following text:
This site is defaced!!!
This site is defaced!!!
NeverEverNoSanity WebWorm generation
Using MSN to search for sites containing the above strings gives an extensive list of sites; evidence that Santy.a is currently causing an epidemic.
Users should note that this worm is not dangerous; it will not infect computers if users view an infected site.
The way to prevent it is to update your phpbb version to 2.0.11
versions before this one are the vulnerable ones.