Hi friends, even if I have already done the necessary modifications and upgrades to the forum something strange could happen anyway, so I'm doing fresh backups of the site on a weekly basis. I suspect that all that online guest (133 yesterdays) are tries to hack the site, but they were unsucessfull till now. I hope that nothing strange will happen to the site.
These are the news:
[i:bf930d57ec]Today a lot of Webservers have been hacked by a so called "Net-Worm.Perl.Santy.a". This worm infects certain web sites by exploiting a vulnerability in
phpBB. Santy.a is spreading rapidly, and has caused an epidemic. Santy.a is something of a novelty - it creates a specially formulated Google search request, which results in a list of sites running vulnerable versions of
phpBB. It then sends a request containing a procedure which will trigger the vulnerability to these sites. Once the attacked server processes the request, the worm will penetrate the site, gaining control over the resource. It then repeats this routine. Once the worm has gained control over a site, it will scan all directories on the infected site. All files with the extensions .htm, .php, .asp, .shtm, .jsp and phtm will be overwritten with the text 'This site is defaced!!! This site is defaced!!! NeverEverNoSanity WebWorm generation'. Apart from defacing infected sites with this text, the worm has no pay load. It will not infect machines which are used to view infected sites. We recommend that all users of
phpBB should upgrade to version 2.0.11 to prevent their sites from being defaced[/i:bf930d57ec]
-------------------------------------------------------------------------
[i:bf930d57ec]Web search engine company Google is blocking efforts by a new Internet worm to use its search engine to find vulnerable computers on the Internet, the company announced this week.
Google is blocking searches launched by Santy.A, a new Internet worm that targets servers running
phpBB, a popular electronic bulletin board software package, according to a statement from the company. Without any native ability to scan for vulnerable computers, Google's action halted Santy.A's spread, according to antivirus companies.
Santy.A targets servers running
phpBB. Antivirus companies first detected the worm Tuesday, though it may have been spreading silently well before that, according to Johannes Ullrich, chief technology officer at The SANS Institute's Internet Storm Center.
The worm used a vulnerability in
phpBB, an open source software product that is managed by the
phpBB Group, to spread across the Internet, infecting computer servers that host online bulletin boards and defacing those sites with the words "This site is defaced!!! NeverEverNoSanity WebWorm."
A
phpBB component called viewtopic.php allows malicious commands to be passed to and executed on servers that run a vulnerable version of the
phpBB software. Secunia, a Copenhagen-based security company, first reported the vulnerability on November 19. An updated version of
phpBB software that fixes the flaw was released on November 18.
Impact Uncertain
Estimates of the impact of the Santy worm vary widely. Searches on a beta version of Microsoft's MSN Search feature for the text used to deface sites returned over 30,000 hits. However, identical searches on other engines, including the official MSN Search engine, Yahoo, and Google search engines returned far fewer hits, ranging from 785 (MSN) to 2030 (Yahoo).
However, using searches for telltale signs of infection, such as defacement text, is an inexact way to determine the actual number of Santy infections, says Ullrich.
"Santy will only deface sites if it can overwrite files, and it may not always be able to do that based on the configuration of the Web server [running
phpBB]," he says.
Also, an analysis of the Santy code revealed that the worm spread quietly for a while, infecting
phpBB servers but not overwriting files and defacing the bulletin boards, Ullrich says.
The Santy worm marked some firsts, including the use of a popular search engine as part of a worm's spreading mechanism. However, the lessons to be learned from Santy's spread are already well established: keep on top of software patches and "harden" the configuration of public-facing servers by preventing users from being able to take unnecessary actions, such as overwriting files, he says.[/i:bf930d57ec]
"Worm" crisis worldwide...
72512
50450
5031
There goes the neighborhood. 
succeded to stop the evil bots 
...
- they don't have creativity and therefore they must destroy the h ard work of others... 
! I'm backing up the most valuable part of our site, the database, on a daily basis now... I can rebuild the rest but not the database...
