Another "Good Worm": Anti-Santy

As noted yesterday, a new worm is making the rounds, Santy. It seems that a new worm is out about about to combat this, "Anti-Santy" ... No word yet on if the anti-worm actually works.

The vulnerability description suggests that the worm only needs to patch a couple of lines in the stock phpBB codebase to protect against Santy. However, I've expressed my thoughts on the good worm here already, and I'll reiterate the key points: you don't have the authority to make those changes, you don't know if they'll work correctly, and you don't know what they may have changed. All of this combines in a lethal fashion to create a situation where more problems are likely to be generated than are fixed.

You can search for Anti-Santy hit sites (using MSN search) by using the search string "Anti-Santy-Worm V4". Sites that have been indexed by the search engine will be returned. As of this morning it was 3 sites. A site that has been hit will look like this:

Originally noticed via the F-Secure AV weblog.