Seven sites have been defaced by a worm which appears to combat the Santy worm according to the Security company F-Secure. The anti-Santy worm uses Google to find sites that use the PHP Bulletin Board software exploited by the earlier worm, anti- santy infects the sites and attempts to make the sites more secure by installing a patch. Sites that have been attacked by the anti-Santy worm are defaced with the words: "viewtopic.php secured by Anti-Santy-Worm V4. Your site is a bit safer, but upgrade to >= 2.0.11." According to Mikko Hypponen, director of antivirus research at F-Secure even though anti -santy appears to do good it is likely to cause problems administrators who will have to handle the increase in traffic.

via CNET