Wednesday, December 22, 2004

Santy killed in action by Google

Santy has died. The Santy worm is not spreading any more, thanks to Google.
Google started filtering the queries made by the worm around midnight GMT, effectively stopping the spread of the worm. Apparently they are doing this based on a combination of the search terms and the User-Agent header field.
Google has also started showing the defaced websites in it's index. MSN Search already had them visible over 12 hours ago, so apparently the indexing process takes longer at Google.
Like I reported earlier, MSN Search reports huge numbers of websites to be affected. However, if you keep viewing the search index pages, you get different results. MSN Search reports 29,000 hits, but runs out of the hits already on search index page 15 - with 153 actual hits shown. Google finds about 1500 defaced sites right now. It's hard to estimate how many actual sites got hit. So the possible 39.000 number from my former report could be completely wrong!