[ Thanks to xcyber for
this link. ]
“The virus searches for .php and .htm files and inserts code
to call itself. The virus executes only on servers with PHP
interpreters. This virus cannot be contracted by simply
visiting an infected Web page.”
“This virus is written in PHP and is contained in a file that is
718 bytes long. When executed, the virus searches the current
directory for files with .php or .htm extensions. If one of these
files is writable, the virus opens the file to determine if the
file is already infected. If the file is not infected, the virus
inserts a line to execute the original viral file rather than
appending itself to the infected file.”