[ Thanks to for this link. ]

"The virus searches for .php and .htm files and inserts code to call itself. The virus executes only on servers with PHP interpreters. This virus cannot be contracted by simply visiting an infected Web page."

"This virus is written in PHP and is contained in a file that is 718 bytes long. When executed, the virus searches the current directory for files with .php or .htm extensions. If one of these files is writable, the virus opens the file to determine if the file is already infected. If the file is not infected, the virus inserts a line to execute the original viral file rather than appending itself to the infected file."

Complete Advisory