Aha! This is what hit us.
Net worm using Google to spread
A Web worm that identifies potential victims by searching Google is spreading among online bulletin boards using a vulnerable version of the program phpBB, security professionals said on Tuesday.
The Santy worm uses a flaw in the widely used community forum software known as the PHP Bulletin Board (phpB
to spread, according to updated analyses. The worm searches Google for sites using a vulnerable version of the software, antivirus firm Kaspersky said in a statement.
Almost 40,000 sites may have already been infected.
Rest of story here:
http://news.zdnet.com/2100-1009_22-5499725.html
And, btw, we're back up. And the vulnerability patched! Whew!