Summary of W32/CodeRed II
|Alias:|| I-Worm.Bady, CodeRed, Bady, Code Red|
||4 Aug 2001
|Third variant of the Code Red worm has been spreading in the wild since August 4th, 2001. It targets Microsoft IIS www servers, and does not pose a threat to end users.
|CodeRed II is a rewritten version of the original Code Red worm. It uses the same IIS hole to gain access on the web server and then continues to find new vulnerable systems.
Interestingly, Code Red II has been programmed to spread more aggressively in China than anywhere else. This might be in relation to the Chinese references in the original worm.
The most important feature of Code Red II is that it installs a backdoor into systems it infects.
When a host gets infected it starts to scan for other hosts to infect. It probes random IP addresses but the code is designed so that probing of neighbour hosts is more probable.
If the infected system has the language set to Chinese the worm starts more aggressive scanning (600 threads instead of 300). The scanning runs for 24 hours after the infection (48 for Chinese machines) and then the system is rebooted.
There is a time limit in the code that will stop the worm on the 1st of October. At that time it will reboot the machine and stop spreading. The installed trojan still remains in the system!
The worm drops a trojan program to '\explorer.exe' that modifies different some IIS settings to allow a remote attack of the infected host. The standard command interpreter 'cmd.exe' is copied to '\inetpub\scripts\root.exe' and to '\progra~1\common~1\system\MSADC\root.exe'. The worm creates these files to both 'C:' and 'D:' drives if they exist. These copies of the 'cmd.exe' will allow any attacker to execte commands on the remote system really easily.
TROJAN PART OF THE CODE
First of all it disables the System File Checker (SFC) functionality in Windows. SFC is responsible for checking the integrity of system files.
Two new root directories are added to the IIS configuration: '/c' that points to 'c:\' and '/d' that points to 'd:\'.
This makes sure that even if the copies of 'cmd.exe' the worm made are removed the system can still be compromised.
Modifications to the registry:
is set to 0xffffff9d that disables the System File Checker.
',217' is appended to these keys:
These keys make 'C:' and 'D:' accessible trough the webserver:
|Removal Instructions||First apply the neccesary security patches from Microsoft:
The first one fixes the vulnerability the worm uses to spread. The second one fixes the problem that makes Windows to run the trojanized 'explorer.exe' from the root folder. Both patches must be applied.
When the patches are applied the system has to be rebooted to eliminate the worm itself if it was still active. The following files must be deleted:
These keys have to be removed:
The added ',217' string has to be removed from these keys:
[Analysis: Gergely Erdelyi, Sami Rautiainen & Mikko Hypponen / F-Secure Corp.; July-August, 2001]