FRISK Software International


Summary of W32/CodeRed II
Alias: I-Worm.Bady, CodeRed, Bady, Code Red
Discovered: 4 Aug 2001
 
Jump to:
Brief description
Technical description
Removal Instructions

Brief Description
Third variant of the Code Red worm has been spreading in the wild since August 4th, 2001. It targets Microsoft IIS www servers, and does not pose a threat to end users.


Technical Description
CodeRed II is a rewritten version of the original Code Red worm. It uses the same IIS hole to gain access on the web server and then continues to find new vulnerable systems.

Interestingly, Code Red II has been programmed to spread more aggressively in China than anywhere else. This might be in relation to the Chinese references in the original worm.

The most important feature of Code Red II is that it installs a backdoor into systems it infects.

When a host gets infected it starts to scan for other hosts to infect. It probes random IP addresses but the code is designed so that probing of neighbour hosts is more probable.

If the infected system has the language set to Chinese the worm starts more aggressive scanning (600 threads instead of 300). The scanning runs for 24 hours after the infection (48 for Chinese machines) and then the system is rebooted.

There is a time limit in the code that will stop the worm on the 1st of October. At that time it will reboot the machine and stop spreading. The installed trojan still remains in the system!

The worm drops a trojan program to '\explorer.exe' that modifies different some IIS settings to allow a remote attack of the infected host. The standard command interpreter 'cmd.exe' is copied to '\inetpub\scripts\root.exe' and to '\progra~1\common~1\system\MSADC\root.exe'. The worm creates these files to both 'C:' and 'D:' drives if they exist. These copies of the 'cmd.exe' will allow any attacker to execte commands on the remote system really easily.

TROJAN PART OF THE CODE

First of all it disables the System File Checker (SFC) functionality in Windows. SFC is responsible for checking the integrity of system files.

Two new root directories are added to the IIS configuration: '/c' that points to 'c:\' and '/d' that points to 'd:\'.

This makes sure that even if the copies of 'cmd.exe' the worm made are removed the system can still be compromised.

Modifications to the registry:

 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable'
is set to 0xffffff9d that disables the System File Checker.

',217' is appended to these keys:

 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\Scripts'
 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\MSADC'


These keys make 'C:' and 'D:' accessible trough the webserver:

 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\C'
 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\C'



Removal Instructions
First apply the neccesary security patches from Microsoft:

http://www.microsoft.com/technet/security/bulletin/ms01-033.asp

http://www.microsoft.com/technet/security/bulletin/MS00-052.asp

The first one fixes the vulnerability the worm uses to spread. The second one fixes the problem that makes Windows to run the trojanized 'explorer.exe' from the root folder. Both patches must be applied.

When the patches are applied the system has to be rebooted to eliminate the worm itself if it was still active. The following files must be deleted:

 '\inetpub\scripts\root.exe'
 '\progra~1\common~1\system\MSADC\root.exe'
 '\explorer.exe'
These keys have to be removed:

 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\C'
 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\D'
The added ',217' string has to be removed from these keys:

 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\Scripts'
 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\MSADC'

[Analysis: Gergely Erdelyi, Sami Rautiainen & Mikko Hypponen / F-Secure Corp.; July-August, 2001]
 


Stay up to date with important developments via e-mail.
Stay up to date with life cycle policies for F-PROT Antivirus for Windows.
Virus news and information directly to your desktop.
Definitions of common antivirus terminology.
For further virus information, please try our partners' websites:

Authentium

perComp Verlag
(in German)
 

agoat@klaki.net argentina@f-prot.com argentina@frisk.is argentina@complex.is argentina@f-prot.is argentina@frisk-software.com argentina@f-prot.net argentina@f-prot.co.uk brazil@f-prot.com brazil@frisk.is brazil@complex.is brazil@f-prot.is brazil@frisk-software.com brazil@f-prot.net brazil@f-prot.co.uk malta@f-prot.com malta@frisk.is malta@complex.is malta@f-prot.is malta@frisk-software.com malta@f-prot.net malta@f-prot.co.uk a.bjani@f-prot.com a.bjani@frisk.is a.bjani@complex.is a.bjani@f-prot.is a.bjani@f-prot.co.uk a.bjani@frisk-software.com a.bjani@f-prot.net z.fifl@f-prot.com z.fifl@frisk.is z.fifl@complex.is z.fifl@f-prot.is z.fifl@f-prot.co.uk z.fifl@frisk-software.com z.fifl@f-prot.net strumpuri@complex.is strumpure@complex.is strumpuru@complex.is