Home / malware Worm:W32/CodeRed.II
First posted on 15 June 2010.
Source: SecurityHomeAliases :
There are no other names known for Worm:W32/CodeRed.II.
Explanation :
A standalone malicious program which uses computer or network resources to make complete copies of itself. May include code or other malware to damage both the system and the network.
Additional Details Worm:W32/CodeRed.II, also known as CodeRed.C, has been spreading in the wild since August 4th, 2001. It targets Microsoft IIS www servers, and does not pose a threat to end users.
CodeRed II is a rewritten version of the original Code Red worm. It uses the same IIS hole to gain access on the web server and then continues to find new vulnerable systems.
Interestingly, Code Red II has been programmed to spread more aggressively in China than anywhere else. This might be in relation to the Chinese references in the original worm.
Backdoor
The most important feature of Code Red II is that it installs a backdoor into systems it infects. This is accomplished by copying the standard Windows NT/2000 command interpreter "cmd.exe" into web server's "scripts" directory. As a result, any web surfer can now execute commands on any infected www site just by typing suitable URLs to the web location. Below, a 'DIR' directory listing command has been executed.
Propagation
When a host gets infected it starts to scan for other hosts to infect. It probes random IP addresses but the code is designed so that probing of neighbour hosts is more probable.
If the infected system has the language set to Chinese the worm starts more aggressive scanning (600 threads instead of 300). The scanning runs for 24 hours after the infection (48 for Chinese machines) and then the system is rebooted.
There is a time limit in the code that will stop the worm on the 1st of October. At that time it will reboot the machine and stop spreading. The installed trojan still remains in the system!
The worm drops a trojan program to '\explorer.exe' that modifies different some IIS settings to allow a remote attack of the infected host. The standard command interpreter 'cmd.exe' is copied to '\inetpub\scripts\root.exe' and to '\progra~1\common~1\system\MSADC\root.exe'. The worm creates these files to both 'C:' and 'D:' drives if they exist. These copies of the 'cmd.exe' will allow any attacker to execute commands on the remote system really easily.
Installation
First of all it disables the System File Checker (SFC) functionality in Windows. SFC is responsible for checking the integrity of system files.
Two new root directories are added to the IIS configuration: '/c' that points to 'c:\' and '/d' that points to 'd:\'.
This makes sure that even if the copies of 'cmd.exe' the worm made are removed the system can still be compromised.
Registry Changes
The following changes are made:
€ 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable'
is set to 0xffffff9d that disables the System File Checker.
',217' is appended to these keys:
€ 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\Scripts' € 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\MSADC'
These keys make 'C:' and 'D:' accessible trough the webserver:
€ 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\C' € 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\C'
Note
The backdoor components that the worm drops into infected system are detected by F-Secure Anti-Virus with updates released at August 5th, 2001.Last update 15 June 2010
