Worm/CodeRed - Worm

Vea también

Descripción completa

Alias:	W32/CodeRed.a.worm
Type:	Worm
Size:
Origin:	unknown
Date:	07-25-2001
Damage:
VDF Version:
Danger:	Medium
Distribution:	High

Technical DetailsWorm/CodeRed uses a Microsoft IIS (Internet Information Server) security hole for its spreading. After the worm infects a server, it will look for other servers to invade.

There are some conditions, for the CodeRed to infect a system:
- Microsoft Windows NT 4.0 or Windows 2000 with IIS 4.0 or IIS 5.0
- Cisco CallManager, Unity Server, uOne, ICS7750, Building Broadband Service Manager

When the worm infects a computer, the file C:\notworm. appears. The CodeRed has the following payload:

1. The worm opens communication on TCP port 80 to 100 randomly chosen IP addresses and tries to send itself to them.
2. If the computer is on between the 20th and 28th of the month, CodeRed starts a DoS (Denial-of-Service) attack against an US Government website (www1.whitehouse.guv).
3. After the infection succeeded, the server is set again to English as standard language. Then, on all compromised sites will appear the following message:

HELLO! Welcome to http://www.worm.com! Hacked By Chinese!

Para una breve descripción vea el resumen aquí.

Descripción insertada por Crony Walker el Tue, 15 Jun 2004 14:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« volver