Worm/CodeRed - Worm

Vedi anche

Descrizione completa

Alias:	W32/CodeRed.a.worm
Type:	Worm
Size:
Origin:	unknown
Date:	07-25-2001
Damage:
VDF Version:
Danger:	Medium
Distribution:	High

Technical DetailsWorm/CodeRed uses a Microsoft IIS (Internet Information Server) security hole for its spreading. After the worm infects a server, it will look for other servers to invade.

There are some conditions, for the CodeRed to infect a system:
- Microsoft Windows NT 4.0 or Windows 2000 with IIS 4.0 or IIS 5.0
- Cisco CallManager, Unity Server, uOne, ICS7750, Building Broadband Service Manager

When the worm infects a computer, the file C:\notworm. appears. The CodeRed has the following payload:

1. The worm opens communication on TCP port 80 to 100 randomly chosen IP addresses and tries to send itself to them.
2. If the computer is on between the 20th and 28th of the month, CodeRed starts a DoS (Denial-of-Service) attack against an US Government website (www1.whitehouse.guv).
3. After the infection succeeded, the server is set again to English as standard language. Then, on all compromised sites will appear the following message:

HELLO! Welcome to http://www.worm.com! Hacked By Chinese!

Per la descrizione "in breve" clicca qui.

Descrizione inserita da Crony Walker il Tue, 15 Jun 2004 14:00 (GMT+1)

» Informazioni sul malware
» Informazioni sul phishing
» Viruses In the Wild

« Indietro