Threat Descriptions

Worm:W32/CodeRed.II

Classification

Category :

Malware

Type :

Worm

Platform :

W32

Aliases :

Worm:W32/CodeRed.II, IIS-Worm.CodeRed.c, Trojan.Win32.VirtualRoot, CodeRed.C, CodeRedII, Code Red gen 3

Summary

Worm:W32/CodeRed.II, also known as CodeRed.C, has been spreading in the wild since August 4th, 2001. It targets Microsoft IIS www servers, and does not pose a threat to end users.

Removal

First apply the neccesary security patches from Microsoft:

The first one fixes the vulnerability the worm uses to spread. The second one fixes the problem that makes Windows to run the trojanized 'explorer.exe' from the root folder. Both patches must be applied.

When the patches are applied the system has to be rebooted to eliminate the worm itself if it was still active. The following files must be deleted:

  • '\inetpub\scripts\root.exe'
  • '\progra~1\common~1\system\MSADC\root.exe'
  • '\explorer.exe'

These keys have to be removed:

  • 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\C'
  • 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\D'

The added ',217' string has to be removed from these keys:

  • 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\Scripts'
  • 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\MSADC'

A tool to perform the aforementioned actions is available at:

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

CodeRed II is a rewritten version of the original Code Red worm. It uses the same IIS hole to gain access on the web server and then continues to find new vulnerable systems.

Interestingly, Code Red II has been programmed to spread more aggressively in China than anywhere else. This might be in relation to the Chinese references in the original worm.

Backdoor

The most important feature of Code Red II is that it installs a backdoor into systems it infects. This is accomplished by copying the standard Windows NT/2000 command interpreter "cmd.exe" into web server's "scripts" directory. As a result, any web surfer can now execute commands on any infected www site just by typing suitable URLs to the web location. Below, a 'DIR' directory listing command has been executed.

Propagation

When a host gets infected it starts to scan for other hosts to infect. It probes random IP addresses but the code is designed so that probing of neighbour hosts is more probable.

If the infected system has the language set to Chinese the worm starts more aggressive scanning (600 threads instead of 300). The scanning runs for 24 hours after the infection (48 for Chinese machines) and then the system is rebooted.

There is a time limit in the code that will stop the worm on the 1st of October. At that time it will reboot the machine and stop spreading. The installed trojan still remains in the system! The worm drops a trojan program to '\explorer.exe' that modifies different some IIS settings to allow a remote attack of the infected host. The standard command interpreter 'cmd.exe' is copied to '\inetpub\scripts\root.exe' and to '\progra~1\common~1\system\MSADC\root.exe'. The worm creates these files to both 'C:' and 'D:' drives if they exist. These copies of the 'cmd.exe' will allow any attacker to execute commands on the remote system really easily.

Installation

First of all it disables the System File Checker (SFC) functionality in Windows. SFC is responsible for checking the integrity of system files.

Two new root directories are added to the IIS configuration: '/c' that points to 'c:\' and '/d' that points to 'd:\'.

This makes sure that even if the copies of 'cmd.exe' the worm made are removed the system can still be compromised.

Registry Changes

The following changes are made:

  • 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable'

is set to 0xffffff9d that disables the System File Checker. ',217' is appended to these keys:

  • 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\Scripts'
  • 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\MSADC'

These keys make 'C:' and 'D:' accessible trough the webserver:

  • 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\C'
  • 'SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots\C'

Note

The backdoor components that the worm drops into infected system are detected by F-Secure Anti-Virus with updates released at August 5th, 2001.