# MA-033.082001: MyCERT Advisory - "Code Red II" Worm

**Date:** 07 Aug 2001  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-033.082001  
**Advisory ID:** MA-033.082001

---

1.0 Description
#### 1.1 Overview
A new rapidly spreading Internet worm that exploits the same vulnerability as the previous [Code Red worm](/en/services/advisories/mycert/2001/main/detail/123/index.html) emerged over the weekend, and security experts are warning that it may be more malicious than the original.It was first discovered on Aug. 4,2001. It has been called a variant of the original CodeRed Worm because it uses the same "buffer overflow" exploit to propagate to other web servers.Many security organizations are assessing this worm to be a high threat.
#### 1.2 Aliases
Also Known As: CodeRed.C, CodeRed Version 3, CodeRed III,W32.Bady.C
#### 1.3 Payload
If the worms finds the CodeRedII atom on infected machine it will sleep forever or otherwise it places an atom and continues the infection process.Spawns 600 threads for propagation on Chinese language system within 48 hours and 300 threads will be spawn non Chinese language systemwithin 24 hours. Upon infection, it will copy CMD.exe to root.exe in IIS scripts and MSADC folders. It creates a Trojan horse named explorer.exe and calls the real explorer.exe to hide its presence. As a result, this will allow an intruder to gain root access through a backdoor on a compromised machine. The Trojan horse will activate every time a user logs in.
For detail description of the payload, please refer to:
http://www.cert.org/incident\_notes/IN-2001-09.html
### 2.0 Systems Affected
- Unpatched Windows 2000 running Microsoft IIS 4.0 or 5.0 are vulnerable to infection.
- Unpatched Windows NT, Cisco CallManager, Unity Server, uOne, ICS7750, Building Broadband Service.
- Manager and Cisco 600 series DSL routers may experience performance degradation.
### 3.0 Technical Matters
#### 3.1 How the worm works (as referred from Symantec and SecurityFocus)
When a web server becomes infected, the worm will first call its initialization routine that identifies the base address of kernel32.dll in the process address space of the ISS server service.
Next it looks for the address of GetProcAddress. Then it starts to call GetProcAddress to get access to a set of API addresses:
- LoadLibraryA
CreateThread
GetSystemTime
It will load WS2\_32.DLL to access functions such as socket, closesocket and WSAGetLastError. From USER32.DLL, it will get ExitWindowsEx that is used by the worm to reboot the system.
The main thread will check for two different markers:
1. ' 29A' marker which controls the installation of a trojan called Trojan.VirtualRoot.
2. A semaphor marker called 'CodeRedII'. If the semaphor exists, the worm goes into an infinite sleep.
Next, the main thread checks the default language. If the default language is Chinese (either Taiwan or PRC),it creates 600 new threads, and 300 threads for non Chinese language. These threads generate random IPs and favors the same address space as the current victim addresses used to search for new web server to infect.
While these threads are working, the main thread copies cmd.exe from the Windows NT System directory to thefollowing directories if they exist.
- c:\inetpub\scripts\root.exe
d:\inetpub\scripts\root.exe
c:\progra~1\common~1\system\MSADC\root.exe
d:\progra~1\common~1\system\MSADC\root.exe
If the trojan is dropped by the worm has modified the following registry (adding a few different keys and also setting the user group to 217), it will allow a hacker to take full control of the web server by sending an HTTP GET request to run scripts/root.exe on the infected web server.
- HKLM\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots
The main thread sleeps for 48 hours for Chinese language systems and 24 hours for non-Chinese language systems. The other 300 or 600 threads will still work and attempt to infect other systems. When the threads wake up from its sleep, it will cause the machine to be rebooted. In addition, all threads check if the date is October or if it is 2002. If so, the machine is rebooted.
The worm copies the command shell (cmd.exe) to the default execution enabled directory of the IIS web server allowing remote control. It will alsodrop a hidden, system and read-only attribute file into the root drive as either or both C:\EXPLORER.EXE or D:\EXPLORER.EXE. These trojan files are identified by Norton AntiVirus as Trojan.VirtualRoot. The worm carries this files inside itself in a packed format and unpacks it when its dropped.
The infection will last 24 or 48 hours and then the machine will be rebooted. However, the same machine can get infected again until it is patched with the latest update from Microsoft. If the date is October or if it is 2002,the machine will also be rebooted. When the machine is rebooted, Trojan.VirtualRoot will be executed when the system attempts to execute explorer.exe due to how Windows NT resolved or searches program path when executing a program.
The trojan (c:\explorer.exe) will sleeps for a few minutes and reset these keys to assure the registry keys are modified.It will alter the registry keyof WinLogon to disable SFC (system file checker).
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon SFCDisable key to 0xFFFFFF9D
The aftermath of the infection is that it will leave the infected machines open to remote connection and could allow an attacker to gain unauthorised access to the compromised machine.
#### 3.2 Attack Signatures
The Code Red II worm sends a very similar header which can be seen in the log as below:
/default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%
u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u909
0%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=aHTTP/1.0
The difference is that it uses X instead of N as its filler character compared to the previous Code Red worm.
### 4.0 Recovery
#### 4.1 Recovery Step
There are ways to remove this worm from an infected machine, the automatic removal and manual removal as explained below.
**4.1.1 For Automatic Removal**
4.1.1.1) Disconnect the infected machine from the network
4.1.1.2) Microsoft has developed a tool, Code Red II Cleaner which eliminates the obvious damage that is caused by the Code Red II worm.
Get the tool to remove the worm from an infected machine. Do not download this tool from the infected machine.You can download this tool using an uninfected machine and save it into a disk or media and run it on the infected machine.
The tool does the followings automatically:
- Removes the malicious files installed by the worm
- Reboots the system to clear the hostile code from memory
- Removes the mappings that the worm is currently known to install
- Provides an option to permanently disable Internet Information Server (IIS) on the server.
The URLs for the tool:
Code Red II Cleaner
http://www.microsoft.com/technet/treeview/default.asp?url= /technet/itsolutions/security/tools/redfix.asp
http://www.microsoft.com/Downloads/Release.asp?releaseID=31878
Note: Because of the way the worm functions, you should run the tool a second time after the server reboots.This will ensure the worm is eliminated no matter what state it was in when you ran the tool the first time.
**By this time the tool should have removed the worm from the infected machine. Next, you need to apply the latest patches from Microsoft.**
4.1.1.3) Apply the patches from Microsoft. Prior to applying patches, you need to apply latest service packs.
- For Windows NT 4.0 with IIS 4.0
First, apply Service Pack 6a. You can get it from your vendor or at the below url,
http://www.microsoft.com/ntserver/nts/downloads/recommended/SP6/allSP6.asp
followed by MS01-044 Cumulative Patch for IIS (Released: 15th August 2001),as per URL
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=32061
- For Windows 2000 with IIS 5.0
First, apply Service Pack 2 . You can get it from your vendor or at the below url.
http://www.microsoft.com/windows2000/downloads/servicepacks/sp2/
Followed by MS01-044 Cumulative Patch for IIS (Released: 15th August 2001)
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=32011
Note: The MS01-044 Cumulative Patch for IIS is a patch that supercedes the following security bulletins:
Further information on Microsoft Security Bulletin MS01-044 Cumulative Patch for IIS (released: 15th August 2001)
http://www.microsoft.com/technet/security/bulletin/ms01-044.asp
- - Microsoft Security Bulletin MS01-033
- Microsoft Security Bulletin MS01-026
**At this point, your server should be able to prevent future attacks or reinfection by Code Red II worm.You can scan your server with antivirus tools to scan for the presence of the worm in your server.**
4.1.1.4) Scan the machine with antivirus tool with an updated virus pattern
Tools offered by anti virus company for scanning this worm:
Mcafee
CyberCop WormScan
http://www.mcafeeasap.com/asp\_subscribe/trial\_cc.asp
Synmantec
Online scan
http://security1.norton.com/us/crdetect.asp?productid=sarc&langid=us&venid=sym
Scan local system
http://security1.norton.com/us/nav/common/common/bin/CRDetect.exe
Trendmicro
http://www.antivirus.com/vinfo/security/detect\_cr.exe
**4.1.2) For Manual Removal**
4.1.2.1) Disconnect from network.
Delete manually all copies of ROOT.EXE in your hard drive including mounted drive located at the following paths:
- C:\INETPUB\SCRIPTS\ROOT.EXE
C:\PROGRA~1\COMMON~1\SYSTEM\MSADC\ROOT.EXE
D:\INETPUB\SCRIPTS\ROOT.EXE
D:\PROGRA~1\COMMON~1SYSTEM\MSADC\ROOT.EXE
4.1.2.2) Delete manually the Trojan file(s) dropped by CODERED.C by issuing the following commands:
- ATTRIB C:\EXPLORER.EXE -H -A -R
DEL C:\EXPLORER.EXE
ATTRIB D:\EXPLORER.EXE -H -A -R
DEL D:\EXPLORER.EXE
4.1.2.3) Reboot the machine
4.1.2.4) To enable system file protection, reset to zero the following registry value:
- HKLM\SOFTWARE\Microsoft\WindowsNT\Current Version\WinLogon\SFCDisable
4.1.2.5) Remove or set to zero the following data located at
- HKLM\SYSTEM\CurrentContro\Set\Services\W3SVC\Parameters\Virtual Roots
/Scripts => remove if not needed and set to 0 if needed
/msadc => remove if not needed and set to 0 if needed
/c => removed
/d =>removed
4.1.2.6) Reboot the machine
**By this time you should have removed the worm from the infected machine. Next, you need to apply the latest patches from Microsoft.**
4.1.2.7) Follow the steps as in 4.1.1.3 for patches.
4.1.2.8) Scan the server with antivirus tool as mentioned in 4.1.1.4
**4.2 Other recommendations:**
1. Disconnect the machine from the network.
2. Do a clean format and installation in isolated LAN
3. Install latest service packs and patches from step 5.1.1.3 in isolated LAN
4. Harden host following the guidelines and checklist provided below:
http://www.microsoft.com/technet/treeview/default.asp? url=/technet/itsolutions/security/tools/tools.asp
or download and use IIS Lockdown Tool
http://www.microsoft.com/technet/treeview/default.asp? url=/technet/itsolutions/security/tools/locktool.asp
Note: If some applications requires these services which had been previously removed by Lockdown, the setup can be restored by having the undo files located at \win32\inetsrv\oblt-log can be used to recover previous settings.
### 5.0 Prevention
#### 5.1 Applying the latest patches
1. Microsoft Security Bulletin MS01-044 Cumulative Patch for IIS (Released: 15 August 2001)
http://www.microsoft.com/technet/security/bulletin/MS01-044.asp
#### 5.2 If you are using Proxy Server
You can filter Code Red at the server by following steps below:
**5.2.1 Cacheflow**
Mark Cather suggested the following strategy for using a Cacheflow web cache (posted to the Unisog mailing list):
We are using a Cacheflow web cache to filter out Code Red attacks. Cisco's WCCP protocol is allowing us to transparently redirect all inbound and outbound port 80 traffic through our web cache. With the following local filter entry on the cache engine:
http://.\*/.\*default.ida.\* service=no
all Code Red probes are being dropped.
5.2.2 Network Appliance
Apply the following ACL lists.
deny url matches "XXXXXXXXXX" for the Code Red version 3
deny url matches "NNNNNNNNNN" for the previous Code Red
### 6.0 More Information
More information on 'Code Red Version 3' worm can be obtained from the following sites:
Symantec
http://securityresponse.symantec.com/avcenter/venc/data/codered.ii.html
Securityfocus
http://www.securityfocus.com/frames/? content=/templates/article.html%3Fid%3D232
SANS
http://www.incidents.org/react/code\_redII.html
EEYE
http://www.eeye.com/html/Research/Advisories/AL20010804.html