Code Red is a computer worm, and Code Red II is its rewritten version. This worm looks for a host for spreading itself. After infecting a host, it creates a backdoor for a remote unauthorized user so that he can access the infected system and take control over the victim’s PC.

Code Red is a worm, and Code Red II is its modified version. This worm searches for any vulnerability in the additional programs of Microsoft IIS Web server, so that it can spread itself.
It then uses the same IIS hole in order to gain access to a web server to continue looking for other vulnerable systems.
Virus Code Red makes use of a weakness called buffer overflow, in which it utilizes the repeated character ‘N’ to overflow a buffer. It executes any random code to infect the system.

Features of Virus Code Red and Code Red II

The most important feature of Code Red, of course, is its ability to install a backdoor into systems and then start infecting them.

In another instance, Virus Code Red tries to connect to a TCP port 80 from any arbitrary selected host. When it connects to port 80, it sends a HTTP Get request command to the victim, so that it can perform a buffer overflow. After that, it sends the same HTTP Get request command to other arbitrarily selected hosts.

In this way, IIS 4.0 and 5.0 servers, which are installed with Indexing service gets affected by Code Red.

Those systems, which have a HTTP server listing port 80, may accept the HTTP Get request command and respond with a “HTTP 400 Bad Request” message, and save this request in an access log.

The Code Red virus starts executing itself once it enters a computer system. A user can easily recognize its activities on a system if the following string is present in a Web server log file:

/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3% u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a

This string indicates that the Code Red worm made an attempt to infect the machine. When this happens, even the web pages on the victim’s system are affected and they will show the following message:

HELLO! Welcome to http://www.worm.com! Hacked By Chinese!

Virus Code Red degrades the performance of an infected system. Virus Code Red II also makes use of the same buffer overflow technique. After infecting any host, it also starts searching for other hosts.

Contact RPC and protect your computer from Virus Code Red and Code Red II.