{"id":5510,"date":"2018-11-14T16:00:41","date_gmt":"2018-11-14T10:30:41","guid":{"rendered":"https:\/\/antivirus.comodo.com\/blog\/?p=5510"},"modified":"2021-02-24T13:42:36","modified_gmt":"2021-02-24T08:12:36","slug":"codered-worm","status":"publish","type":"post","link":"https:\/\/antivirus.comodo.com\/blog\/comodo-news\/codered-worm\/","title":{"rendered":"What is Code Red Worm?"},"content":{"rendered":"

\"codered\"
\nCode red is a computer worm that was identified in July 2001, when computers running on Internet Information Services (IIS) web server of Microsoft were found compromised. The after effect of the attack caused a damage of billions of dollars in the summer of 2001.<\/p>\n

Marc Maiffret and Ryan Permeh employees of eEye Digital Security discovered this worm when it exploited an existing vulnerability discovered by Riley Hassell.<\/p>\n

The named the computer worm, “Code Red” is because they were drinking Code Red Mountain Dew when they confirmed it as a threat.<\/p>\n

It displays a text string “Welcome to worm.com Hacked by Chinese!” and it runs on the memory erasing all files present in the hard drive. It infected close to 359,000 hosts on July 19, 2001.<\/p>\n

Behaviour of Code Red<\/h2>\n

Code Red lands on the server in the form of GET \/default.ida request on on TCP port 80. By this way the code is developed to exploit a buffer overflow vulnerability in Microsoft’s Internet Information Server (IIS) which is the indexing software. By doing so the code runs within the IIS server. The worm virus<\/a> is completely run in the memory and cannot be found on the disk. It occupies 3,569 bytes.<\/p>\n

The payload of the worm comprised of:<\/p>\n