Win32/CodeRed Worm

 Information about the Win32/CodeRed worm:

Codered is an Internet worm. This worm will infect Windows NT and Windows 2000 systems, if IIS (Internet Information Service) is installed.

This worm exploits the vulnerability of buffer overflow (Unchecked Buffer) under Index server. When the worm is run, it replicates itself in the memory. Using the replicated copies in the memory, worm tries to infect other IIS servers. Worm achieves this by generating random server addresses. It uses port 80 to spread across the servers.

If the current system date is in between 20th and 28th, then it tries connecting www.whitehouse.gov government site. It also defaces the web pages on the infected server by setting the current language to US English and with the following contents:

Welcome to http://www.worm.com !
Hacked By Chinese!

The Codered first appeared in July 2001.

 Other names of Win32/CodeRed worm:

The worm is also known as W32/Bady.worm, HBC.