Win32/CodeRed.C Worm

 Information about the Win32/CodeRed.C worm:

Codered.C is an Internet worm and is a variant of Codered. This worm will infect Windows 2000/XP systems.

Codered.C infects in the similar manner as Codered. If the infected server language is Chinese, then it creates 600 threads and spreads for next 48 Hours. In other cases it creates 300 threads and spreads for next 24 Hours.

During infection this drops a backdoor trojan into the server there by giving full access to hackers. It copies the trojan to the root of C: or D: as EXPLORER.EXE. Next time when the user logs on to the infected server it starts changing the system settings. It also disables Windows File Protection. When the infected server is browsed remotely, trojan tries to publish the contents of C:\ and D:\. This makes necessary changes to the registry on the server, which allows full access to the remote user. To achieve this it modifies registry keys at:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\SFCDisable

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\Virtual Roots

The Codered.C first appeared in August 2001.

 Other names of Win32/CodeRed.C worm:

The worm is also known as W32/CodeRed.c, CodeRed.v3, CodeRed II.