|
|
IIS-Worm.CodeGreen. Viruses Information
| Name: |
IIS-Worm.CodeGreen. |
| Category: |
Viruses |
| Description:
|
Details
IIS-Worm.CodeGreen.a
This is an Internet worm that targets Web sites by infecting Internet Information Servers (ISS). The worm completes the method of spreading from one Web site to other Web sites by sending and executing its code on remote machines in a similar way to the "CodeRed" IIS worm.
This worm, like the "CodeRed" worm, randomly scans IP addresses and attacks remote IIS servers by using a buffer-overrun exploit.
The main feature of this worm is its "anti-worm" functions. Upon being run on infected machines, it cleans-up and:
erases traces of the "CodeRed" worm, then displays a message (see below)
downloads and spawns a Microsoft patch that fixes the problem with IIS worms of this type
The message is as follows:
Des HexXer's CodeGreen V1.0 beta
CodeGreen has entered your system
it tried to patch your system and
to remove CodeRedII's backdoors
You may uninstall the patch via
SystemPanel/Sofware: Windows 2000 Hotfix [Q300972]
get details at "www.microsoft.com".
visit "www.buha-security.de" |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Cinderella.390.
BuenDia.81
Delphine.761.
Win95.Zom.86
Lubak.46
BadSectors.315
SLH.30
ExeHeader famil
Macro.Word.Waverle
Codr.140
|
|
