* subscribe at http://techPolice.com

 Microsoft Releases Code Red Cleanup

By Brian McWilliams, Newsbytes
08 Aug 2001, 10:46 AM CST

 To undo the effects of an Internet worm that may have burrowed into hundreds of 
thousands of computers, Microsoft has released a new tool, Code Red Cleanup.
Available from the Microsoft Web site, the small utility is designed to "eliminate the 
obvious effects of the Code Red II worm" from infected Web servers, according to the 

First identified over the weekend, Code Red II exploits a recently identified weakness 
in Microsoft's Internet Information Server (IIS) software on Windows 2000 and Windows 
NT4 systems. The worm installs a "back door" on infected machines that allows 
attackers to remotely control them. The worm attempts to spread by scanning the 
Internet address space for other vulnerable servers.

In addition to eradicating malicious files installed by the worm, Code Red Cleanup 
reboots the system to eliminate memory-resident code. The tool also removes special 
settings known as "mappings" installed by the worm. Finally, the utility provides an 
option to permanently disable IIS on the server.

The cleanup tool does not install the patch released by Microsoft in June to correct 
the buffer-overflow bug in its Web server software.

While it can eliminate all traces of the Code Red II worm from an infected system, 
security experts and Microsoft warn that Code Red Cleanup may lull administrators into 
a false sense of security.

According to Simple Nomad, a security expert with Bindview Corporation's RAZOR team, 
the Microsoft utility does not eliminate the other malicious programs that might have 
been loaded on an infected system using the back door created by Code Red II.

"People right this second are manually scanning for these openings and uploading even 
more malicious code. I am surprised secondary worms to take advantage of these 
wide-open machines are not already running," said Simple Nomad.

According to the Computer Emergency Response Team (CERT) at Carnegie Mellon 
University, the best way to recover from system-level compromises such as a Code Red 
II infection is to reformat the drive, re-install software and apply appropriate 
security patches.

In its description of Code Red Cleanup, Microsoft acknowledges that the tool "does not 
eliminate any additional damage that other attacks may have caused while your server 
was infected." The company advises operators of Internet-connected servers to rebuild 
the infected systems from scratch, as well as any other servers at risk because of 
their proximity to the infected machines.

The release of Code Red Cleanup by Microsoft late Tuesday follows a public request 
from security experts for a way to swiftly protect infected systems and block the 
further spread of Code Red II.

On Sunday, Elias Levy, chief technology officer for SecurityFocus.com, posted a 
blueprint for such a tool on a security mailing list. Although not a perfect solution, 
such a tool was required, according to Levy, because many system administrators are 
unlikely to rebuild their systems and apply the patch.

"It's good to give them an easy option that at the very least closes the hole and hope 
that the machine had not yet been found by an attacker and modified further," wrote 
Levy, whose blueprint for the tool included installing the June Microsoft patch.

Despite Microsoft's quick response in releasing the tool, security experts remain 
concerned that many operators still may not even get around to cleaning up and 
patching their infected systems, much less taking them down and rebuilding them.

"I fear that most of the systems that are still unpatched may not get patched until 
the next service pack or even OS upgrade. If, after all this, people are still unaware 
of what's happening, then they simply are not paying attention or don't care," said 
Christopher Paul, a security consultant at Dedicated Technologies, an information 
technology consulting firm, who has been analyzing Code Red and its successors.

Microsoft's description of Code Red Cleanup is at 
http://www.microsoft.com/technet/itsolutions/security/tools/redfix.asp .

CERT's advisory on Code Red II is at 
http://www.cert.org/incident_notes/IN-2001-09.html .

Reported by Newsbytes, http://www.newsbytes.com .

10:46 CST
Reposted 11:03 CST

Save up to 80% on inkjet cartridges at 77Colors.com
FREE shipping to the USA & Canada by fast US Priority Mail.
Satisfaction Guaranteed! Easy online shopping & ordering:

--via http://techPolice.com
archive: http://theMezz.com/cybercrime/archive
subscribe: [EMAIL PROTECTED]
--via http://theMezz.com

EASY UNSUBSCRIBE click here: http://topica.com/u/?b1dhr0.b2EDp2
Or send an email To: [EMAIL PROTECTED]
This email was sent to: archive@jab.org

T O P I C A -- Register now to manage your mail!

Reply via email to