CodeGreen combats Code Red

September 7, 2001

A German coder calling himself Herbert HexXer released source code for a new worm called CodeGreen, which is designed to combat the Code Red.

CodeGreen works by running on a system and waiting for Code Red to attack that system. When CodeGreen detects a Code Red attack, it launches a counterattack that removes Code Red and installs a copy of CodeGreen on the attacking system.

Furthermore CodeGreen determines the system's language and then downloads the Code Red patch from Microsoft to close the vulnerability. The CodeGreen worm also scans for other systems that Code Red has infected and attempts to patch those systems also.

Like a Code Red, CodeGreen is memory resident only, which means that rebooting the system removes the worm. The creator of CodeGreen said that although he has successfully tested the code on German language systems, he's doubtful whether CodeGreen is effective on non-German language systems.