Code Red hits Hotmail

August 10, 2001

Microsoft Corp. has admitted that several systems hosting the MSN Hotmail service have been infected by variants of the Code Red worm.

Several of company's web-based mail servers were recently infected by the worm. Though a representative of the company said the infections have been eliminated, Microsoft is still studying the issue. According to the spokesperson no personal information of Hotmail users was breached.

Microsoft says that the problem has been solved however few security experts say some Hotmail servers remain infected today. According to the experts a number of Hotmail servers are infected with Code Red II, more malicious and virulent version of Code Red. The Code Red II leaves a Trojan on the infected server and enables a remote intruder to control the system.

The Hotmail compromise follows an infection of servers hosting Microsoft's Windows Update site by the original Code Red worm.

Few days ago Microsoft has releases Code Red Cleanup, the small utility designed to "eliminate the obvious effects of the Code Red II worm" from infected Web servers:
http://www.microsoft.com/technet/itsolutions/security/tools/redfix.asp

In addition to removing malicious files installed by the Code Red, the cleanup tool reboots the system to eradicate memory-resident code. The utility also removes special settings known as "mappings" installed by the worm. Eventually, the Code Red Cleanup provides an option to permanently disable IIS on the server. However the tool does not install the patch released by Microsoft in June to correct the buffer-overflow bug in its Web server software.

Meanwhile FBI is very serious about finding the authors of Code Red worms, that already cost $US2 billion in damage.

"We have 4,000 security professionals around the world who are giving us information," said a representative of FBI's National Infrastructure Protection Center (NIPC). "It's only a matter of time."

If the Code Red creator is not located in the U.S., the NIPC will alert local law enforcement and work with them to make sure the writer is held liable under local laws.