Code Red II
Computer worm
title: "Code Red II" type: doc version: 1 created: 2026-02-28 author: "Wikipedia contributors" status: active scope: public tags: ["exploit-based-worms", "hacking-in-the-2000s"] description: "Computer worm" topic_path: "general/exploit-based-worms" source: "https://en.wikipedia.org/wiki/Code_Red_II" license: "CC BY-SA 4.0" wikipedia_page_id: 0 wikipedia_revision_id: 0
::summary Computer worm ::
::data[format=table title="infobox computer virus"]
| Field | Value |
|---|---|
| type | Server jamming worm |
| :: |
| common_name = | technical_name = | alias = | family = | classification = | type = Server jamming worm | subtype = | isolation_date = | origin = | author = | ports_used = | platform = | file_size = | language = Code Red II is a computer worm similar to the Code Red worm. Released two weeks after Code Red on August 4, 2001, it is similar in behavior to the original, but analysis showed it to be a new worm instead of a variant. Unlike the first, the second has no function for attack; instead it has a backdoor that allows attacks. The worm was designed to exploit a security hole in the indexing software included as part of Microsoft's Internet Information Server (IIS) web server software (CVE-2001-0500).
A typical signature of the Code Red II worm appears in a web server log as:
GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX %u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801 %u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3 %u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0
While the original worm tried to infect other computers at random, Code Red II tries to infect machines on the same subnet as the infected machine.
Microsoft had released a security patch for IIS on June 18, 2001, that fixed the security hole, however not everyone had patched their servers, including Microsoft themselves.
References
References
- Microsoft. (2001-06-18). "Microsoft Security Bulletin MS01-033". Microsoft TechNet.
- Joris Evers. (2001-08-09). "Microsoft Sees Red: Worm Infects Its Own Servers". IDG News Service.
::callout[type=info title="Wikipedia Source"] This article was imported from Wikipedia and is available under the Creative Commons Attribution-ShareAlike 4.0 License. Content has been adapted to SurfDoc format. Original contributors can be found on the article history page. ::