Symantec issues virus threat alert

As of 01 April 2009, systems infected with the latest version of the Downadup threat (W32.Downadup.C) will begin to use a new algorithm to determine what domains to contact.

Symantec Security Response experts have not detected any additional activities since the April 01 attack date, but is continuing to monitor for any new activities and will provide updates as they become available. Keep in mind that these systems could be updated on any date after April 1.

A mitigation option is now available to effectively bypass the Conficker domain blocking feature that prevents a user on an infected machine from accessing a security site to get a fix tool. The user can go to a DOS prompt and type “net stop dnscache” which disables the DNS cache. The user will get a message that the DNS client service is stopped and can proceed to access the security Web site or download the fix tool.

Symantec Security Response continues to remind users not to be alarmed, but to continue to exercise caution and implement security best practices into their daily routines. These best practices include keeping security patches current, keeping antivirus definitions up to date and being cautious when visiting suspicious Web sites or opening unexpected e-mails and e-mail attachments.