Alert: New worm affecting corporate networks

By Victor Ng | Jan 8, 2009

2 comments

Facebook

LinkedIn

Digg

F-Secure has issued an alert about new versions of the "Downadup" worm, which infect Windows workstations and servers, causing various problems.

Since New Year, F-Secure has received several reports of corporate networks getting infected with variants of this worm. Information and network security experts are working closely with affected companies as well as with various CERT organizations to fight this worm outbreak.

Downadup (also known as Conficker) is large family of network worms. They are unusually difficult to remove, especially in the case of an internal infection inside a corporate network.

What to do to avoid infection

• Make sure latest Microsoft patches have been applied
• Make sure your organization is running the latest version of your antivirus product
• Check that the antivirus product has the latest updates
• Turn off AUTORUN and AUTOPLAY for USB sticks
• Make sure users domain passwords are strong
• Take extra care about the domain administrators’ passwords

What to do if your network is already infected

• Check your antivirus vendor’s website for disinfection instructions
• Disinfection of this worm is complex and could require shutting down parts of your network
• Restrict USB stick usage and block unnecessary traffic at your firewalls

What does the worm do?
Downadup uses several different methods to spread. These include using the recently patched vulnerability in Windows Server Service, guessing network passwords and infecting USB sticks.

2 comments

Facebook

LinkedIn

Digg