Symantec ThreatCon level raised to HIGH.

Greeting's

Okay life's going bit easy now Microsoft released the patch earlier then said. Infocon (SANS) level is back to green, symantec's norton anti-virus is FINALLY able to catch at least one type of WMF exploit and it all seems good UNTIL I see that symantec has just raised the level of it's Threatcon to high. I cant get the reason nor do I see any new exploit either being made public or now one's found out (except windows 2000's hole release on 12 of December is now public)

Anyone got any idea why symantec has raised the level even after the patch being released.

Perhaps it the better late then never aproach..

Quote:

---

This condition applies when an isolated threat to the computing infrastructure is currently underway or when malicious code reaches a severe risk rating. Under this condition, increased monitoring is necessary, security applications should be updated with new signatures and/or rules as soon as they become available and redeployment and reconfiguration of security systems is recommended. People should be able to maintain this posture for a few weeks at a time, as threats come and go.

---

It's proppably their way of saying: "Patch up, and update"
I think it has to do with the 'Now there is something to do, so go do it' instead of 'There is something out there, we don't know what to do' feel..
It's not a techy meter, like the SANS ISC Infocon..
It's a public anouncement..