[nsp-sec] FW: Storm worm changing DNS resolver settings on victim system

[John Kristoff]

On Thu, 13 Mar 2008 08:49:02 +0100
Florian Weimer <fweimer at bfk.de> wrote:

> For Zlob, it's trivial, see <http://support.microsoft.com/kb/158474>,
> under "DnsServerPort".  MacOS X supports "port" in /etc/resolv.conf,
> so it's equally straightforward.  It's probably a good idea to do this
> right now because it makes cleaning up more difficult.

I stand corrected, cool feature.  What do you mean by it being a good
idea to do this right now?  You mean we should do this in order to
learn how to deal with it?

John