RE: msblast DDos counter measures

[Laurent LEVIER <llevier () argosnet com>]

Marc,

> therefore keeping machines from using windows update to get patches.
Because I have 15 000 machines to tell that...

> the worm only hits windowsupdate.com
Glancing at multiple internet sites, the 2 main sites were mentionned, and 
so in doubt...

But it is not a very problem. Once we will be 100% sure of what DNS name is 
used, we could remove the other "redirected" DNS.
15 minutes after, the record will become valid again.

Brgrds

Laurent LEVIER
IT Systems & Networks Security Expert



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html