But doesn't that mean the hacker won?
If you change the DNS and a user can not get to
windowsupdate, you just helped him create a better
DoS than he had...
I have no affiliation with Microsoft, nor do I care about their services
or products. What I do care about is a worm that sends out packets
uncontrolled. If there is the possibility that this "planned" DOS will
cause issues with my topology, then I will do whatever it takes to stop
it. The fact that user's can't reach windowsupdate.com is irrelevant.