For instance, my ISP provides me with my DNS server - are you actually saying that there are servers higher up in the hierarchy underneath the root servers that serve MY DNS server, and hence me, with bogus website addresses? Does it only affect certain ISPs or even whole internet backbone providers? I suspect that this only affects people who have either had their PCs hacked and have had static entries put in their HOSTS file, or have local DNS servers compromised, or people who normally reconfigure their DNS for other purposes and dont use their ISPs DNS Servers. Lets have some more info about how this works in practice shall we El-Reg? Cheers. I would wager this Dagon character doesn't say, and doesn't really know. You're all missing the point! This article is about a CLIENT vulnerability! The malware is changing the DNS setting at the CLIENT (Windows) to make the CLIENT query the WRONG DNS server. You can secure your DNS server to the point of unplugging it and locking it in a bank vault 5 miles underground and it won't fix this problem. All of the servers are functioning as intended and designed (including the "bad" ones). Are they really saying..... that all malicious code has to do is replace the exiting resolv.conf (linux/unix variants) or the relevant windows file with bogus nameservers? This would mean that the 'bogus' namesevers only have to maintain a relevant record for sites they want to spoof i.e. www.mybank.com CNAME www.dodgysite.com