Microsoft might have made a blunder with one of their latest patches; MSO09-008.
This patch was intended to fix an issue with the way Windows handles DNS, WINs and the man-in-the-middle attacks.
Unfortunately if you have already been exposed to one and your system compromised the patch won't do you a whole lot of good. Microsoft is saying this is the expected behavior as the patch was meant to fix unaffected systems and not ones already compromised.
Read more here
Tyler Reguly, a researcher on nCircle's VERT team, pointed out that the patch checks to see which entries have been created in the DNS server and only adds block list entries for values not already being served.
Vole said the patch worked like it was supposed to, and was not meant to protect people who had already fallen to the exploit... so there