The best way to not get hit...

...is to not be anywhere?

In a not even vaguely bold move, Microsoft went and pulled all DNS for windowsupdate.com. They indicate how it's a smart move.

What they don't tell you is that the worm, given NO IP address to attack... will flood 255.255.255.255 -- a broadcast address, causing it to wreak more havoc on the infected system's segment than it would have before.

SO:
1) MS has a hole for years in their now heavily-code-reviewed software.
2) MS releases a patch and begs everyone to apply it
3) a worm comes out, which will target a DDoS attack at a prominent MS site just 6 days after release
4) MS pulls their address so the worm beats the daylight out of the local victim's network.

THANKS Microsoft!