A new twist in DNS-changing malware poisons other hosts on a local subnet, and installs a rogue DHCP server.