9

I recently inherited a corporate network and one of the devices kept having errors connecting to mapped network drives with errors pertaining to the server time being different than the computer's time. This was not the case, but I found a form where people attributed that to using the wrong DNS server. I checked the DNS settings on the computer and to my surprise the DNS server was set to the loopback (127.0.0.1). I didn't realize windows computers had DNS servers installed on them.

First question, is this default windows behavior?

I used telnet to verify that there was actually a process accepting connections on 127.0.0.1:53 and it was.

Second question, should I be concerned about something like this from a malware perspective?

2 Answers 2

6

First, no, this is not default Windows behavior. Windows client operating systems do not ship with a DNS server. (Windows Server-based operating systems do, but not desktop/client OSes.)

Second, yes, you probably want to find out what service is listening on that port and take a much closer look at it. Step one is to run netstat -a -b from a command prompt or Powershell. This will list all of the current open connections and listening ports, and the applications associated with them. This should allow you to figure out which application or service is listening on UDP 53.

The fact that its running its own DNS server is not necessarily an indication of malware, but it certainly could be malware, so I wouldn't ignore it and would want to investigate it to understand it better.

5
  • 4
    Some antivirus launches its own protected DNS
    – schroeder
    May 4, 2018 at 19:21
  • @schroeder I suspected that could be another possible cause, but hadn't seen it in practice. Good to know.
    – Xander
    May 4, 2018 at 19:24
  • Sorry, I guess I didn't mean to ask if it is the default that windows computers run a DNS server, but do they come shipped with a DNS server that just needs to be turned on or something?
    – MikeSchem
    May 4, 2018 at 21:26
  • @MikeSchem Nope, it would have to be 3rd party software.
    – Xander
    May 4, 2018 at 21:59
  • 1
    @schroeder Yes, as an example, Webroot SecureAnywhere can be configured to use a local DNS proxy so that it can prevent malicious or blocked addresses from being resolved and, therefore, connected to. Jan 3, 2019 at 16:45
3

It may be a Windows service called 'Internet Connection Sharing', which 'includes a local DNS resolver', as the Wikipedia article states. I have identified that this was the case for me by following Xander's answer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .