6

I recently inherited a corporate network and one of the devices kept having errors connecting to mapped network drives with errors pertaining to the server time being different than the computer's time. This was not the case, but I found a form where people attributed that to using the wrong DNS server. I checked the DNS settings on the computer and to my surprise the DNS server was set to the loopback (127.0.0.1). I didn't realize windows computers had DNS servers installed on them.

First question, is this default windows behavior?

I used telnet to verify that there was actually a process accepting connections on 127.0.0.1:53 and it was.

Second question, should I be concerned about something like this from a malware perspective?

4

First, no, this is not default Windows behavior. Windows client operating systems do not ship with a DNS server. (Windows Server-based operating systems do, but not desktop/client OSes.)

Second, yes, you probably want to find out what service is listening on that port and take a much closer look at it. Step one is to run netstat -a -b from a command prompt or Powershell. This will list all of the current open connections and listening ports, and the applications associated with them. This should allow you to figure out which application or service is listening on UDP 53.

The fact that its running its own DNS server is not necessarily an indication of malware, but it certainly could be malware, so I wouldn't ignore it and would want to investigate it to understand it better.

  • 2
    Some antivirus launches its own protected DNS – schroeder May 4 '18 at 19:21
  • @schroeder I suspected that could be another possible cause, but hadn't seen it in practice. Good to know. – Xander May 4 '18 at 19:24
  • Sorry, I guess I didn't mean to ask if it is the default that windows computers run a DNS server, but do they come shipped with a DNS server that just needs to be turned on or something? – MikeSchem May 4 '18 at 21:26
  • @MikeSchem Nope, it would have to be 3rd party software. – Xander May 4 '18 at 21:59
  • 1
    @schroeder Yes, as an example, Webroot SecureAnywhere can be configured to use a local DNS proxy so that it can prevent malicious or blocked addresses from being resolved and, therefore, connected to. – mythofechelon Jan 3 at 16:45
2

It may be a Windows service called 'Internet Connection Sharing', which 'includes a local DNS resolver', as the Wikipedia article states. I have identified that this was the case for me by following Xander's answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.