Unknown svchost.exe DNS port 53 network activity

Giganews Newsgroups
Subject: Unknown svchost.exe DNS port 53 network activity
Posted by:  Raffi (thegrizzz…@yahoo.com)
Date: 20 Dec 2006

First off sorry for cross posting. I'm not sure what this is although
it resembles a trojan.

I noticed heavy activity on my router as well as my workstation LAN
connection icon in the tray. After some digging appears to be a svchost
process that is listening on port 53 with a remote address of my ISP's
DNS server. My router is not set to forward DNS traffic to a specific
system.

I have run the following without any success in catching this bug

AntiVir antivirus
Avast antivirus
Spybot S&D
Ad Aware
AVG antispyware

I got the following information for the related process from Port
Explorer

Command line: c:\windows\system32\svchost.exe -k Network Service

Any help in identifying this bug and cleaning will be greatly
appreciated.

Thanks,
Raffi

Replies