Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am experiencing very huge problem. I have 4 computers in network, and from each a lot of data is being sent to ISP name servers. Sometimes data is being sent a little from each computer in network, sometimes it is just a lot of data from one computer.

I have antivirus (Avast) and malware scan (SpyBot)

I know port 53 UDP is dns which resolves domain IP so its' needed.

Also I have read that ISP name server might have been infected.

So what is the best thing to do in this situation.

Also sometimes internet starts to lag really because of port 53

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

Without having more detail it's difficult to know if you have a problem. Ideally, you would need to analyse the traffic to determine the nature, i.e. which names are being requested. This could be done by using something like Wireshark

If the volume is significantly large, it could be an indicator that one or more of your PC's has become part of a 'botnet' and is being actively used to send 'spam' I appreciate you have Avast and spybot, unfortunately, botnet activity can be very difficult to discover. It mosr cases more sophisticated utilities may be required for analysis. Scanning with GMER - Rootkit Detector and Remover would be a useful exercise.

Another option you could try is changing your DNS servers to one of the free services such as:

http://code.google.com/speed/public-dns/ or http://www.dyndns.com/

share|improve this answer
    
How can I use wireshark to determine if it's botnet? –  DanSpd May 25 '10 at 5:12
    
I just changed DNS server to google ones and in router internet sessions i can see a lot of sessions open to google dns server now on port 53 –  DanSpd May 25 '10 at 5:16
    
The wireshark analysis cold provide more insight into the nature of the traffic being generated. if you're using a firewall, can you configure it to log DNS traffic? It would be helpful to know which names are being resolved. You could also check your IP address against this database whatismyipaddress.com/blacklist-check –  Pulse May 25 '10 at 5:46
    
unplug each computer one at a time until you find the one doing all the spamming. Then run wireshark on it, then check the capture and see what the DNS queries are doing –  frymaster May 25 '10 at 8:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.