Port 53 UDP Outgoing flood

Question

I am experiencing very huge problem. I have 4 computers in network, and from each a lot of data is being sent to ISP name servers. Sometimes data is being sent a little from each computer in network, sometimes it is just a lot of data from one computer.

I have antivirus (Avast) and malware scan (SpyBot)

I know port 53 UDP is dns which resolves domain IP so its' needed.

Also I have read that ISP name server might have been infected.

So what is the best thing to do in this situation.

Also sometimes internet starts to lag really because of port 53

Answer 1

Without having more detail it's difficult to know if you have a problem. Ideally, you would need to analyse the traffic to determine the nature, i.e. which names are being requested. This could be done by using something like Wireshark

If the volume is significantly large, it could be an indicator that one or more of your PC's has become part of a 'botnet' and is being actively used to send 'spam' I appreciate you have Avast and spybot, unfortunately, botnet activity can be very difficult to discover. It mosr cases more sophisticated utilities may be required for analysis. Scanning with GMER - Rootkit Detector and Remover would be a useful exercise.

Another option you could try is changing your DNS servers to one of the free services such as:

http://code.google.com/speed/public-dns/ or http://www.dyndns.com/