Unknown svchost.exe DNS port 53 network activity

No traffic can come to the machine, unless you have opened the inbound port by using port forwarding on the router, which allows unsolicited in bound traffic to reach a machine . The machine may or may not be listening on the forwarded port. On the other hand, if a computer has made a solicitation for inbound traffic by sending outbound traffic to a remote IP, then solicited traffic is going to be let back through the router or a firewall, because the machine behind them made the solicitation.

Svchost.exe which should be running out of the Windows/System32 directory, otherwise it's a Trojan, does nothing on its own. It does the bidding for the O/S and its programs and other programs as well, it does the hosting. Svchost allows the communication between machines in a LAN or WAN situation. However, you should be aware of what Svchost is connecting to as malware can be hosted by Svchost.exe as well.

I suspect the machine was just communicating with the ISP DNS servers as the machine with it's O/S have made the solicitation for traffic

Malware can circumvent and defeat every last bit of it.

How can that be? If you cutoff the traffic on port 53, then how is any machine with an application running where a URL is invloved, look up the WAN IP that belongs to the URL, an application such as a browser accessing the Web site that WAN IP points to? That's what the ISP''s Domain Name Server is for is to take a URL that has been given on its network and convert it to WAN IP so that an application can use the IP to go to a site.

It could be with a browser, that any Web page you're accessing has been cached on the machine and is why you're thinkng nothing is wrong.

If you suspect something, then use the proper tools and look for yourself. A tool like Process Explorer will let you look inside any running process and see the exe, dll, ect, ect or processes that are being hosted by a process such as Svchost.exe. I suspect there is nothing wrong with communications between a computer and the ISP's DNS server.

Long

Maybe the DNScache service? It shouldn't be listening on port 53, though. What's the output of "netstat -anob"?

Usually you'd inspect the traffic with a sniffer (e.g. Wireshark [1]) to get an idea of what's actually transmitted.

Could indeed be DNScache, but check the netstat output to make sure.