Should I block it?

No, this file is 100% safe to run.

VersionsAdditional versions

6.3.9600.16384 (winblue_rtm.130821-1623) 0.82%
6.3.9600.16384 (winblue_rtm.130821-1623) 0.05%
6.3.9600.16384 (winblue_rtm.130821-1623) 0.63%
6.3.9600.16384 (winblue_rtm.130821-1623) 0.05%
6.3.9600.16384 (winblue_rtm.130821-1623) 2.27%
6.3.9431.0 (winmain_bluemp.130615-1214) 0.15%
6.3.9431.0 (winmain_bluemp.130615-1214) 0.05%
6.2.9200.16384 (win8_rtm.120725-1247) 0.82%
6.2.9200.16384 (win8_rtm.120725-1247) 0.68%
6.2.9200.16384 (win8_rtm.120725-1247) 1.65%
6.2.9200.16384 (win8_rtm.120725-1247) 11.33%
6.2.8400.0 (winmain_win8rc.120518-1423) 0.10%
6.2.8400.0 (winmain_win8rc.120518-1423) 0.10%
6.2.8250.0 (winmain_win8beta.120217-1520) 0.05%
6.2.8102.0 (winmain_win8m3.110823-1455) 0.10%
6.1.7600.16385 (win7_rtm.090713-1255) 29.33%
6.1.7600.16385 (win7_rtm.090713-1255) 2.86%
6.1.7600.16385 (win7_rtm.090713-1255) 1.26%
6.1.7600.16385 (win7_rtm.090713-1255) 2.42%
6.1.7600.16385 (win7_rtm.090713-1255) 3.24%
6.1.7600.16385 (win7_rtm.090713-1255) 14.91%
6.1.7600.16385 (win7_rtm.090713-1255) 2.23%
6.1.7600.16385 (win7_rtm.090713-1255) 0.77%
6.1.7600.16385 (win7_rtm.090713-1255) 0.05%
6.1.7600.16385 (win7_rtm.090713-1255) 0.19%
View more

PE structurePE file structure
Show functions
Import table
advapi32.dll
SetServiceStatus, ReportEventW, RegisterEventSourceW, RegisterServiceCtrlHandlerExW, RegCloseKey, RegQueryValueExW, RegSetValueExW, RegOpenKeyExW, RegEnumKeyExW, RegCreateKeyExW, RegDeleteKeyW, RegNotifyChangeKeyValue, IsValidSecurityDescriptor, FreeSid, SetSecurityDescriptorOwner, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, AddAccessAllowedAce, InitializeAcl, GetLengthSid, AllocateAndInitializeSid, AccessCheck, MapGenericMask, DeregisterEventSource, OpenThreadToken
api-ms-win-core-crt-l1-1-0.dll
memcmp, memcpy, memset, atoi, wcschr, wcsstr, _wcsicmp, _vsnwprintf_s, _vsnprintf_s, _except_handler4_common
api-ms-win-core-crt-l2-1-0.dll
_initterm_e, _initterm
api-ms-win-core-debug-l1-1-0.dll
OutputDebugStringA
api-ms-win-core-debug-l1-1-1.dll
OutputDebugStringA
api-ms-win-core-delayload-l1-1-0.dll
DelayLoadFailureHook
api-ms-win-core-delayload-l1-1-1.dll
DelayLoadFailureHook, ResolveDelayLoadedAPI
api-ms-win-core-errorhandling-l1-1-0.dll
GetLastError, SetLastError, SetUnhandledExceptionFilter, UnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-1.dll
UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetLastError, SetLastError
api-ms-win-core-file-l1-1-0.dll
FindFirstChangeNotificationW, FindNextChangeNotification
api-ms-win-core-file-l1-2-0.dll
FlushFileBuffers, FindNextChangeNotification, FindFirstChangeNotificationW
api-ms-win-core-handle-l1-1-0.dll
CloseHandle
api-ms-win-core-heap-l1-1-0.dll
HeapDestroy, GetProcessHeap, HeapFree, HeapCreate, HeapAlloc
api-ms-win-core-heap-l1-2-0.dll
GetProcessHeap, HeapDestroy, HeapFree, HeapAlloc, HeapCreate
api-ms-win-core-heap-obsolete-l1-1-0.dll
LocalAlloc, LocalFree
api-ms-win-core-interlocked-l1-1-0.dll
InterlockedDecrement, InterlockedIncrement, InterlockedExchange, InterlockedCompareExchange
api-ms-win-core-interlocked-l1-2-0.dll
InterlockedExchange, InterlockedCompareExchange, InterlockedIncrement, InterlockedDecrement
api-ms-win-core-libraryloader-l1-1-0.dll
LoadLibraryExW, GetProcAddress, DisableThreadLibraryCalls, LoadLibraryExA, FreeLibrary
api-ms-win-core-libraryloader-l1-1-1.dll
GetProcAddress, LoadLibraryExW, DisableThreadLibraryCalls, FreeLibrary
api-ms-win-core-localization-l1-1-0.dll
LCMapStringW
api-ms-win-core-localization-l1-2-0.dll
LCMapStringW
api-ms-win-core-localregistry-l1-1-0.dll
RegCloseKey, RegOpenKeyExW, RegQueryValueExW, RegEnumKeyExW, RegCreateKeyExW, RegDeleteKeyExW, RegQueryValueExA, RegOpenKeyExA, RegNotifyChangeKeyValue, RegSetValueExW
api-ms-win-core-misc-l1-1-0.dll
LocalFree, LocalAlloc, Sleep
api-ms-win-core-processenvironment-l1-1-0.dll
ExpandEnvironmentStringsW
api-ms-win-core-processenvironment-l1-2-0.dll
ExpandEnvironmentStringsW
api-ms-win-core-processthreads-l1-1-0.dll
GetCurrentProcess, CreateThread, GetCurrentThreadId, TerminateThread, OpenThreadToken, GetCurrentThread, GetCurrentProcessId, TerminateProcess
api-ms-win-core-processthreads-l1-1-1.dll
TerminateThread, GetCurrentProcessId, GetCurrentThread, OpenThreadToken, GetCurrentProcess, TerminateProcess, GetCurrentThreadId, CreateThread
api-ms-win-core-profile-l1-1-0.dll
QueryPerformanceCounter
api-ms-win-core-registry-l1-1-0.dll
RegEnumKeyExW, RegQueryValueExW, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegDeleteKeyExW, RegOpenKeyExW, RegOpenKeyExA, RegQueryValueExA, RegNotifyChangeKeyValue
api-ms-win-core-string-l1-1-0.dll
MultiByteToWideChar, CompareStringW, WideCharToMultiByte
api-ms-win-core-synch-l1-1-0.dll
DeleteCriticalSection, SetEvent, CreateEventW, WaitForSingleObject, InitializeSRWLock, AcquireSRWLockShared, AcquireSRWLockExclusive, ReleaseSRWLockShared, CreateEventA, ReleaseSRWLockExclusive, InitializeCriticalSection, WaitForMultipleObjectsEx, ResetEvent, EnterCriticalSection, LeaveCriticalSection
api-ms-win-core-synch-l1-2-0.dll
ReleaseMutex, CreateEventA, ReleaseSRWLockShared, AcquireSRWLockShared, InitializeSRWLock, AcquireSRWLockExclusive, WaitForMultipleObjectsEx, InitializeCriticalSection, LeaveCriticalSection, ResetEvent, EnterCriticalSection, DeleteCriticalSection, WaitForSingleObject, SetEvent, Sleep, CreateEventW, ReleaseSRWLockExclusive
api-ms-win-core-sysinfo-l1-1-0.dll
GetTickCount, GetSystemDirectoryW, GetSystemTimeAsFileTime, GetTickCount64
api-ms-win-core-sysinfo-l1-2-0.dll
GetSystemTimeAsFileTime, GetTickCount, GetSystemDirectoryW, GetTickCount64, GetLocalTime
api-ms-win-core-threadpool-l1-1-0.dll
UnregisterWaitEx
api-ms-win-core-threadpool-legacy-l1-1-0.dll
UnregisterWaitEx
api-ms-win-core-timezone-l1-1-0.dll
SystemTimeToFileTime
api-ms-win-core-util-l1-1-0.dll
EncodePointer, DecodePointer
api-ms-win-security-base-l1-1-0.dll
MapGenericMask, IsValidSecurityDescriptor, FreeSid, SetSecurityDescriptorOwner, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, AddAccessAllowedAce, InitializeAcl, GetLengthSid, AllocateAndInitializeSid, AccessCheck
api-ms-win-security-base-l1-2-0.dll
IsValidSecurityDescriptor, GetLengthSid, AllocateAndInitializeSid, GetTokenInformation, MapGenericMask, AccessCheck, FreeSid, SetSecurityDescriptorOwner, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, AddAccessAllowedAce, InitializeAcl
api-ms-win-security-sddl-l1-1-0.dll
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-service-core-l1-1-0.dll
RegisterServiceCtrlHandlerExW, SetServiceStatus
api-ms-win-service-core-l1-1-1.dll
RegisterServiceCtrlHandlerExW, SetServiceStatus
dhcpcsvc.dll
DhcpFreeLeaseInfo, DhcpQueryLeaseInfo, DhcpStaticRefreshParams
dhcpcsvc6.dll
Dhcpv6FreeLeaseInfo, Dhcpv6QueryLeaseInfo
dnsapi.dll
GetCurrentTimeInSeconds, NetInfo_IsAddrConfig, DnsGetProxyInfoPrivate, DnsGetPolicyTableInfoPrivate, NetInfo_GetAdapterByName, DnsFreePolicyConfig, DnsNameCompare_W, HostsFile_Open, HostsFile_ReadLine, HostsFile_Close, Dns_InitializeMsgBuf, Dns_ReadPacketName, Dns_SetRecordsSection, Dns_SetRecordsTtl, Dns_AddRecordsToMessage, Send_MessagePrivate, Dns_RecvTcp, Socket_RecvFrom, IpHelp_IsAddrOnLink, Local_GetRecordsForLocalNameEx, DnsQuery_W, NetInfo_GetAdapterByAddress, NetInfo_GetAdapterByInterfaceIndex, Socket_Create, Socket_JoinMulticast, Socket_SetMulticastLoopBack, Socket_TcpListen, Socket_SetTtl, Dns_AllocateMsgBuf, Socket_CloseEx, Dns_FreeMsgBuf, DnsStatusString, FlushDnsPolicyUnreachableStatus, Trace_Reset, NetInfo_UpdateServerReachability, NetInfo_ResetServerPriorities, NetInfo_Build, NetInfo_Copy, NetInfo_Clean, NetInfo_Free, Reg_ReadUpdateInfo, Reg_FreeUpdateInfo, DnsReplaceRecordSetW, ExtraInfo_Init, DnsModifyRecordsInSet_W, Update_ReplaceAddressRecordsW, Faz_AreServerListsInSameNameSpace, Reg_GetValueEx, Reg_ReadGlobalsEx, DnsGlobals, Security_ContextListTimeout, DnsLogInit, DnsApiFree, DnsApiRealloc, DnsApiAlloc, Socket_CacheInit, DnsTraceServerConfig, DnsLogTime, DnsLogIt, Socket_CacheCleanup, Query_Main, DnsUpdateMachinePresence, DnsLogEvent, NetInfo_CreatePerNetworkNetinfo, NetInfo_UpdateNetworkProperties, AddRefQueryBlobEx, Query_Cancel, DeRefQueryBlobEx, DnsQueryEx, DnsFree, DnsCancelQuery, DelaySortDAServerlist, Dns_CacheServiceInit, Dns_CacheServiceCleanup
iphlpapi.dll
SetCurrentThreadCompartmentId
kernel32.dll
TerminateThread, FindFirstChangeNotificationW, GetSystemDirectoryW, FindNextChangeNotification, GetCurrentThread, OutputDebugStringA, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, InterlockedIncrement, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InterlockedDecrement, Sleep, InitializeCriticalSection, WaitForMultipleObjects, GetTickCount, ResetEvent, CreateThread, HeapCreate, SetLastError, HeapAlloc, HeapFree, EnterCriticalSection, LeaveCriticalSection, WaitForSingleObject, GetProcessHeap, HeapDestroy, CreateEventW, InterlockedExchange, SetEvent, DeleteCriticalSection, GetLastError, InterlockedCompareExchange, UnregisterWait, CloseHandle, GetCurrentThreadId, WideCharToMultiByte, MultiByteToWideChar, CompareStringW, CompareStringA, LCMapStringW, LocalFree, GetCurrentProcess, LocalAlloc, CreateEventA
kernelbase.dll
CompareStringA
msvcrt.dll
DllMain
nsi.dll
NsiFreeTable, NsiGetParameter, NsiAllocateAndGetTable, NsiGetAllParameters
ntdll.dll
EtwTraceMessage, NtQueryInformationProcess, RtlCreateServiceSid, RtlInitUnicodeString, EvtIntReportEventAndSourceAsync, EtwEventRegister, RtlReleaseSRWLockExclusive, RtlAcquireSRWLockExclusive, RtlInitializeCriticalSection, RtlIpv6AddressToStringA, RtlIpv6AddressToStringExW, RtlIpv4AddressToStringExW, EtwGetTraceEnableFlags, EtwGetTraceEnableLevel, EtwGetTraceLoggerHandle, EtwRegisterTraceGuidsW, EtwUnregisterTraceGuids, EtwEventUnregister, RtlUnwind, RtlIdnToUnicode, RtlGUIDFromString, RtlFreeUnicodeString, RtlStringFromGUID, RtlIdnToAscii
rpcrt4.dll
RpcServerInqBindings, RpcEpUnregister, RpcBindingVectorFree, RpcServerUnregisterIf, RpcImpersonateClient, RpcRevertToSelf, RpcServerUseProtseqEpW, RpcServerRegisterIfEx, RpcBindingToStringBindingW, RpcStringFreeW, RpcStringBindingParseW, NdrServerCall2, RpcServerListen, RpcServerRegisterIf3, RpcServerSubscribeForNotification, RpcServerUnsubscribeForNotification, RpcAsyncCompleteCall, NdrAsyncServerCall
winnsi.dll
NsiConnectToServer, NsiRpcDeregisterChangeNotification, NsiDisconnectFromServer, NsiRpcRegisterChangeNotification
ws2_32.dll
WSACreateEvent, WSAEventSelect, WSASocketW, WSAIoctl, WSAResetEvent, WSASocketA
Export table
LoadGPExtension
Reg_DoRegisterAdapter
ServiceMain
SvchostPushServiceGlobals

dnsrslvr.dll

DNS Caching Resolver Service by Microsoft

Remove dnsrslvr.dll
Version:   6.1.7600.16385 (win7_rtm.090713-1255)
MD5:   33ef4861f19a0736b11314aad9ae28d0
SHA1:   4e0836fa4757ab07b1ebabe42dd3519268883aae
SHA256:   4c4b84365d85758e3263b88f157d8b086b392c6f1ea5f0f3db6bf87ef90248ec
This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is dnsrslvr.dll?

The caching resolver reduces DNS network traffic and speeds name resolution by providing a local cache for DNS queries.

About dnsrslvr.dll (from Microsoft)

“Name query responses are cached for the TTL specified in the response (not to exceed the value specified in the MaxCacheEntryTtlLimit registry entry (HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\”

DetailsDetails

File name:dnsrslvr.dll
Publisher:Microsoft Corporation
Product name:DNS Caching Resolver Service
Description:Microsoft® Windows® Operating System
Typical file path:C:\Windows\System32\dnsrslvr.dll
Original name:dnsrslvr.dll.mui
File version:6.1.7600.16385 (win7_rtm.090713-1255)
Product version:6.1.7600.16385
Size:129.5 KB (132,608 bytes)
Digital DNA
PE subsystem:Windows GUI
File packed:No
Code language:Microsoft Visual C# / Basic .NET
.NET CLR:Yes
.NET NGENed:No
More details

BehaviorsBehaviors

Hosted services
Runs as a shared service under the Windows svcHost
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'
  • Shared name is 'Dnscache'

Windows OS versionsDistribution by Windows OS

OS versiondistribution
Windows 7 Home Premium 52.50%
Windows 7 Ultimate 29.00%
Windows 7 Professional 10.50%
Windows 7 Home Basic 3.00%
Windows 7 Starter 1.50%
Windows 8 Pro 1.00%
Windows Vista Home Premium 0.50%
Windows 7 Enterprise 0.50%
Windows Se7en Titan 0.50%
Windows 8 Pro with Media Center 0.50%
Windows Vista Business 0.50%

Distribution by countryDistribution by country

United States installs about 40.40% of DNS Caching Resolver Service.

OEM distributionDistribution by PC manufacturer

PC Manufacturerdistribution
Dell 24.06%
ASUS 15.04%
Hewlett-Packard 14.29%
Acer 13.53%
Toshiba 11.28%
Sony 4.51%
Lenovo 4.51%
Samsung 2.26%
GIGABYTE 2.26%
Intel 2.26%
MSI 1.50%
Alienware 1.13%
Medion 0.75%
Gateway 0.75%
NEC 0.75%
Compaq 0.75%
Sahara 0.38%
Back to top
Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

Download it for FREE