Windows 10: Constant Network Activity with No Processes Using Network

Hi! Just noticed this problem about a week and a half ago, but assumed it was probably just Windows force-downloading the update that dropped today. But I've installed the update now and I'm still constantly receiving 88-100 Kbps down. Resource monitor shows no processes using the network and there are no active TCP connections. I've tried using Glasswire and Wireshark to determine what is constantly being downloaded but have since been unable to determine what it is.

I've run full system scans with Avira Free, Malwarebytes 3, Hitman Pro, ESET online scanner, and RogueKiller. I've also run multiple adware cleaners but still the problem persists. netstat (-b/a/n) offered no useful information and showed no active connections even while I was sitting and looking at the Task Manager showing 88kbps being received.

I've updated drivers and Windows to the current available stable versions and still the problem persists.

Running Windows 10 (1703 - 15063.483) with AMD FX-6300 cpu and Radeon R270.

Any ideas on what could be causing this or methods for determining what is causing it would be greatly appreciated!

:)

 

SearchUI.exe (Cortana) is Constantly Accessing the Internet

As I've said, there are constant network activities ONLY when web search is enabled, and when it's disabled, the search window misbehaves; i.e., the Cortana process tries to initiate itself, causing the search window to close after a few
seconds of opening -- according to Task Manager.

I'm using Kaspersky Internet Security.

Thanks.

 

Constant network activity by svchost.exe (netsvcs)

The link no longer works. It just takes you to the error section.

 

A lot of that traffic is just keep alive pings from the machine to your gateway and gateway to your machine. The rest can be NTP, etc. while it is just sitting idle to communicate. If the system is clean, no need to worry. If you want to see what is going on on the Gateway side, just look at the logs. As for Windows, you can use the Sysinterrnals TCPView, which you can read about and download at TCPView for Windows

 

Thanks for the reply! While I do believe that Wireshark showed me something similar to what you said, I don't understand why I just started seeing this less than two weeks ago. I check regularly to see what's happening on the network and that just started occurring then, not coinciding with a windows update of any sort that I'm aware of. As far as NTP is concerned, why would it need a continuous stream that large to keep the system clock synced? Wouldn't like one ping an hour at the most be enough for that?

Also not very experienced with networking, what are these Gateway logs you're referring to?

 

Wireshark is for sniffing packet traffic to see what it contains. TCPView will show you what ports with what IP's are being used. You will see various ports pinging as normal traffic, with heartbeats taking up the majority of those streams. The Gateway logs are on the gateway that allows you to connect to the Internet.

 

I gotcha. Would constant ARP broadcasts that I've been getting recently have any effect on my situation?

 

You would need to use TCPView for the answer of your question.