Windows 10: How can I discover what app/process is stealing my bandwith (W10 Home)

Hi

I am in a remote part of the world with limited access to networking. I am using a 3G mobile/cell USB modem with cellphone sim card to get internet access. I only get 2.5GB allowance per month.
Every day when I first connect to the network, *something* on my computer downloads 130MB of data. Every day! This mystery app/process is using up my whole data allowance! How can I find out what it is and stop it, please?

I suspect it is these:
PID Address
scvhost.exe (netsvcs) 476 14.40.233.105
scvhost.exe (netsvcs) 476 14.40.233.112
scvhost.exe (netsvcs) 476 14.40.233.50
scvhost.exe (netsvcs) 476 14.40.233.106
scvhost.exe (netsvcs) 476 13.107.4.50

...as they all go crazy (network Bytes/second) in the Network view of Windows Resource Monitor while the download is happening.

Process Explorer by Sysinternals shows one scvhost.exe (C/Windows/System32/svchost.exe (netsvcs)) file getting very busy (CPU usage) at the time of the download. That particular svchost.exe has these processes associated with it:
Application Information [AppInfo]
Computer Browser [Browser]
Delivery Optimisation [DoSvc]
Geolocation Service[ifsvc]
IP Helper [iphlpsvc]
Remote Access Connnection Manager [RasMan]
Server [Lanman Server]
System Event Notification Service [SENS]
Shell Hardware Detection [ShellHWDetection]
Themes [Themes]
Task Scheduler [Schedule]
UserProfileService [ProfSvc]
User Manager [UserManager]
Windows Push Notifications System Service [WpnService]
Windows Management Instrumentation [Winmgmt]

When whatever-it-is has finished downloading its 130MB, it goes quiet and doesn't generate any more traffic until the next day.

The regular Windows 10 task mananger doesn't show any network traffic at all. I guess that it doesn't recognise my USB modem as a network interface.

I have turned off all the "auto-updates" I can think of (Avast, MBalwarebytes, Firefox extensions). Windows updates is set to "Do not Download over metered connections" I have even tried turning off Windows Updates entirely, (plus Skype Updates, Googleupdates) under "Services" in Control Panel.

How do I discover what it is that is doing the downloading and turn it off? thanks.


The machine shows-up as clean in Avast, MBalwarebytes scans.
OS: Windows 10 home, latest build.
Intel core i7 4500U processor.

:)

 

win 10 update and net speed

I updated to win 10 home version yesterday and I googled some and find that the system takes 80% of bandwith for apps and all and leaves 20% for browser and surfing so I tred to find how to disable this I found I need to type" gpedit.msc" in run

but I didn't have that as it s only available in win 10 pro so now I want that 80% of my bandwith back as I play game that need more bandwith and I don't really need to update any other apps or anything I need help quick

 

Shut down

How can I shut down without installing updates? I have Verizon Home Fusion (limited bandwith) and typically take my laptop to a friend's to do updates. Starting yesterday, the option to shutdown includes installing updates?

 

NetLimiter Homepage
may help.

Bear in mind your universal apps update regularly (4 hourly scheduled task) and there's this:

 

For those who want more info's about the under-the-hood processes/bandwidth get the FREE M$ sys-internals suit!

Check it out @ Sysinternals Suite

Greetz

 

You may have already tried this, but does Data Usage in Settings say anything helpful?
Network Data Usage - View in Windows 10

 

Thanks, will give it a go.

Can I change that - it turns out my problem is actually occurring several times a day, not just once.

Yes, hardly ever launch any of those, but have turned off all the 'run in background' switches now.

 

THanks, already using the "Process Explorer" part of that (which unless I'm mistaken is more for CPU usage than network traffic). I will give the full suite a look!

 

Reply - thanks. It only reports some wireless LAN traffic I had early in the month, it doesn't seem to see the traffic from when I use my usb modem *Sad

 

You could try launching e.g. Sysinternals TCPView at logon as a scheduled task - run it manually first to get a feel. There may be some other tool in the suite- it's extensive.

 

Netlimiter supports my assumption that it this svchost.exe which contains the problem.

It is seen as Process ID/PID 1028 in Netlimiter.

Netlimiter lets me throttle PID1028's download speed, or to manually kill its connections (upon which the process just hunts round for a new ip/server and continues downloading).


btw, it seems you can add columns to the regular Task manager to see the PID and Processname and the underlying Services.



also link


However, I still can't find a way of seeing which _service_ is accounting for the network traffic. Windows Update seems an obvious contender and I have disabled Windows Update and 'Update Orchestrator for Windows Updates' to no avail. I'm a bit nervous about disabling some of the others, e.g. Winmgmt- "if this service is stopped, most Windows-based software will not function properly" (!)


The Task Scheduler entries for Windows Updates
task scheduler>WindowsUpdate>Automatic>AppUpdate (Windows Store apps) daily at 01H30; 04H56; 07H08 +?
task scheduler>Scheduled Start (sc.exe) (13H16 daily)
task scheduler>sih (server initiated healing (sihclient.exe)) 20H00 daily

...are all showing as "Ready" (not "Disabled"), despite Windows Update being disabled in Services.

It also seems to be possible to configure them to only trigger when connected to a particular network. By default and currently, they are set to run on "any network connection", despite Windows Settings being set to "do not download over metered connections". I haven't started playing with that yet. I wonder if there is any point in doing so if Windows Updates is supposedly disabled entirely.

----

So, this is just an update on my progress, I guess. For now, I have a sort of workaround (Netlimiter allows me to cap the download speed to a crawl, but doesn't stop it entirely), but I haven't been able to isolate or stop the actual Service causing the traffic...

Any further thoughts ?

TIA *Smile

 

You could try launching e.g. Sysinternals TCPView at logon as a scheduled task - run it manually first to get a feel. There may be some other tool in the suite- it's extensive.

As per my #8.

 

Yes you can! To check what's eating your bandwidth you need to download the full suite and use the TCPVIew! Hope this helps you to tackle your issue. Good luck.

Greetz

 

Hi

Yer, I looked at that, but I couldn't see how it would help me. It shows me the Process ID of the svchost.exe that is generating the traffic (which I already know from two other sources) and the ten-ish ips which is connecting to, but not which of the 16 underlying Services [AppInfo][Browser][DoSvc][ifsvc][iphlpsvc][RasMan][Lanman Server][SENS][ShellHWDetection][Themes][Schedule][ProfSvc][UserManager][WpnService][Winmgmt] is generating the traffic.

TCPView only gives me options to close each connection (which just pops back up a minute later), or kill the (entire) Process (which presumably includes all 16 Services). Doing so kills the whole dial-up connection (which is presumably not surprising as Service "RasMan" (which runs the modem) has been stopped).

How would TCPView help me identify the (root) source of the traffic (and stop it) please ?

 

networking - Identifying Windows service generating network traffic - Super User

may help