Windows 10: svchost.exe intensive network usage

Discus and support svchost.exe intensive network usage in Windows 10 Network and Sharing to solve the problem; Hi everybody, I have high network usage problems with some services in windows: this is a screenshot of the problem (the process highlighted is... Discussion in 'Windows 10 Network and Sharing' started by Jymmy097, Oct 27, 2016.

  1. Jymmy097 Win User

    svchost.exe intensive network usage


    Hi everybody,

    I have high network usage problems with some services in windows: this is a screenshot of the problem (the process highlighted is called "Service Host: Local system" in English).

    svchost.exe intensive network usage [​IMG]

    Does anybody know how to limit the bandwidth those services can use or, in alternative, how to fix the problem: I cannot browse the internet fast anymore with those services eating all my bandwidth (yes, my maximum bandwidth is VERY low).

    Thank you very much.



    :)
     
    Jymmy097, Oct 27, 2016
    #1

  2. svchost.exe / service host : local system ( network restricted ) high usage memory and CPU

    When you open Task Manager a little bit, you’ll see that svchost.exe service host: local system (network restricted) is causing the problem of high CPU usage. To improve your Windows performance, and get rid of the high CPU usage, you
    have to disable Superfetch service. Superfetch used to pre-load data from hard disk into RAM memory. So let's follow this steps.

    Fix svchost.exe service host: local system (network restricted)
     
    dedyprasetiyo724, Oct 27, 2016
    #2
  3. Windows 10 boots up with black screen with blinking cursor and then loads up windows like normal (why is their a black screen)

    Process ID 1544

    User kjack

    Domain DESKTOP-4FN22AL

    Path C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe

    Memory Usage 4.74 MB

    Peak Memory Usage 15 MB

    steamwebhelper.exe

    Process ID 3932

    User

    Domain DESKTOP-4FN22AL

    Path C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe

    Memory Usage 9.05 MB

    Peak Memory Usage 33 MB

    svchost.exe

    Process ID 1424

    User SYSTEM

    Domain NT AUTHORITY

    Path C:\Windows\System32\svchost.exe

    Memory Usage 19 MB

    Peak Memory Usage 32 MB

    svchost.exe

    Process ID 1648

    User SYSTEM

    Domain NT AUTHORITY

    Path C:\Windows\System32\svchost.exe

    Memory Usage 7.23 MB

    Peak Memory Usage 14 MB

    svchost.exe

    Process ID 1556

    User LOCAL SERVICE

    Domain NT AUTHORITY

    Path C:\Windows\System32\svchost.exe

    Memory Usage 5.99 MB

    Peak Memory Usage 13 MB

    svchost.exe

    Process ID 1448

    User LOCAL SERVICE

    Domain NT AUTHORITY

    Path C:\Windows\System32\svchost.exe

    Memory Usage 3.25 MB

    Peak Memory Usage 7.87 MB

    svchost.exe

    Process ID 2104

    User SYSTEM

    Domain NT AUTHORITY

    Path C:\Windows\System32\svchost.exe

    Memory Usage 16 MB

    Peak Memory Usage 20 MB

    svchost.exe

    Process ID 1188

    User LOCAL SERVICE

    Domain NT AUTHORITY

    Path C:\Windows\System32\svchost.exe

    Memory Usage 16 MB

    Peak Memory Usage 30 MB

    svchost.exe

    Process ID 1124

    User LOCAL SERVICE

    Domain NT AUTHORITY

    Path C:\Windows\System32\svchost.exe

    Memory Usage 19 MB

    Peak Memory Usage 82 MB

    svchost.exe

    Process ID 480

    User LOCAL SERVICE

    Domain NT AUTHORITY

    Path C:\Windows\System32\svchost.exe

    Memory Usage 17 MB

    Peak Memory Usage 25 MB

    svchost.exe

    Process ID 5976

    User LOCAL SERVICE

    Domain NT AUTHORITY

    Path C:\Windows\System32\svchost.exe

    Memory Usage 3.80 MB

    Peak Memory Usage 6.89 MB

    svchost.exe

    Process ID 392

    User SYSTEM

    Domain NT AUTHORITY

    Path C:\Windows\System32\svchost.exe

    Memory Usage 52 MB

    Peak Memory Usage 278 MB

    svchost.exe

    Process ID 1020

    User SYSTEM

    Domain NT AUTHORITY

    Path C:\Windows\System32\svchost.exe

    Memory Usage 116 MB

    Peak Memory Usage 145 MB

    svchost.exe

    Process ID 892

    User NETWORK SERVICE

    Domain NT AUTHORITY

    Path C:\Windows\System32\svchost.exe

    Memory Usage 8.85 MB

    Peak Memory Usage 12 MB

    svchost.exe

    Process ID 4700

    User LOCAL SERVICE

    Domain NT AUTHORITY

    Path C:\Windows\System32\svchost.exe

    Memory Usage 3.30 MB

    Peak Memory Usage 6.92 MB

    svchost.exe

    Process ID 1272

    User NETWORK SERVICE

    Domain NT AUTHORITY

    Path C:\Windows\System32\svchost.exe

    Memory Usage 12 MB

    Peak Memory Usage 18 MB

    svchost.exe

    Process ID 9932

    User SYSTEM

    Domain NT AUTHORITY

    Path C:\Windows\System32\svchost.exe

    Memory Usage 8.68 MB

    Peak Memory Usage 9.71 MB

    svchost.exe

    Process ID 824

    User SYSTEM

    Domain NT AUTHORITY

    Path C:\Windows\System32\svchost.exe

    Memory Usage 14 MB

    Peak Memory Usage 23 MB

    svchost.exe

    Process ID 3080

    User

    Domain DESKTOP-4FN22AL

    Path C:\Windows\System32\svchost.exe

    Memory Usage 19 MB

    Peak Memory Usage 34 MB

    System

    Process ID 4

    Memory Usage 1.64 MB

    Peak Memory Usage 17 MB

    System Idle Process

    Process ID 0

    SystemSettings.exe

    Process ID 6824

    User kjack

    Domain DESKTOP-4FN22AL

    Path C:\Windows\ImmersiveControlPanel\SystemSettings.exe

    Memory Usage 15 MB

    Peak Memory Usage 67 MB

    taskhostw.exe

    Process ID 3148

    Domain DESKTOP-4FN22AL

    Path C:\Windows\System32\taskhostw.exe

    Memory Usage 11 MB

    Peak Memory Usage 36 MB

    wininit.exe

    Process ID 572

    User SYSTEM

    Domain NT AUTHORITY

    Path C:\Windows\System32\wininit.exe

    Memory Usage 1.20 MB

    Peak Memory Usage 5.15 MB

    winlogon.exe

    Process ID 736

    User SYSTEM

    Domain NT AUTHORITY

    Path C:\Windows\System32\winlogon.exe

    Memory Usage 4.85 MB

    Peak Memory Usage 17 MB

    WinStore.App.exe

    Process ID 7980

    Domain DESKTOP-4FN22AL

    Path C:\Program Files\WindowsApps\Microsoft.WindowsStore_11610.1001.23.0_x64__8wekyb3d8bbwe\WinStore.App.exe

    Memory Usage 3.39 MB

    Peak Memory Usage 62 MB

    WmiPrvSE.exe

    Process ID 7156

    User NETWORK SERVICE

    Domain NT AUTHORITY

    Path C:\Windows\System32\wbem\WmiPrvSE.exe

    Memory Usage 18 MB

    Peak Memory Usage 29 MB

    WmiPrvSE.exe

    Process ID 5228

    User SYSTEM

    Domain NT AUTHORITY

    Path C:\Windows\System32\wbem\WmiPrvSE.exe

    Memory Usage 24 MB

    Peak Memory Usage 37 MB

    WmiPrvSE.exe

    Process ID 2172

    User LOCAL SERVICE

    Domain NT AUTHORITY

    Path C:\Windows\System32\wbem\WmiPrvSE.exe

    Memory Usage 7.43 MB

    Peak Memory Usage 12 MB

    WRSA.exe

    Process ID 8996

    User SYSTEM

    Domain NT AUTHORITY

    Path C:\Program Files\Webroot\WRSA.exe

    Memory Usage 9.70 MB

    Peak Memory Usage 106 MB

    WRSA.exe

    Process ID 5520

    User kjack

    Domain DESKTOP-4FN22AL

    Path C:\Program Files\Webroot\WRSA.exe

    Memory Usage 736 KB

    Peak Memory Usage 64 MB

    Security Options

    Accounts: Administrator account status Disabled

    Accounts: Block Microsoft accounts Not Defined

    Accounts: Guest account status Disabled

    Accounts: Limit local account use of blank passwords to console logon only Enabled

    Accounts: Rename administrator account Administrator

    Accounts: Rename guest account Guest

    Audit: Audit the access of global system objects Disabled

    Audit: Audit the use of Backup and Restore privilege Disabled

    Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings Not Defined

    Audit: Shut down system immediately if unable to log security audits Disabled

    DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax Not Defined

    DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax Not Defined

    Devices: Allow undock without having to log on Enabled

    Devices: Allowed to format and eject removable media Not Defined

    Devices: Prevent users from installing printer drivers Disabled

    Devices: Restrict CD-ROM access to locally logged-on user only Not Defined

    Devices: Restrict floppy access to locally logged-on user only Not Defined

    Domain controller: Allow server operators to schedule tasks Not Defined

    Domain controller: LDAP server signing requirements Not Defined

    Domain controller: Refuse machine account password changes Not Defined

    Domain member: Digitally encrypt or sign secure channel data (always) Enabled

    Domain member: Digitally encrypt secure channel data (when possible) Enabled

    Domain member: Digitally sign secure channel data (when possible) Enabled

    Domain member: Disable machine account password changes Disabled

    Domain member: Maximum machine account password age 30 days

    Domain member: Require strong (Windows 2000 or later) session key Enabled

    Interactive logon: Display user information when the session is locked Not Defined

    Interactive logon: Do not display last user name Disabled

    Interactive logon: Do not require CTRL+ALT+DEL Not Defined

    Interactive logon: Machine account lockout threshold Not Defined

    Interactive logon: Machine inactivity limit Not Defined

    Interactive logon: Message text for users attempting to log on

    Interactive logon: Message title for users attempting to log on

    Interactive logon: Number of previous logons to cache (in case domain controller is not available) 10 logons

    Interactive logon: Prompt user to change password before expiration 5 days

    Interactive logon: Require Domain Controller authentication to unlock workstation Disabled

    Interactive logon: Require smart card Disabled

    Interactive logon: Smart card removal behavior No Action

    Microsoft network client: Digitally sign communications (always) Disabled

    Microsoft network client: Digitally sign communications (if server agrees) Enabled

    Microsoft network client: Send unencrypted password to third-party SMB servers Disabled

    Microsoft network server: Amount of idle time required before suspending session 15 minutes

    Microsoft network server: Attempt S4U2Self to obtain claim information Not Defined

    Microsoft network server: Digitally sign communications (always) Disabled

    Microsoft network server: Digitally sign communications (if client agrees) Disabled

    Microsoft network server: Disconnect clients when logon hours expire Enabled

    Microsoft network server: Server SPN target name validation level Not Defined

    Network access: Allow anonymous SID/Name translation Disabled

    Network access: Do not allow anonymous enumeration of SAM accounts Enabled

    Network access: Do not allow anonymous enumeration of SAM accounts and shares Disabled

    Network access: Do not allow storage of passwords and credentials for network authentication Disabled

    Network access: Let Everyone permissions apply to anonymous users Disabled

    Network access: Named Pipes that can be accessed anonymously

    Network access: Remotely accessible registry paths System\CurrentControlSet\Control\ProductOptions,System\CurrentControlSet\Control\Server Applications,Software\Microsoft\Windows NT\CurrentVersion

    Network access: Remotely accessible registry paths and sub-paths System\CurrentControlSet\Control\Print\Printers,System\CurrentControlSet\Services\Eventlog,Software\Microsoft\OLAP Server,Software\Microsoft\Windows NT\CurrentVersion\Print,Software\Microsoft\Windows
    NT\CurrentVersion\Windows,System\CurrentControlSet\Control\ContentIndex,System\CurrentControlSet\Control\Terminal Server,System\CurrentControlSet\Control\Terminal Server\UserConfig,System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration,Software\Microsoft\Windows
    NT\CurrentVersion\Perflib,System\CurrentControlSet\Services\SysmonLog

    Network access: Restrict anonymous access to Named Pipes and Shares Enabled

    Network access: Restrict clients allowed to make remote calls to SAM

    Network access: Shares that can be accessed anonymously Not Defined

    Network access: Sharing and security model for local accounts Classic - local users authenticate as themselves

    Network security: Allow Local System to use computer identity for NTLM Not Defined

    Network security: Allow LocalSystem NULL session fallback Not Defined

    Network security: Allow PKU2U authentication requests to this computer to use online identities.
    Not Defined

    Network security: Configure encryption types allowed for Kerberos Not Defined

    Network security: Do not store LAN Manager hash value on next password change Enabled

    Network security: Force logoff when logon hours expire Disabled

    Network security: LAN Manager authentication level Not Defined

    Network security: LDAP client signing requirements Negotiate signing

    Network security: Minimum session security for NTLM SSP based (including secure RPC) clients Require 128-bit encryption

    Network security: Minimum session security for NTLM SSP based (including secure RPC) servers Require 128-bit encryption

    Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication Not Defined

    Network security: Restrict NTLM: Add server exceptions in this domain Not Defined

    Network security: Restrict NTLM: Audit Incoming NTLM Traffic Not Defined

    Network security: Restrict NTLM: Audit NTLM authentication in this domain Not Defined

    Network security: Restrict NTLM: Incoming NTLM traffic Not Defined

    Network security: Restrict NTLM: NTLM authentication in this domain Not Defined

    Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers Not Defined

    Recovery console: Allow automatic administrative logon Disabled

    Recovery console: Allow floppy copy and access to all drives and all folders Disabled

    Shutdown: Allow system to be shut down without having to log on Enabled

    Shutdown: Clear virtual memory pagefile Disabled

    System cryptography: Force strong key protection for user keys stored on the computer Not Defined

    System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing Disabled

    System objects: Require case insensitivity for non-Windows subsystems Enabled

    System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) Enabled

    System settings: Optional subsystems

    System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies Disabled

    User Account Control: Admin Approval Mode for the Built-in Administrator account Not Defined

    User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop Disabled

    User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode Prompt for consent for non-Windows binaries

    User Account Control: Behavior of the elevation prompt for standard users Prompt for credentials

    User Account Control: Detect application installations and prompt for elevation Enabled

    User Account Control: Only elevate executables that are signed and validated Disabled

    User Account Control: Only elevate UIAccess applications that are installed in secure locations Enabled

    User Account Control: Run all administrators in Admin Approval Mode Enabled

    User Account Control: Switch to the secure desktop when prompting for elevation Enabled

    User Account Control: Virtualize file and registry write failures to per-user locations Enabled Device Tree

    ACPI x64-based PC

    Microsoft ACPI-Compliant System

    ACPI Fixed Feature Button

    ACPI Power Button

    ACPI Thermal Zone

    ACPI Thermal Zone

    Intel Core i5-3550 CPU @ 3.30GHz

    Intel Core i5-3550 CPU @ 3.30GHz

    Intel Core i5-3550 CPU @ 3.30GHz

    Intel Core i5-3550 CPU @ 3.30GHz

    Microsoft Windows Management Interface for ACPI

    PCI Express Root Complex

    Intel Management Engine Interface

    Memory Controller

    Motherboard resources

    PCI-to-PCI Bridge

    SM Bus Controller

    System board

    PCI-to-PCI Bridge

    NVIDIA GeForce GTX 970

    HP Pavilion 22cw IPS LED Backlit Monitor

    High Definition Audio Controller

    NVIDIA High Definition Audio

    Intel(R) 6 Series/C200 Series Chipset Family USB Enhanced Host Controller - 1C2D

    USB Root Hub

    Generic USB Hub

    High Definition Audio Controller

    High Definition Audio Device

    PCI-to-PCI Bridge

    Realtek PCIe GBE Family Controller

    Intel(R) 6 Series/C200 Series Chipset Family USB Enhanced Host Controller - 1C26

    USB Root Hub

    Generic USB Hub

    Belkin USB Wireless Adaptor

    USB Input Device

    HID-compliant mouse

    USB Composite Device

    USB Input Device

    HID Keyboard Device

    USB Input Device

    HID-compliant consumer control device

    HID-compliant system controller

    LPC Controller

    Communications Port (COM1)

    Direct memory access controller

    High precision event timer

    Legacy device

    Motherboard resources

    Motherboard resources

    Motherboard resources

    Motherboard resources

    Numeric data processor

    Programmable interrupt controller

    System CMOS/real time clock

    System timer

    Standard SATA AHCI Controller

    PLDS DVD+-RW DH-16ACS

    ST1000LM014-1EJ164
     
    kjshadowfade, Oct 27, 2016
    #3
  4. simrick Win User

    svchost.exe intensive network usage

    Hi.
    Have you tried following the PIDs using Process Explorer to find out what exactly it is?
    Process Explorer
    .
    Also, might want to run ADWCleaner, to clear out the junk.
     
    simrick, Oct 28, 2016
    #4
  5. Also use Process Explorer to check the svchost instance is legit. Hover the mouse of the instance and verify Path is C:\Windows\system32\svchost.exe. Any other path means malware
     
    ComputerGeek, Oct 28, 2016
    #5
  6. Jymmy097 Win User
    Thanks a lot for your replies. I've understood which services are running under that instance of svchost. Now what can I do to understand which service is eating up my network connection?

    Thanks in advance.
     
    Jymmy097, Nov 5, 2016
    #6
  7. simrick Win User
    GlassWire?
     
    simrick, Nov 5, 2016
    #7
  8. Jymmy097 Win User

    svchost.exe intensive network usage

    But this can help me only to block the entire svchost instance, while I'd like to know which serviceis the cause of this problem...
     
    Jymmy097, Nov 8, 2016
    #8
  9. simrick Win User
    Follow the PIDs (drill down all dependencies) using Process Explorer to find out what exactly it is.
    Process Explorer
    .
     
    simrick, Apr 5, 2018
    #9
Thema:

svchost.exe intensive network usage

Loading...
  1. svchost.exe intensive network usage - Similar Threads - svchost exe intensive

  2. unsual high cpu usage of regsvr32.exe

    in Windows 10 BSOD Crashes and Debugging
    unsual high cpu usage of regsvr32.exe: hello everyone I'm having a bit of trouble with this application. Just recently my CPU has been mostly taken up by one instance of the above file continuously running. Now I have had a look in Task Manager and the following command lines are stated as below:-...
  3. Error with svchost

    in Windows 10 BSOD Crashes and Debugging
    Error with svchost: I have been recieveing messages for the past two or three days now. When I go full screen, this message randomly pops up. "svchost.exe - application error The instruction at 0x00007FF8A305C686 referenced memory at 0x00007FF8C82D1A78. The memory could not be read. Click...
  4. svchost high usage

    in Windows 10 BSOD Crashes and Debugging
    svchost high usage: I have a HP-omen 17. Recently I have been observing high cpu usage under the name of one/two unnamed process related to svchost.exe. The problem started recently with sudden high usage of cpu during pc start up. These process have to be terminated each time individually. The...
  5. svchost consuming a lot of CPU usage when the laptop is powered on?

    in Windows 10 BSOD Crashes and Debugging
    svchost consuming a lot of CPU usage when the laptop is powered on?: This svchost file name doesn't appear on the task manager page but it is something which is making the cpu run at almost full capacity an along with this there is another blank file which is doing the same thing but it doesn't have the same strength as the other one. The file...
  6. svchost

    in Windows 10 BSOD Crashes and Debugging
    svchost: An aplication in the path C:\Windows\syswow\ is running in the background and it consumes 60% of my cpu how to i stop it? I think it as something about Net Framework our something like that but im not sure. My Windows version is 1607...
  7. BSOD during intensive system usage, for more than 1 hour

    in Windows 10 BSOD Crashes and Debugging
    BSOD during intensive system usage, for more than 1 hour: Hi I have got many BSOD's recently while using my system intensively for multiple hours, for example when playing Overwatch or any other game that uses my CPU, GPU, and RAM intensively. The games are running fine, no lag, no sign of system error, but suddenly, after 1h...
  8. svchost Service Host: Local Service (No Network) - CPU (10-15%) usage

    in Windows 10 Support
    svchost Service Host: Local Service (No Network) - CPU (10-15%) usage: Hi guys,I just can't figure out why is this module using my CPU continuously (10%-15% usage).I've attached a screenshot and the ETL file for you to analyze this.You can download the ETL file from here. (Google Drive link)My PC specs:OS: Windows 10 Pro 64-bitCPU: Intel Core i7...
  9. svchost CPU usage at 55%

    in Windows 10 Performance & Maintenance
    svchost CPU usage at 55%: not sure since when and how ( must have been recently ), but my windows 10 got probably infected, whenever i start pc, my cpu usage jumps to 55% ±. After I open task manager, i can see this ( attachment ) : the PID of "faulty" service is always different and if I stop the...
  10. Extremely HIGH CPU Usage (SVCHost)

    in Windows 10 Performance & Maintenance
    Extremely HIGH CPU Usage (SVCHost): So, basically I upgraded to Windows 10, and it's been a huge nightmare. To start with, I didn't enjoy the experience and tried to downgrade, but I was informed the backup was corrupted (it was using a different file structure or something) and was incompatible. So... no...
Tags:

Users found this page by searching for:

  1. svchost.exe (NetworkService p) using internet