Windows 10: svchost.exe intensive network usage

Hi everybody,

I have high network usage problems with some services in windows: this is a screenshot of the problem (the process highlighted is called "Service Host: Local system" in English).



Does anybody know how to limit the bandwidth those services can use or, in alternative, how to fix the problem: I cannot browse the internet fast anymore with those services eating all my bandwidth (yes, my maximum bandwidth is VERY low).

Thank you very much.



:)

 

svchost.exe / service host : local system ( network restricted ) high usage memory and CPU

When you open Task Manager a little bit, you’ll see that svchost.exe service host: local system (network restricted) is causing the problem of high CPU usage. To improve your Windows performance, and get rid of the high CPU usage, you
have to disable Superfetch service. Superfetch used to pre-load data from hard disk into RAM memory. So let's follow this steps.

Fix svchost.exe service host: local system (network restricted)

 

Windows 10 boots up with black screen with blinking cursor and then loads up windows like normal (why is their a black screen)

Process ID 1544

User kjack

Domain DESKTOP-4FN22AL

Path C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe

Memory Usage 4.74 MB

Peak Memory Usage 15 MB

steamwebhelper.exe

Process ID 3932

User

Domain DESKTOP-4FN22AL

Path C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe

Memory Usage 9.05 MB

Peak Memory Usage 33 MB

svchost.exe

Process ID 1424

User SYSTEM

Domain NT AUTHORITY

Path C:\Windows\System32\svchost.exe

Memory Usage 19 MB

Peak Memory Usage 32 MB

svchost.exe

Process ID 1648

User SYSTEM

Domain NT AUTHORITY

Path C:\Windows\System32\svchost.exe

Memory Usage 7.23 MB

Peak Memory Usage 14 MB

svchost.exe

Process ID 1556

User LOCAL SERVICE

Domain NT AUTHORITY

Path C:\Windows\System32\svchost.exe

Memory Usage 5.99 MB

Peak Memory Usage 13 MB

svchost.exe

Process ID 1448

User LOCAL SERVICE

Domain NT AUTHORITY

Path C:\Windows\System32\svchost.exe

Memory Usage 3.25 MB

Peak Memory Usage 7.87 MB

svchost.exe

Process ID 2104

User SYSTEM

Domain NT AUTHORITY

Path C:\Windows\System32\svchost.exe

Memory Usage 16 MB

Peak Memory Usage 20 MB

svchost.exe

Process ID 1188

User LOCAL SERVICE

Domain NT AUTHORITY

Path C:\Windows\System32\svchost.exe

Memory Usage 16 MB

Peak Memory Usage 30 MB

svchost.exe

Process ID 1124

User LOCAL SERVICE

Domain NT AUTHORITY

Path C:\Windows\System32\svchost.exe

Memory Usage 19 MB

Peak Memory Usage 82 MB

svchost.exe

Process ID 480

User LOCAL SERVICE

Domain NT AUTHORITY

Path C:\Windows\System32\svchost.exe

Memory Usage 17 MB

Peak Memory Usage 25 MB

svchost.exe

Process ID 5976

User LOCAL SERVICE

Domain NT AUTHORITY

Path C:\Windows\System32\svchost.exe

Memory Usage 3.80 MB

Peak Memory Usage 6.89 MB

svchost.exe

Process ID 392

User SYSTEM

Domain NT AUTHORITY

Path C:\Windows\System32\svchost.exe

Memory Usage 52 MB

Peak Memory Usage 278 MB

svchost.exe

Process ID 1020

User SYSTEM

Domain NT AUTHORITY

Path C:\Windows\System32\svchost.exe

Memory Usage 116 MB

Peak Memory Usage 145 MB

svchost.exe

Process ID 892

User NETWORK SERVICE

Domain NT AUTHORITY

Path C:\Windows\System32\svchost.exe

Memory Usage 8.85 MB

Peak Memory Usage 12 MB

svchost.exe

Process ID 4700

User LOCAL SERVICE

Domain NT AUTHORITY

Path C:\Windows\System32\svchost.exe

Memory Usage 3.30 MB

Peak Memory Usage 6.92 MB

svchost.exe

Process ID 1272

User NETWORK SERVICE

Domain NT AUTHORITY

Path C:\Windows\System32\svchost.exe

Memory Usage 12 MB

Peak Memory Usage 18 MB

svchost.exe

Process ID 9932

User SYSTEM

Domain NT AUTHORITY

Path C:\Windows\System32\svchost.exe

Memory Usage 8.68 MB

Peak Memory Usage 9.71 MB

svchost.exe

Process ID 824

User SYSTEM

Domain NT AUTHORITY

Path C:\Windows\System32\svchost.exe

Memory Usage 14 MB

Peak Memory Usage 23 MB

svchost.exe

Process ID 3080

User

Domain DESKTOP-4FN22AL

Path C:\Windows\System32\svchost.exe

Memory Usage 19 MB

Peak Memory Usage 34 MB

System

Process ID 4

Memory Usage 1.64 MB

Peak Memory Usage 17 MB

System Idle Process

Process ID 0

SystemSettings.exe

Process ID 6824

User kjack

Domain DESKTOP-4FN22AL

Path C:\Windows\ImmersiveControlPanel\SystemSettings.exe

Memory Usage 15 MB

Peak Memory Usage 67 MB

taskhostw.exe

Process ID 3148

Domain DESKTOP-4FN22AL

Path C:\Windows\System32\taskhostw.exe

Memory Usage 11 MB

Peak Memory Usage 36 MB

wininit.exe

Process ID 572

User SYSTEM

Domain NT AUTHORITY

Path C:\Windows\System32\wininit.exe

Memory Usage 1.20 MB

Peak Memory Usage 5.15 MB

winlogon.exe

Process ID 736

User SYSTEM

Domain NT AUTHORITY

Path C:\Windows\System32\winlogon.exe

Memory Usage 4.85 MB

Peak Memory Usage 17 MB

WinStore.App.exe

Process ID 7980

Domain DESKTOP-4FN22AL

Path C:\Program Files\WindowsApps\Microsoft.WindowsStore_11610.1001.23.0_x64__8wekyb3d8bbwe\WinStore.App.exe

Memory Usage 3.39 MB

Peak Memory Usage 62 MB

WmiPrvSE.exe

Process ID 7156

User NETWORK SERVICE

Domain NT AUTHORITY

Path C:\Windows\System32\wbem\WmiPrvSE.exe

Memory Usage 18 MB

Peak Memory Usage 29 MB

WmiPrvSE.exe

Process ID 5228

User SYSTEM

Domain NT AUTHORITY

Path C:\Windows\System32\wbem\WmiPrvSE.exe

Memory Usage 24 MB

Peak Memory Usage 37 MB

WmiPrvSE.exe

Process ID 2172

User LOCAL SERVICE

Domain NT AUTHORITY

Path C:\Windows\System32\wbem\WmiPrvSE.exe

Memory Usage 7.43 MB

Peak Memory Usage 12 MB

WRSA.exe

Process ID 8996

User SYSTEM

Domain NT AUTHORITY

Path C:\Program Files\Webroot\WRSA.exe

Memory Usage 9.70 MB

Peak Memory Usage 106 MB

WRSA.exe

Process ID 5520

User kjack

Domain DESKTOP-4FN22AL

Path C:\Program Files\Webroot\WRSA.exe

Memory Usage 736 KB

Peak Memory Usage 64 MB

Security Options

Accounts: Administrator account status Disabled

Accounts: Block Microsoft accounts Not Defined

Accounts: Guest account status Disabled

Accounts: Limit local account use of blank passwords to console logon only Enabled

Accounts: Rename administrator account Administrator

Accounts: Rename guest account Guest

Audit: Audit the access of global system objects Disabled

Audit: Audit the use of Backup and Restore privilege Disabled

Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings Not Defined

Audit: Shut down system immediately if unable to log security audits Disabled

DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax Not Defined

DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax Not Defined

Devices: Allow undock without having to log on Enabled

Devices: Allowed to format and eject removable media Not Defined

Devices: Prevent users from installing printer drivers Disabled

Devices: Restrict CD-ROM access to locally logged-on user only Not Defined

Devices: Restrict floppy access to locally logged-on user only Not Defined

Domain controller: Allow server operators to schedule tasks Not Defined

Domain controller: LDAP server signing requirements Not Defined

Domain controller: Refuse machine account password changes Not Defined

Domain member: Digitally encrypt or sign secure channel data (always) Enabled

Domain member: Digitally encrypt secure channel data (when possible) Enabled

Domain member: Digitally sign secure channel data (when possible) Enabled

Domain member: Disable machine account password changes Disabled

Domain member: Maximum machine account password age 30 days

Domain member: Require strong (Windows 2000 or later) session key Enabled

Interactive logon: Display user information when the session is locked Not Defined

Interactive logon: Do not display last user name Disabled

Interactive logon: Do not require CTRL+ALT+DEL Not Defined

Interactive logon: Machine account lockout threshold Not Defined

Interactive logon: Machine inactivity limit Not Defined

Interactive logon: Message text for users attempting to log on

Interactive logon: Message title for users attempting to log on

Interactive logon: Number of previous logons to cache (in case domain controller is not available) 10 logons

Interactive logon: Prompt user to change password before expiration 5 days

Interactive logon: Require Domain Controller authentication to unlock workstation Disabled

Interactive logon: Require smart card Disabled

Interactive logon: Smart card removal behavior No Action

Microsoft network client: Digitally sign communications (always) Disabled

Microsoft network client: Digitally sign communications (if server agrees) Enabled

Microsoft network client: Send unencrypted password to third-party SMB servers Disabled

Microsoft network server: Amount of idle time required before suspending session 15 minutes

Microsoft network server: Attempt S4U2Self to obtain claim information Not Defined

Microsoft network server: Digitally sign communications (always) Disabled

Microsoft network server: Digitally sign communications (if client agrees) Disabled

Microsoft network server: Disconnect clients when logon hours expire Enabled

Microsoft network server: Server SPN target name validation level Not Defined

Network access: Allow anonymous SID/Name translation Disabled

Network access: Do not allow anonymous enumeration of SAM accounts Enabled

Network access: Do not allow anonymous enumeration of SAM accounts and shares Disabled

Network access: Do not allow storage of passwords and credentials for network authentication Disabled

Network access: Let Everyone permissions apply to anonymous users Disabled

Network access: Named Pipes that can be accessed anonymously

Network access: Remotely accessible registry paths System\CurrentControlSet\Control\ProductOptions,System\CurrentControlSet\Control\Server Applications,Software\Microsoft\Windows NT\CurrentVersion

Network access: Remotely accessible registry paths and sub-paths System\CurrentControlSet\Control\Print\Printers,System\CurrentControlSet\Services\Eventlog,Software\Microsoft\OLAP Server,Software\Microsoft\Windows NT\CurrentVersion\Print,Software\Microsoft\Windows
NT\CurrentVersion\Windows,System\CurrentControlSet\Control\ContentIndex,System\CurrentControlSet\Control\Terminal Server,System\CurrentControlSet\Control\Terminal Server\UserConfig,System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration,Software\Microsoft\Windows
NT\CurrentVersion\Perflib,System\CurrentControlSet\Services\SysmonLog

Network access: Restrict anonymous access to Named Pipes and Shares Enabled

Network access: Restrict clients allowed to make remote calls to SAM

Network access: Shares that can be accessed anonymously Not Defined

Network access: Sharing and security model for local accounts Classic - local users authenticate as themselves

Network security: Allow Local System to use computer identity for NTLM Not Defined

Network security: Allow LocalSystem NULL session fallback Not Defined

Network security: Allow PKU2U authentication requests to this computer to use online identities.
Not Defined

Network security: Configure encryption types allowed for Kerberos Not Defined

Network security: Do not store LAN Manager hash value on next password change Enabled

Network security: Force logoff when logon hours expire Disabled

Network security: LAN Manager authentication level Not Defined

Network security: LDAP client signing requirements Negotiate signing

Network security: Minimum session security for NTLM SSP based (including secure RPC) clients Require 128-bit encryption

Network security: Minimum session security for NTLM SSP based (including secure RPC) servers Require 128-bit encryption

Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication Not Defined

Network security: Restrict NTLM: Add server exceptions in this domain Not Defined

Network security: Restrict NTLM: Audit Incoming NTLM Traffic Not Defined

Network security: Restrict NTLM: Audit NTLM authentication in this domain Not Defined

Network security: Restrict NTLM: Incoming NTLM traffic Not Defined

Network security: Restrict NTLM: NTLM authentication in this domain Not Defined

Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers Not Defined

Recovery console: Allow automatic administrative logon Disabled

Recovery console: Allow floppy copy and access to all drives and all folders Disabled

Shutdown: Allow system to be shut down without having to log on Enabled

Shutdown: Clear virtual memory pagefile Disabled

System cryptography: Force strong key protection for user keys stored on the computer Not Defined

System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing Disabled

System objects: Require case insensitivity for non-Windows subsystems Enabled

System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links) Enabled

System settings: Optional subsystems

System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies Disabled

User Account Control: Admin Approval Mode for the Built-in Administrator account Not Defined

User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop Disabled

User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode Prompt for consent for non-Windows binaries

User Account Control: Behavior of the elevation prompt for standard users Prompt for credentials

User Account Control: Detect application installations and prompt for elevation Enabled

User Account Control: Only elevate executables that are signed and validated Disabled

User Account Control: Only elevate UIAccess applications that are installed in secure locations Enabled

User Account Control: Run all administrators in Admin Approval Mode Enabled

User Account Control: Switch to the secure desktop when prompting for elevation Enabled

User Account Control: Virtualize file and registry write failures to per-user locations Enabled Device Tree

ACPI x64-based PC

Microsoft ACPI-Compliant System

ACPI Fixed Feature Button

ACPI Power Button

ACPI Thermal Zone

ACPI Thermal Zone

Intel Core i5-3550 CPU @ 3.30GHz

Intel Core i5-3550 CPU @ 3.30GHz

Intel Core i5-3550 CPU @ 3.30GHz

Intel Core i5-3550 CPU @ 3.30GHz

Microsoft Windows Management Interface for ACPI

PCI Express Root Complex

Intel Management Engine Interface

Memory Controller

Motherboard resources

PCI-to-PCI Bridge

SM Bus Controller

System board

PCI-to-PCI Bridge

NVIDIA GeForce GTX 970

HP Pavilion 22cw IPS LED Backlit Monitor

High Definition Audio Controller

NVIDIA High Definition Audio

Intel(R) 6 Series/C200 Series Chipset Family USB Enhanced Host Controller - 1C2D

USB Root Hub

Generic USB Hub

High Definition Audio Controller

High Definition Audio Device

PCI-to-PCI Bridge

Realtek PCIe GBE Family Controller

Intel(R) 6 Series/C200 Series Chipset Family USB Enhanced Host Controller - 1C26

USB Root Hub

Generic USB Hub

Belkin USB Wireless Adaptor

USB Input Device

HID-compliant mouse

USB Composite Device

USB Input Device

HID Keyboard Device

USB Input Device

HID-compliant consumer control device

HID-compliant system controller

LPC Controller

Communications Port (COM1)

Direct memory access controller

High precision event timer

Legacy device

Motherboard resources

Motherboard resources

Motherboard resources

Motherboard resources

Numeric data processor

Programmable interrupt controller

System CMOS/real time clock

System timer

Standard SATA AHCI Controller

PLDS DVD+-RW DH-16ACS

ST1000LM014-1EJ164

 

Hi.
Have you tried following the PIDs using Process Explorer to find out what exactly it is?
Process Explorer
.
Also, might want to run ADWCleaner, to clear out the junk.

 

Also use Process Explorer to check the svchost instance is legit. Hover the mouse of the instance and verify Path is C:\Windows\system32\svchost.exe. Any other path means malware

 

Thanks a lot for your replies. I've understood which services are running under that instance of svchost. Now what can I do to understand which service is eating up my network connection?

Thanks in advance.

 

GlassWire?

 

But this can help me only to block the entire svchost instance, while I'd like to know which serviceis the cause of this problem...

 

Follow the PIDs (drill down all dependencies) using Process Explorer to find out what exactly it is.
Process Explorer
.