Do I have a key logger or is simply windows spying on me?

CrunchyMuesli · 09 Feb 2021

Hello everyone

I have a question regarding I have disabled all background apps and I'm not running any browser but I can see in my Task manager that I'm constantly sending 8kbps somewhere(from time to time I would also receive 8kbps). The only process on Task Manager that seems to have network traffic is the "System" process at 0.1Mbps.

Do I have a key logger or is simply windows spying on me?-reddit.jpg

However, after having a look at Resource Monitor I can see that the the process responsible for the sending of packages is is svchost.exe(NetworkService -p)

Why are these processes: System and svchost.exe sending data even when I'm not using anything(no browser, no background apps, no AV, etc) that requires internet. Does that signal that I have a keylogger or possibly even a screen capturer that is sending my information to someone? Or that these processes have been hijacked from my system? I'm really concerned about it as my knowledge on network security is lacking. Any help or advice would be greatly appreciated!

Samuria · 09 Feb 2021

Welcome to the forum. svchost.exe is a program that runs other programs so you need to check what its actually running if you click on it in taskmanager it should show what its running

CrunchyMuesli · 09 Feb 2021

Samuria said:

Welcome to the forum. svchost.exe is a program that runs other programs so you need to check what its actually running if you click on it in taskmanager it should show what its running

The svchost.exe doesn't appear in task manager. Only "System" appears to be using network resources.

f14tomcat · 09 Feb 2021

It could simply be feedback telemetry going back to MS. That does not require any obvious processes to be running, it goes back in small batches at regular intervals.

Check all your Privacy settings in Settings to eliminate most of the feedback. It is very difficult to remove all of it to 0.

Ghot · 09 Feb 2021

CrunchyMuesli said:

The svchost.exe doesn't appear in task manager. Only "System" appears to be using network resources.

"Service Host" is svchost. There are tons of them in Task Manager on the Processes tab.

CrunchyMuesli · 09 Feb 2021

Ghot said:

"Service Host" is svchost. There are tons of them in Task Manager on the Processes tab.

I'm sorry, I didn't know that. Here is a snippet of my Task Manager:

Do I have a key logger or is simply windows spying on me?-reddit3.jpg

Ghot · 09 Feb 2021

CrunchyMuesli said:

I'm sorry, I didn't know that. Here is a snippet of my Task Manager:

Here's a snippet of mine...

Do I have a key logger or is simply windows spying on me?-image1.png

I wouldn't worry about 8kb/s. That's really nothing.
Microsoft telemetry will easily do that much.

Windows is built on a whole pile of "Services". Svchost.exe keeps track of all those Services.
You can type services.msc in the taskbar search box to see the Services.

/edit

If you're really worried... run a Microsoft defender scan, and follow that with a Malwarebytes scan.

Latest Version of Malwarebytes