Constant network activity received at 8Kbps once every 1-3 weeks!?

About 4 years ago I had opened a thread "Constant network activity data being sent at 8-16 Kbps, what is it?!"

I diagnosed this as some IP address from Bolivia at that time and enabled firewall and it stopped since. That thread had like over 79K views. I didn't want to bump it as it is unrelated to the issue I am experiencing this time round!

About 3 months ago I started noticing this behaviour with constant network activity received at 8Kbps.

This time this is always occurring as an 8Kbps data received either immediately at start-up or reboot of Windows 10. This does not ever happen in the middle of the computer and it usually happens once every week or 2.

The last time I noticed this was just over 3 weeks ago on the 15th of December 2022. Today morning on Sunday 08/01/2023 08:01:30 it happened again! I thought I solved the problem.

Yet, if I actually go to the Processes tab this will show 0% network activity and 0Mbps for all of the background processes. Typing Netstat -b or Netstat -o shows no Active Connections! Unplugging Ethernet LAN cable and re-plugging it doesn't change the behaviour nor does disabling the network adapter and re-enabling do anything.

The only thing that stops the behaviour is if I restart the computer or change the static IP address 192.168.1.... to a different number. Let's just say if my static IP address is 192.168.1.10 and I change it to another number like 192.168.1.50 then it stops right away.

I have so far failed to diagnose what from where I am receiving this 8Kbps constant network data. I have tried using Resource Monitor and TCPView but it doesn't appear to show any active connection. There isn't any extra process running either.

This does not stop on its own however, long the PC is on for. Only a system reboot or change in IP address stops it. It will happen only once every 1-3 weeks at a random date. Could it be a bug or glitch within the network? Is there any more advanced software available that could tell me from where this network activity is coming from?

How do I execute this script? When I follow this link PowerShellScripts/Start-NetworkMonitor.ps1 at master . chentiangemalc/PowerShellScripts . GitHub and paste the entire script in PowerShell the whole PowerShell window closes.

When I try to follow the instructions PS C:\Windows\system32> .\Start-NetworkMonitor.ps1
.\Start-NetworkMonitor.ps1 : The term '.\Start-NetworkMonitor.ps1' is not recognized as the name of a cmdlet,
function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the
path is correct and try again.
At line:1 char:1
+ .\Start-NetworkMonitor.ps1
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (.\Start-NetworkMonitor.ps1:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException

Is there a simple way to find out the network activity?

What could it be. At first I thought it could be telemetry. But this is not sending 8Kbps data, it is receiving and this does not show up in netstat. Difficult to diagnose when it is happening 1-3 weeks only once. Prior to that for months on end I never saw this, it is a completely new experience that happens on startup randomly once in a couple of weeks approximately.

Ok, so finally I have identified the solution to this. I uninstalled Store Experience Host using O&O AppBuster on the 9th of January.
It has been 2 months since then and I have never experienced the network activity at system startup since.

Nevertheless, when I installed O&O AppBuster again and ran the program I could not find Store Experience Host in the list to manually install again. I guess it doesn't matter at the end of the day. I'm sure this can be installed manually from the Microsoft Store.

But this is indeed the culprit. I remember very well that prior to reinstalling my DELL laser colour printer in September this wasn't there. But I had manually installed the Store Experience Host because I had problems with Microsoft Store Install Service being triggered to run in the background every time the printer was turned on. I reinstalled Dell Hub and uninstalled it again and that fixed the glitch with Microsoft Store Install Service.

But at that time I forgot to uninstall the Store Experience Host and didn't even know that this is what was causing this issue with network activity at startup randomly every 2-3 weeks from September to January. Uninstalled it in January the 9th and since then no such network activity at startup for the last 2 months!

This is despite Microsoft Store being set to not auto-install apps HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager
In the right pane, double click on the DWORD entry named SilentInstalledAppsEnabled and set it to 0.

and... HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore

AutoDownload DWORD

delete DWORD = default
2 = always off
4 = always on

These settings have no bearing to this network activity being triggered by the Store Experience Host. Microsoft has no respect to these user settings. Luckily uninstalling it stopped this network activity at system startup.

BLaZiNgSPEED said:

Ok, so finally I have identified the solution to this...

This is despite Microsoft Store being set to not auto-install apps HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager
In the right pane, double click on the DWORD entry named SilentInstalledAppsEnabled and set it to 0.

and... HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore

AutoDownload DWORD

delete DWORD = default
2 = always off
4 = always on

These settings have no bearing to this network activity being triggered by the Store Experience Host. Microsoft has no respect to these user settings. Luckily uninstalling it stopped this network activity at system startup.

Thanks for posting back with your findings, particularly the registry settings... always useful information to have.

RickC said:

Thanks for posting back with your findings, particularly the registry settings... always useful information to have.

Many thanks. Yes, the registry for the AutoDownload is to stop Microsoft from auto installing the Microsoft apps and auto-updating the apps. Once it is configured to a number 2 for AutoDownload then the apps will not automatically install after uninstalling them.

You may have noticed on a fresh Windows 10 install or feature upgrade when you tried to uninstall apps like Candy Crush Saga they happen to reinstall on their own. This setting takes care of this problem.

There is also a Task Scheduler called InstallService --> ScanForUpdates that needs to be toggled to Disabled. This will stop Windows from scanning and triggering the Microsoft Store Install Service to start running in the background.

I have uninstalled all the Store apps except for the VP9 Video, HEIF Image, Web Media and Webpb Image extensions as these are all important ones.

Now I have no idea of the importance of the Store Experience Host and whether that affects installation of any store apps. If this does affect the installation of any store apps then this can be manually installed to aid the installation of any store apps if needed and then it can be safely uninstalled again using AppBuster.

I believe alternatively using Windows Update Blocker tool or using group policy editor to disable automatic Windows Update along with the network "remove access to use all windows update features". This will probably solve the network activity glitch without needing to uninstall Store Experience Host. But anyway, I'm glad that I have identified this as the culprit as it has been giving me headaches and paranoia these last few months.

Sadly the issue returned. But this time after almost 3 months!

After almost 3 months today 31/07/2023 this morning just turn on my PC at 12:25am this issue has returned. My last experience was on 5/05/2023. Though I know at that time specifically it was caused by Corsair K55 Pro XT, which I had returned. This was triggering the issue every few days.

Anyway, having returned the keyboard the issue with this has returned again after almost 3 months.

So pretty much almost 3 months on since that date this happened again today 31/07/2023.

I posted it in my other thread regarding network send data, a separate issue from this. Another use responded in that thread complaining of this issue with received data, the same issue as me but he didn't post in this thread, so I had to reply to that thread and I'm also updating this thread with my experience here.

The saddest part about this is that it gives zero clues what it is. If I paste Netstat -b as you can see Active Connections show nothing.

Netstat -ano will also show a list of IP address as Active Connections as listening.

The thing is, however, as long the computer is on the 8Kbps received data doesn't stop unless I restart the computer or turn off network adapter and then turn it back on! Even if the PC remains on for several hours.

I will try experimenting with disabling Windows Update using group policy editor as my second experiment and see if this makes any difference.

I cannot see from your screenshot any established entries from any external endpoints.

Your Netstat results appear to show just your device's loopback addresses/ports listening (which is what they are supposed to do) and the performance graph appears to show just a regular listening 'heartbeat' as the monitored ports receive internal queries.

I could be wrong but I think you may be misinterpreting the results. It looks like Windows' own internal network traffic doing diagnostic port checks, i.e. all internal network data... which may in fact be the result of you uninstalling core components (like Store Experience Host) and the OS trying to figure out why it's now no longer working as designed.

For example, the entry of your 192.168.1.20 IP address and port 139 normally used by the NetBIOS Session service to the adapter's loopback address. That looks suspiciously like NetBIOS trying to look around your internal network for any shared resources and finding that it can't.

However, IMO the only way to check this is to match the PIDs shown in the Netstat results to their processes... perhaps using Process Explorer?

Hope this helps...

Yes, it could be Microsoft looking for some update that causes this glitch.
However, Store Experience Host when it was initially installed was causing this frequency to occur much more frequently, like every 2 weeks or so!

Having uninstalled that using O&O AppBuster this stopped the behaviour for the next 4 months from January to May! Until of-course when I tried to upgrade my keyboard to Corsair K55 Pro XT when it was occurring every 3 days or so.

After I uninstalled and returned back the keyboard it stopped occurring for more than 2 months. There is no established network connections that shows anything triggering this.

Also the background processes on Windows remain the same number at 58. There is no Windows Update or Microsoft Store Install Service running in the background and they are Manual. Of-course Windows Update does start on boot but disappears after a few minutes. The thing is that the 8Kbps data received will still persist infinitely.

The only thing that has occurred recently is latest Nvidia Graphics Card Drivers along with its control panel on the 30/06/23 last month. And I also installed a Microphone last month using Microphone port recently as I needed it for a short online course for 10 days. This isn't even plugged.

Now whether one of these are the triggers that occurred a month later or whether it is completely coincidental, I'll not know! But it could be the Nvidia Control Panel that is related to the Store.

The problem is that it is difficult to diagnose because if I restart the computer this behaviour will stop and will probably not return for another 1-3 months!

I can only speculate that it is Windows Update that is the culprit. In the past I used Windows Update Blocker and this behaviour was never observed in 2 years. But since I decided to use Specify Target Build 1903 I decided to ignore using the Windows Update Blocker tool knowing that Windows 10 will remain at the final build of 1903 even when it scans for updates.

I'm now going to make another experiment before further investigating.

I have decided to follow this guide on how to disable Windows updates using Group Policy Editor. There was also a YouTube video that I followed around a year and 6 months ago, I only implemented this test once but reverted those changes as I thought it's not really needed.

Now I'll test again with these new configurations by also setting http:\\neverupdatewindows10.com in WUServer. I did it with Group Policy Editor but also checked via Registry to see the same change.

If this happens soon again then I'll know it's not Windows Update but something else!