How can I discover what app/process is stealing my bandwith (W10 Home)

Hi

I am in a remote part of the world with limited access to networking. I am using a 3G mobile/cell USB modem with cellphone sim card to get internet access. I only get 2.5GB allowance per month.
Every day when I first connect to the network, *something* on my computer downloads 130MB of data. Every day! This mystery app/process is using up my whole data allowance! How can I find out what it is and stop it, please?

I suspect it is these:
PID Address
scvhost.exe (netsvcs) 476 14.40.233.105
scvhost.exe (netsvcs) 476 14.40.233.112
scvhost.exe (netsvcs) 476 14.40.233.50
scvhost.exe (netsvcs) 476 14.40.233.106
scvhost.exe (netsvcs) 476 13.107.4.50

...as they all go crazy (network Bytes/second) in the Network view of Windows Resource Monitor while the download is happening.

Process Explorer by Sysinternals shows one scvhost.exe (C/Windows/System32/svchost.exe (netsvcs)) file getting very busy (CPU usage) at the time of the download. That particular svchost.exe has these processes associated with it:
Application Information [AppInfo]
Computer Browser [Browser]
Delivery Optimisation [DoSvc]
Geolocation Service[ifsvc]
IP Helper [iphlpsvc]
Remote Access Connnection Manager [RasMan]
Server [Lanman Server]
System Event Notification Service [SENS]
Shell Hardware Detection [ShellHWDetection]
Themes [Themes]
Task Scheduler [Schedule]
UserProfileService [ProfSvc]
User Manager [UserManager]
Windows Push Notifications System Service [WpnService]
Windows Management Instrumentation [Winmgmt]

When whatever-it-is has finished downloading its 130MB, it goes quiet and doesn't generate any more traffic until the next day.

The regular Windows 10 task mananger doesn't show any network traffic at all. I guess that it doesn't recognise my USB modem as a network interface.

I have turned off all the "auto-updates" I can think of (Avast, MBalwarebytes, Firefox extensions). Windows updates is set to "Do not Download over metered connections" I have even tried turning off Windows Updates entirely, (plus Skype Updates, Googleupdates) under "Services" in Control Panel.

How do I discover what it is that is doing the downloading and turn it off? thanks.


The machine shows-up as clean in Avast, MBalwarebytes scans.
OS: Windows 10 home, latest build.
Intel core i7 4500U processor.

You may have already tried this, but does Data Usage in Settings say anything helpful?
Network Data Usage - View in Windows 10

dalchina said:

NetLimiter Homepage
may help.

Thanks, will give it a go.

Bear in mind your universal apps update regularly (4 hourly scheduled task)

Can I change that - it turns out my problem is actually occurring several times a day, not just once.

and there's this:

Yes, hardly ever launch any of those, but have turned off all the 'run in background' switches now.

M4v3r1ck said:

For those who want more info's about the under-the-hood processes/bandwidth get the FREE M$ sys-internals suit!

Check it out @ Sysinternals Suite

Greetz

THanks, already using the "Process Explorer" part of that (which unless I'm mistaken is more for CPU usage than network traffic). I will give the full suite a look!

DavidY said:

You may have already tried this, but does Data Usage in Settings say anything helpful?
Network Data Usage - View in Windows 10

Reply - thanks. It only reports some wireless LAN traffic I had early in the month, it doesn't seem to see the traffic from when I use my usb modem

Netlimiter supports my assumption that it this svchost.exe which contains the problem.

Process Explorer by Sysinternals shows one scvhost.exe (C/Windows/System32/svchost.exe (netsvcs)) file getting very busy (CPU usage) at the time of the download. That particular svchost.exe has these processes associated with it:
Application Information [AppInfo]
Computer Browser [Browser]
Delivery Optimisation [DoSvc]
Geolocation Service[ifsvc]
IP Helper [iphlpsvc]
Remote Access Connnection Manager [RasMan]
Server [Lanman Server]
System Event Notification Service [SENS]
Shell Hardware Detection [ShellHWDetection]
Themes [Themes]
Task Scheduler [Schedule]
UserProfileService [ProfSvc]
User Manager [UserManager]
Windows Push Notifications System Service [WpnService]
Windows Management Instrumentation [Winmgmt]

It is seen as Process ID/PID 1028 in Netlimiter.

Netlimiter lets me throttle PID1028's download speed, or to manually kill its connections (upon which the process just hunts round for a new ip/server and continues downloading).


btw, it seems you can add columns to the regular Task manager to see the PID and Processname and the underlying Services.

also link


However, I still can't find a way of seeing which _service_ is accounting for the network traffic. Windows Update seems an obvious contender and I have disabled Windows Update and 'Update Orchestrator for Windows Updates' to no avail. I'm a bit nervous about disabling some of the others, e.g. Winmgmt- "if this service is stopped, most Windows-based software will not function properly" (!)


The Task Scheduler entries for Windows Updates
task scheduler>WindowsUpdate>Automatic>AppUpdate (Windows Store apps) daily at 01H30; 04H56; 07H08 +?
task scheduler>Scheduled Start (sc.exe) (13H16 daily)
task scheduler>sih (server initiated healing (sihclient.exe)) 20H00 daily

...are all showing as "Ready" (not "Disabled"), despite Windows Update being disabled in Services.

It also seems to be possible to configure them to only trigger when connected to a particular network. By default and currently, they are set to run on "any network connection", despite Windows Settings being set to "do not download over metered connections". I haven't started playing with that yet. I wonder if there is any point in doing so if Windows Updates is supposedly disabled entirely.

----

So, this is just an update on my progress, I guess. For now, I have a sort of workaround (Netlimiter allows me to cap the download speed to a crawl, but doesn't stop it entirely), but I haven't been able to isolate or stop the actual Service causing the traffic...

Any further thoughts ?

TIA :)