Windows 10: How can I discover what app/process is stealing my bandwith (W10 Home)

Page 1 of 2 12 LastLast
  1.    22 Jan 2017 #1

    How can I discover what app/process is stealing my bandwith (W10 Home)


    Hi

    I am in a remote part of the world with limited access to networking. I am using a 3G mobile/cell USB modem with cellphone sim card to get internet access. I only get 2.5GB allowance per month.
    Every day when I first connect to the network, *something* on my computer downloads 130MB of data. Every day! This mystery app/process is using up my whole data allowance! How can I find out what it is and stop it, please?

    I suspect it is these:
    PID Address
    scvhost.exe (netsvcs) 476 14.40.233.105
    scvhost.exe (netsvcs) 476 14.40.233.112
    scvhost.exe (netsvcs) 476 14.40.233.50
    scvhost.exe (netsvcs) 476 14.40.233.106
    scvhost.exe (netsvcs) 476 13.107.4.50

    ...as they all go crazy (network Bytes/second) in the Network view of Windows Resource Monitor while the download is happening.

    Process Explorer by Sysinternals shows one scvhost.exe (C/Windows/System32/svchost.exe (netsvcs)) file getting very busy (CPU usage) at the time of the download. That particular svchost.exe has these processes associated with it:
    Application Information [AppInfo]
    Computer Browser [Browser]
    Delivery Optimisation [DoSvc]
    Geolocation Service[ifsvc]
    IP Helper [iphlpsvc]
    Remote Access Connnection Manager [RasMan]
    Server [Lanman Server]
    System Event Notification Service [SENS]
    Shell Hardware Detection [ShellHWDetection]
    Themes [Themes]
    Task Scheduler [Schedule]
    UserProfileService [ProfSvc]
    User Manager [UserManager]
    Windows Push Notifications System Service [WpnService]
    Windows Management Instrumentation [Winmgmt]

    When whatever-it-is has finished downloading its 130MB, it goes quiet and doesn't generate any more traffic until the next day.

    The regular Windows 10 task mananger doesn't show any network traffic at all. I guess that it doesn't recognise my USB modem as a network interface.

    I have turned off all the "auto-updates" I can think of (Avast, MBalwarebytes, Firefox extensions). Windows updates is set to "Do not Download over metered connections" I have even tried turning off Windows Updates entirely, (plus Skype Updates, Googleupdates) under "Services" in Control Panel.

    How do I discover what it is that is doing the downloading and turn it off? thanks.


    The machine shows-up as clean in Avast, MBalwarebytes scans.
    OS: Windows 10 home, latest build.
    Intel core i7 4500U processor.
      My ComputerSystem Spec

  2.    22 Jan 2017 #2

    NetLimiter Homepage
    may help.

    Bear in mind your universal apps update regularly (4 hourly scheduled task) and there's this:
    Click image for larger version. 

Name:	Snap 2017-01-22 at 09.36.24.jpg 
Views:	4 
Size:	61.1 KB 
ID:	118028
      My ComputerSystem Spec


  3. Posts : 628
    Win 10 Pro x64 1607 (Build 14393.953)
       22 Jan 2017 #3

    How can I discover what app/process is stealing my bandwith (W10 Home)


    For those who want more info's about the under-the-hood processes/bandwidth get the FREE M$ sys-internals suit!

    Check it out @ Sysinternals Suite

    Greetz
      My ComputerSystem Spec


  4. Posts : 1,393
    Windows 10 Pro (32-bit) 16299.15
       22 Jan 2017 #4

    You may have already tried this, but does Data Usage in Settings say anything helpful?
    Network Data Usage - View in Windows 10
      My ComputerSystem Spec

  5.    22 Jan 2017 #5

    dalchina said: View Post
    Thanks, will give it a go.

    Bear in mind your universal apps update regularly (4 hourly scheduled task)
    Can I change that - it turns out my problem is actually occurring several times a day, not just once.

    and there's this:
    Yes, hardly ever launch any of those, but have turned off all the 'run in background' switches now.
      My ComputerSystem Spec

  6.    22 Jan 2017 #6

    M4v3r1ck said: View Post
    For those who want more info's about the under-the-hood processes/bandwidth get the FREE M$ sys-internals suit!

    Check it out @ Sysinternals Suite

    Greetz

    THanks, already using the "Process Explorer" part of that (which unless I'm mistaken is more for CPU usage than network traffic). I will give the full suite a look!
      My ComputerSystem Spec

  7.    22 Jan 2017 #7

    DavidY said: View Post
    You may have already tried this, but does Data Usage in Settings say anything helpful?
    Network Data Usage - View in Windows 10
    Reply - thanks. It only reports some wireless LAN traffic I had early in the month, it doesn't seem to see the traffic from when I use my usb modem
      My ComputerSystem Spec

  8.    23 Jan 2017 #8

    Can I change that - it turns out my problem is actually occurring several times a day, not just once.
    Click image for larger version. 

Name:	Snap 2017-01-23 at 07.12.24.jpg 
Views:	2 
Size:	141.7 KB 
ID:	118140

    You could try launching e.g. Sysinternals TCPView at logon as a scheduled task - run it manually first to get a feel. There may be some other tool in the suite- it's extensive.
      My ComputerSystem Spec

  9.    24 Jan 2017 #9

    Netlimiter supports my assumption that it this svchost.exe which contains the problem.

    Process Explorer by Sysinternals shows one scvhost.exe (C/Windows/System32/svchost.exe (netsvcs)) file getting very busy (CPU usage) at the time of the download. That particular svchost.exe has these processes associated with it:
    Application Information [AppInfo]
    Computer Browser [Browser]
    Delivery Optimisation [DoSvc]
    Geolocation Service[ifsvc]
    IP Helper [iphlpsvc]
    Remote Access Connnection Manager [RasMan]
    Server [Lanman Server]
    System Event Notification Service [SENS]
    Shell Hardware Detection [ShellHWDetection]
    Themes [Themes]
    Task Scheduler [Schedule]
    UserProfileService [ProfSvc]
    User Manager [UserManager]
    Windows Push Notifications System Service [WpnService]
    Windows Management Instrumentation [Winmgmt]
    It is seen as Process ID/PID 1028 in Netlimiter.

    Netlimiter lets me throttle PID1028's download speed, or to manually kill its connections (upon which the process just hunts round for a new ip/server and continues downloading).


    btw, it seems you can add columns to the regular Task manager to see the PID and Processname and the underlying Services.

    also link


    However, I still can't find a way of seeing which _service_ is accounting for the network traffic. Windows Update seems an obvious contender and I have disabled Windows Update and 'Update Orchestrator for Windows Updates' to no avail. I'm a bit nervous about disabling some of the others, e.g. Winmgmt- "if this service is stopped, most Windows-based software will not function properly" (!)


    The Task Scheduler entries for Windows Updates
    task scheduler>WindowsUpdate>Automatic>AppUpdate (Windows Store apps) daily at 01H30; 04H56; 07H08 +?
    task scheduler>Scheduled Start (sc.exe) (13H16 daily)
    task scheduler>sih (server initiated healing (sihclient.exe)) 20H00 daily

    ...are all showing as "Ready" (not "Disabled"), despite Windows Update being disabled in Services.

    It also seems to be possible to configure them to only trigger when connected to a particular network. By default and currently, they are set to run on "any network connection", despite Windows Settings being set to "do not download over metered connections". I haven't started playing with that yet. I wonder if there is any point in doing so if Windows Updates is supposedly disabled entirely.

    ----

    So, this is just an update on my progress, I guess. For now, I have a sort of workaround (Netlimiter allows me to cap the download speed to a crawl, but doesn't stop it entirely), but I haven't been able to isolate or stop the actual Service causing the traffic...

    Any further thoughts ?

    TIA
    Attached Thumbnails Attached Thumbnails PID task manager.JPG  
      My ComputerSystem Spec

  10.    25 Jan 2017 #10

    You could try launching e.g. Sysinternals TCPView at logon as a scheduled task - run it manually first to get a feel. There may be some other tool in the suite- it's extensive.

    As per my #8.
      My ComputerSystem Spec


 
Page 1 of 2 12 LastLast

Related Threads
svchhost.exe hogging bandwith in Network and Sharing
My internet download speed is only 1MB/s. Often svchost.exe eats up all the speed for itself, downloading something. Most often it's some update, but not always. Anyway I have unlimited data plan, so I don't care much about what it downloads, what...
I'm recently upgraded form windows 7 to windows 10. I'm facing the annoying issue that windows explorer steals the application focus after it finishes copying files and comes to front. Can anyone tell me if there is any option to disable this...
Browser Huge use of Bandwith in Browsers and Email
Hello all, I'm a web developer, and lately I've noticed that while developing on an online server, with Apache blocking all IP's besides my network to access it, I'm using huge amounts of bandwith. In order to monitor my bandwith usage, i've used...
As the title says I am unable to "see" my NAS in windows explorer. I was able to use explorer to view/add/delete files on my NAS a few weeks ago but now now cannot even see the NAS in the network section. Funny thing is that I am able to ping the...
I installed Win 10 x64 Home the other day and since then I have had nothing but problems. At random, explorer.exe will steal focus from the active task (can be firefox, can be Word doesn't matter what it is) making the system almost unusable. ...
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 00:37.
Find Us