Svchost download problem

[the555fallen]

One of the host process for windows services (svchost.exe) is running and downloading something and a lot of it. In the last week it has downloaded 400Mb without any approval. I have set windows updates to manual nothing. I have tried tracking the exact service by monitoring the resource monitor and checking for the PID,however the PID changes each time I try fix the one I think is the problem and there are often 10 or more services with the same PID. If i got to services.msc and try disabling the BITS I cant connect to the cellc stick. I have tried everything i could possibly find on forums and so far nothing.
I have use a cellc 3g stick so 400Mb is a lot and I need to find what the cause of this is and why...

 

[bubbatentoe]

You'd need to find out what's causing it.
Try apps like "unhackme" or spybot".
They'll inform you if your PC's infected.

to stop "strange" apps from eating bandwidth follow these steps.

a) Goto command prompt and do "netstat /b"
this will show all established connections and the associated application names (SvcHost in your case).

b) Look for the associated "foreign address": and write it down.

c) now find your "hosts" file
it's in "windows/system32/drivers/etc"

d) open it and add a new line at the end that looks like this:
127.0.0.1 name-of-host-you-wrote-down-earlier

e) save the file.

f) still in command prompt, do a "nbtstat -RR"

g) "ping" the host name your wrote down earlier
You should get a reply form "127.0.0.1" . your localhost.


You've now caused the "strange" program to (try and) establish a connection with your local host and NOT to some system out there in the ether.
The program will keep on trying to establish a link but it will fail because it's connecting to the wrong host. (saving you lots of bandwidth)




Once you've cleaned your system you can remove the additional entry from your "hosts" file.

 

[NeoProg]

Just reinstall windows