svchost.exe excessive bandwidth usage after upgrading to Windows 10

[Praeses]

So I've upgraded to Windows 10 and noticed that my internet was really slow. I found that svchost.exe is downloading a ton of data from 197.84.129.119 - http://www.whois-ip.pro/197.84.129.119

It's sucking on my 4Mbps line like there's no tomorrow. Any idea what's it downloading? I've updated Windows, turned off sync etc.

As soon as Web Africa's shaping kicked in at 8AM it mellowed down to 1Mbps.

Any idea what's happening?

 

[zolly]

I can't find it now, but there's basically a P2P setting for windows updates. You're probably sharing windows 10 files with someone else who needs them.

 

[Sonic2k]

Malware... had it before... can't remember what it was but was a pain to get rid of...

 

[Slootvreter]

I can't find it now, but there's basically a P2P setting for windows updates. You're probably sharing windows 10 files with someone else who needs them.

Correct. It's default setting is to share updates to PCs on your LAN, there is a setting for sharing to the Internet as well.

 

[Praeses]

I can't find it now, but there's basically a P2P setting for windows updates. You're probably sharing windows 10 files with someone else who needs them.

I did switch that off completely, so can't be that unfortunately

 

[zolly]

I did switch that off completely, so can't be that unfortunately

Virus or malware would be the next thing I guess.

 

[Rickster]

I think it's a local Microsoft CDN

 

[Praeses]

I think it's a local Microsoft CDN

I also figure it's a MS server in Mweb's data center... Just wondering what and how much data it's downloading...

 

[gregmcc]

Check your windowsupdate.log and see if its busy downloading updates.

Failing that - wireshark.

 

[HunterGR]

will check when i get home......

 

[Praeses]

I found some remnants of the windows 10 download in a hidden folder on c: it contained two 2.5gb temp files whicj deleted after stoppimg the BITS service. Problem seems to be fixed now, even after starting BITS again.

 

[BigBear]

Flat lined my 4 meg Line as well.. rebooted pc and back to normal with resuming win 10 update at 88 % now

 

[HavocXphere]

Thread full of guessing...

svhost host is an application that hosts services & multiple ones at the same time at that.

Haven't had to do this in years, but if memory serves the TCPmon tool from Microsoft/sysinternals can trace a connection going to svchost to a specific service / PID...and from there you can check the services in the services.msc tool.

That said, eyeballing that IP I'd say 80% chance you're dealing with a harmless update off a CDN though. Dunno what its updating but it certainly smells like a harmless update. That being said - you should check this out...viruses do make use of svchost as well.

 

[mstaylor]

im gonna guess it's a failed update that is stuck in a loop

 

[e4et]

Had the same issue on Win 10. svchost was bringing my network to a crawl the last two days, hogging most of my bandwidth.
I think it's due to this update (KB3194496) that keeps on failing and what seems to be windows update trying to download it again repeatedly, even though from what I understand, that should not be the case.

Setting the active hours under the Windows updates settings did not make any difference.

I found the below, which helped me out.
After setting the policy, my bandwidth usage went from 4Megs down to 0

Hope it helps someone else
http://cmdrkeene.com/windows-update-download-time-window

 

[sajunky]

Had the same issue on Win 10. svchost was bringing my network to a crawl the last two days, hogging most of my bandwidth.
I think it's due to this update (KB3194496) that keeps on failing and what seems to be windows update trying to download it again repeatedly, even though from what I understand, that should not be the case.

It is doing the same with other KB's and even with a major system update 'esd' file (3GB+ download). One of my main reason of reverting to previous Windows.

BTW, I don't think registry editing on the Home edition can stop automatic downloads completely. Last time I tried it was ignored.

 

[xtm]

microsoft spyware