(solved)- svchost.exe downloading constantly, eating all my bandwidth. Virus ?

Sometimes when you are connected to internet, your bandwidth vanishes for no reason..  Idle network bandwidth is used for no reason even without opening a web browser.

How to find which application consumes the  Idle network bandwidth in this manner ? You can download netbalancer and install.. By opening netbalancer, you can observe individual application/program wise download and upload .

Netbalancer shows svchost.exe  downloading constantly, eating all my bandwidth.. Now what ? 

Most of the time, huge traffic shown in the svchost.exe is due to windows updates via Background Intelligent Transfer Service (BITS) ..

From description of BITS “Transfers files in the background using idle network bandwidth. If the service is disabled, then any applications that depend on BITS, such as Windows Update or MSN Explorer, will be unable to automatically download programs and other information.” 

BITS uses binpath= “c:\windows\system32\svchost.exe -k netsvcs”

Svchost works as a  container for multiple processes …You can simply expand it in task manager… See the service host expansion in the pic.. and under that you may see other things such as Background Intelligent Transfer Service etc..

I use wsus  in my work environment, with netbalancer.. and I see 200/300GB traffic via svchost…Netbalancer is used to create rules not to sync updates in day time in wsus, that is a different story though..

Also you can use netbalancer to verify the svchost that takes much bandwidth is same as bits path ..  that is  “c:\windows\system32\svchost.exe -k netsvcs”

Open netbalancer and enable command line by right clicking and selecting command line.. It will show you the command line path of svchost.exe

Using netbalancer, simply you can verify this or you can verify this  by disabling windows updates temporarily or disabling Background Intelligent Transfer Service   for a day or so…..

Go to Control Panel – Administrative Tools – Services – search for BITS and Stop the service by right clicking on it then click on stop. Also in the properties of this service select manual or disable. You can enable it to update your windows anytime. But make sure to enable it, when you need to download windows updates or related service to BITS. 

Instead of disabling BITS completely you can limit svchost.exe to use your traffic for a predefined time period that you decide.. See How to limit svchost.exe  downloading constantly, eating all my bandwidth using netbalancer ? 

There are also some malware  under svchost name, yet above BITS usage  is the very common scenario for huge traffic through svchost.. To make sure you are not infected by common known svchost virus you can always run a virus inspection in your pc using following free tools..

Use these tools first..

http://www.bleepingcomputer.com/download/roguekiller/dl/121/
http://www.bleepingcomputer.com/download/rkill/dl/10/
http://www.bleepingcomputer.com/download/junkware-removal-tool/dl/131/

Use trojan remover and have a full system scan http://www.simplysup.com/tremover/download.html (shareware)

Download hitman pro 3.7 (shareware and can be activated for 30 days free)and have a full system scan..http://www.surfright.nl/en

And/or
use adwcleaner (freeware) and and have a full system scan..http://www.bleepingcomputer.com/download/adwcleaner/dl/125/ )

And/or
use malwarebyte (free version) have a full system scan http://www.malwarebytes.org/products/malwarebytes_free/

And/or
Use Kaspersky Virus Removal Tool
http://www.kaspersky.com/antivirus-removal-tool?form=1

Note: BITS traffic via   “c:\windows\system32\svchost.exe -k netsvcs” is Not a virus or malware problem, its a legit program, so if you use 100 antivirus scanners, you will not be able to remove/stop BITS download traffic…