Trouble With Unnecessary Download By Host Process For Windows Services

Replies

• 

  rahul69

  By Host Process For Windows Services do you mean taskhost.exe?
• 

  Nayan Goenka

  Ok here are some things I need you to verify.
  
  Open msconfig and check which services are auto loading at startup as well as other times.
  Check if you have windows update on auto-update settings mode.
  Check if you have any other software installed which is a developer tool or a microsoft product and is set on auto update.
  Check if you have any server utility installed
  Check if your task manager is auto loading services.
  Enable firewall and restrict all traffic to admin mode only.
  Check all services that have default mode set to admin, if they have update utility
  Check Event Logs when the download happens. See which software or service is doing it. You will get a path to it there.
  Check if you have rogue installations on your computer.
  Check registry by using regedit. Clear registry for rogue entries.
  If none of these work, I would recommend you to format c: and reinstall windows
• 

  Satya Swaroop Dash

  rahul69

  By Host Process For Windows Services do you mean taskhost.exe?

  Nope, its svchost.exe.
• 

  KenJackson

  If a virus added or replace a file on your machine, it will probably have a more recent date than the other files. I found the only virus I've been infested with this way. Open a CMD window and enter:
  

  cd %winsysdir%      (This should take you to C:\windows\system32 or equivalent)
  dir /od

  The dir /od command lists files in order of date, most recent last. Hundreds of files will quickly scroll by. Ignore them. Just look at the last few files, which will be the most recently modified files in the directory. If an executable file has a recent date and you don't recognize it, there's a chance that Windows Update just legitimately replaced it, but there's also a good chance it's a virus.
• 

  Satya Swaroop Dash

  Nayan Goenka

  Ok here are some things I need you to verify.
  
  Open msconfig and check which services are auto loading at startup as well as other times.
  Check if you have windows update on auto-update settings mode.
  Check if you have any other software installed which is a developer tool or a microsoft product and is set on auto update.
  Check if you have any server utility installed
  Check if your task manager is auto loading services.
  Enable firewall and restrict all traffic to admin mode only.
  Check all services that have default mode set to admin, if they have update utility
  Check Event Logs when the download happens. See which software or service is doing it. You will get a path to it there.
  Check if you have rogue installations on your computer.
  Check registry by using regedit. Clear registry for rogue entries.
  If none of these work, I would recommend you to format c: and reinstall windows

  I thought my Visual Studio installation would have been up to something, but even after looking into them I could not find anything
• 

  Satya Swaroop Dash

  KenJackson

  If a virus added or replace a file on your machine, it will probably have a more recent date than the other files. I found the only virus I've been infested with this way. Open a CMD window and enter:
  

  cd %winsysdir%      (This should take you to C:\windows\system32 or equivalent)
  dir /od

  
  The above is the result and I think the PerfStringBackup is the culprit, from a little Google search, everyone seems to point out PerfStringBackup.INI. But it looks like a log file of something.
  Have a look at the screenshot, I think you can figure out something.
• 

  KenJackson

  I don't see anything alarming--assuming you updated the flash player last month. Also, I don't know what directory 1033 is.
• 

  Satya Swaroop Dash

  KenJackson

  I don't see anything alarming--assuming you updated the flash player last month. Also, I don't know what directory 1033 is.

  Thanks, man. You and @#-Link-Snipped-# were quite helpful.
  I have implemented both of your solutions, and I am keeping a keen eye on my network monitor and will keep you updated.
• 

  Nayan Goenka

  Satya Swaroop Dash

  Thanks, man. You and @#-Link-Snipped-# were quite helpful.
  I have implemented both of your solutions, and I am keeping a keen eye on my network monitor and will keep you updated.

  No problem. Happy to help. You make Voice Content for us that is quite awesome 😛
  Btw there is one more advanced setting you can do. After this you need to jst forget about this issue and that is configure firewall in advanced mode. Of course that is some pretty tough advanced stuff but that is the ultimate option you can do to control your network