Windows 7 Unwanted Network Activity

MajorModeler · May 19, 2014

Running Win 7, 64 bit.
Watching the Task Manager, Networking tab, there is an almost constant stream of incoming traffic, even after I have closed Outlook and IE Explorer. I would like to find out which program is requesting the traffic, where it is coming from, and stop it unless I specifically request incoming traffic. Netstat does not help much. WhoIs usually returns an unknown for the IP that I try.
Suggestions?

Peace,
Mike G.

MajorModeler · May 21, 2014

Fixer1234 said:
Unplugging the cable won't buy you much because the activity is happening when you use it, also. The incoming stream isn't typical of malware. If something was being downloaded by malware, it would complete the operation and stop. If something is being uploaded, it wouldn't show up as incoming. It is likely a legitimate process on your computer. Non-productive traffic in the 1M range seems excessive, though, so let's see if we can figure out what it is. Re-enable anything you disabled in previous diagnostics. Try these next:

Look in Task Manager, Services tab. The last column is labelled Group. Look for any entries LocalServiceAndNoImpersonation. If you find any and the Status is Running, stop them. See if the...

MajorModeler · May 21, 2014

badrobot said:
I don't think that is something to get worried about. As long as your computer is connected to the internet (wired or wireless) there will be some sort of activity there all the time. In my case, I have NAS that always connects to my PCs and some programs looking and notifying me for updates like Avast and Malwarebytes online protection. That's the activity I am getting in my network.

I am just uncomfortable not knowing exactly who is sending me stuff and where the traffic is coming from. Not having absolute control over MY MACHINE makes me very unhappy and "slightly" paranoid. I guess I shall continue to unplug the internet cable when I am not actively wanting to use it. A real PTA.

Fixer1234 · May 21, 2014

Unplugging the cable won't buy you much because the activity is happening when you use it, also. The incoming stream isn't typical of malware. If something was being downloaded by malware, it would complete the operation and stop. If something is being uploaded, it wouldn't show up as incoming. It is likely a legitimate process on your computer. Non-productive traffic in the 1M range seems excessive, though, so let's see if we can figure out what it is. Re-enable anything you disabled in previous diagnostics. Try these next:

Look in Task Manager, Services tab. The last column is labelled Group. Look for any entries LocalServiceAndNoImpersonation. If you find any and the Status is Running, stop them. See if the incoming stream stops.
There are three safe modes: Safe Mode, Safe Mode with Networking, and Safe Mode with Command Prompt. Select Safe Mode with Networking and see if you get the incoming stream.
Try a clean boot. This is similar to safe mode in that it limits what is loaded, but it loads more than the bare minimum for Windows to function. Follow these instructions: http://support.microsoft.com/kb/929135 Make notes of anything you disable so you can put it back later. See if you get the incoming stream in this mode.

MajorModeler · May 21, 2014

Fixer1234 said:
Unplugging the cable won't buy you much because the activity is happening when you use it, also. The incoming stream isn't typical of malware. If something was being downloaded by malware, it would complete the operation and stop. If something is being uploaded, it wouldn't show up as incoming. It is likely a legitimate process on your computer. Non-productive traffic in the 1M range seems excessive, though, so let's see if we can figure out what it is. Re-enable anything you disabled in previous diagnostics. Try these next:

Look in Task Manager, Services tab. The last column is labelled Group. Look for any entries LocalServiceAndNoImpersonation. If you find any and the Status is Running, stop them. See if the incoming stream stops.

There are three safe modes: Safe Mode, Safe Mode with Networking, and Safe Mode with Command Prompt. Select Safe Mode with Networking and see if you get the incoming stream.

Try a clean boot. This is similar to safe mode in that it limits what is loaded, but it loads more than the bare minimum for Windows to function. Follow these instructions: http://support.microsoft.com/kb/929135 Make notes of anything you disable so you can put it back later. See if you get the incoming stream in this mode.

After I unchecked the two Media Center boxes in msconfig earlier, then re-booted, the extraneous internet activity seems to have stopped (for now ).
I did find three LocalServiceAndNoImpersonation labeled services in the Task Manager that were running. I did try to stop then, but I got a "you do not have authorization" messages when I tried to stop them. There were a few other services with the same label, but they were tagged as stopped.
Now I can see periodic, frequent, pings going out, but the constant incoming traffic has stopped.
Now I have to figure out why a Windows 7 update failed... Never ending cycle..

Thanks to everyone who offered assistance. I am going to archive this info in case I need it again.

Peace,
Mike G.

Fixer1234 · May 21, 2014

In an earlier post, it sounded like you disabled the Media Center stuff in msconfig but were still having the issue. That could be because changes to msconfig don't take effect until you reboot. Glad to hear you fixed it. Thanks for reporting back.

MajorModeler · May 21, 2014

Fixer1234 said:
In an earlier post, it sounded like you disabled the Media Center stuff in msconfig but were still having the issue. That could be because changes to msconfig don't take effect until you reboot. Glad to hear you fixed it. Thanks for reporting back.

Yeah, in my anxiousness I had forgotten that those changes do not become effective until after re-boot.
I guess the old axiom still prevails - when all else fails, do a hard (power removed) re-boot!

Windows 7 Unwanted Network Activity

MajorModeler

New Member

MajorModeler

MajorModeler

New Member

Fixer1234

Senior Member

MajorModeler

New Member

Fixer1234

Senior Member

MajorModeler

New Member

Similar threads