The background services on my system are consuming a lot of bandwidth. (I think 50 GB in 7 days). I got a little suspicious.
On investigating it seems that some system programs are making a lot of connections to remote machines. These are svchost.exe, dllhost.exe, and System Process (PID 0).
Why are Windows system services making this many connections? (About 150 in total)
You mentioned SVCHost, which I've done a bit of research on. (It wouldn't surprise me at all if DLLHost is similar.)
SVCHost is basically a fancy (documented) trick that Microsoft uses to have multiple "services" look like a single process. The real source of the problem is almost never actually SVCHost, but it is one of the processes that gets disguised as SVCHost. Yeah, this complicates troubleshooting. However, there are some speed benefits, so combining multiple software into a single "process" does have some beneficial purpose.
So if you have some sort of problem with SVCHost, you probably won't get very far by just blaming SVCHost. What you need to do is to figure out which service is actually causing the issue. Some software can provide information about the services within an SVCHost instance, while other software may simply lump things together and simply report the combination as SVCHost. Which of these things happens will depend on just what the reporting software is looking at.
Often, a computer may run multiple SVCHost instances. One step that you can take is to figure out just what services are part of the SVCHost instance that seems to be causing problems. Even by doing just that one single step, things may be narrowed down much further than simply saying "a service", which is pretty much the only thing that can be concluded if SVCHost is blamed for something.
Try: TASKLIST /SVC Then you can match the PID to some services.
Or, try Resource Monitor (Task Manager, Performance tab), CPU. In the "services" section (which you may need to expand), you can sort by PID to see what services are using it.
