Downloads from Microsoft

[plantzzman]

Hope someone can help me out. Using a mobile broadband dongle I am limited to 3GB per month downloads. This means around 100mb per day however in recent months I have been suffering large daily downloads which can swallow up my daily allowance. I cannot get to the bottom of what this daily download is other than I know it is connecting to a Microsoft IP address because I can see the address viewing through my Kaspersky firewall software. I have switched off auto updates or atleast I have switched Windows 7 to check for updates but to allow me to choose when to download them. I dont know what else on my system may be connecting daily to a microsoft IP address so look here for help and advice.

 

[alphanumeric]

If you have Microsoft Security Essentials installed it will connect daily, if not more often, to update its definitions. I do believe it will do it even if windows update is turned off too.

 

[JanKrohn]

You could check the resource monitor. It will show you the processes that connect to the internet. It's already built into Windows 7:

http://www.sevenforums.com/tutorials/12523-resource-monitor.html

 

[Trucidation]

If you have Microsoft Security Essentials installed it will connect daily, if not more often, to update its definitions. I do believe it will do it even if windows update is turned off too.

That's true, but MSE updates should be nowhere near 100MB in size. As far as I can recall, there hasn't been anything very large from MS these past couple days - not on the scale of what the OP is experiencing.

Edit:
Misread the OP. How large exactly do you mean by "large" daily downloads? Also checking, do you browse YouTube or other video sites? (Those HD videos really add up.)

 

[arkhi]

A fresh RTM Win7 install would really rake up download bandwidth, you know.

 

[plantzzman]

Thanks for your feedback on the issue I am experiencing. The downloads I experience are around 50mb each time - often it can be twice per day which obviously will use up my 100mb allowance. All I know is when it starts if I view my network connections on Kaspersky internet security it highlights an IP address which when I check it out is associated to Microsoft so I presume its a microsoft product of some kind updating.

 

[Layback Bear]

Can you have you allowance increased.

 

[Trucidation]

Unattended downloads are usually the automatic updates, and you should be able to see that if you go Start -> Control Panel -> Windows Update; Windows is pretty quick to roll over and show you what it's doing with minimal prodding - seems highly suspicious for it to download anything sizable - especially if it's an ongoing daily thing - without you being able to bring up an interface to see what's going on.

I don't know how Windows handles failed updates though, maybe this is why it keeps trying to download something? Last time I updated a fresh XP/7 install (all updates, service packs, everything + kitchen sink), it only took overnight over a 2MB broadband connection, after which the recent updates are pretty much tiny kb-sized hotfixes.

 

[Sbrideau]

Did you recently install programs that would include an auto-updater for said programs?

 

[essenbe]

Also you mentioned Kaspersky A/V, it has to update definitions also.

 

[profdlp]

If you have multiple computers you could turn off Automatic Updates and just download the standalone patches, then install them on all the machines manually. You'd need to be organized and consistent, though.

 

[plantzzman]

Thanks for everyones feedback.
The connection is a microsoft related IP address or one of their many ! so it wont be updates for the likes of Kaspersky.
This morning it connected as follows

LOCAL PORT 49525
EXTERNAL PORT 80
IP 213.199.148.235

It downloaded 45.6mb and did another 50mb tonight

Any thoughts ?

 

[Trucidation]

When you open up Windows Updates, what do you see? Mine looks like this:



Do you have anything in your updates screen? When's the last time it says it checked for updates, or installed anything?

Other than updates, I seriously don't see what else from MS that would be downloading. Especially not on a consistent daily basis.

Just to clarify, we're talking about ONE computer here, connecting via a mobile broadband dongle you attach to it, right? You don't happen to be on a network, with other PCs sharing the internet connection?

 

[plantzzman]

I have MS updates set to check but then prompt me before downloading so it cannot really be that.
I am beginning to wonder if its the version of office I have which is office starter. I read about a problem with something called click2run which was causing problems with office - I wondered if a download was failing each time meaning I never get past the update itself - leading to daily attempts.

 

[plantzzman]

Sorry I should have added its a single PC

 

[Layback Bear]

Look in you Windows up date history and see if their is a pattern of unsuccessful installs.

 

[plantzzman]

I have checked updates - which are switched to only checking anyway so I can see whats happening. I dont see any regular update failures. This very evening my laptop did a 50mb download from Microsoft but who knows of what or why !

 

[profdlp]

Are you using any of the Windows Cloud services?

 

[kenC]

I know you think the d/l is from Microsoft but have you checked any file/folders to see if there is something you weren't aware of?

 

[Britton30]

I don't think any valid program would need ~100MB daily update. Download and update the 3 security items in my sig, then run full back-to-back scans with each. Although the IP seems to be from MS, they can be spoofed, a common malware trick. someone using a simple proxy could do it.
Someone or something could be using your PC in a botnet for nefarious purposes.
It does seem to be from Microsoft Limited, an ISP in Reading England.