"svchost.exe (netsvcs)" downloading something huge

[denzelink]

Here is a strange situation, i had checked for windows updates for my dell inspiron 5520 win7 64bit and there was just 1 update available. I installed it and restarted my laptop.

After that the process "svchost.exe (netsvcs)" started consuming my 3g net bandwidth and by the time it stopped it had consumed about 310 MB of data. I guess that this process is related to windows update and if that is the case then what was it downloading?

I'm a little worried about what it was downloading so stealthily and so big in size. Thanks for the help guys...

 

[denzelink]

Have you run anti-virus scans as well as a malware scan?

Actually I have KIS fully updated and set to its highest protection settings. And at that time, I was also monitoring the network traffic from its inbuilt network monitor. I always keep a close watch on any anomalous network activity with the help of windows Resource Monitor. What I noticed was that there were some files by the name of qmgr0.dat and qmgr1.dat that this process was accessing/modifying. So I ruled out the possibility of any malware activity as these are genuine windows files.

This was not the first time that as well that "svchost.exe (netsvcs)" was downloading something but the size of data was usually in the range of less than 50 MB. Is it normal for fully patched windows to download stealthily something so big in size?

 

[denzelink]

I am glad that you monitor your system closely. I would still do some scanning.

I scanned my system and did not find anything remarkable except 2 things. First time, my KIS crashed midway while scanning unexpectedly and second time, there were a few unprocessed objects which my antivirus recognised as "not-a-virus: WebToolbar.JS.Condonit.a". I guess that is some kind of toolbar for my Google Chrome but i don't know why my av did not scan it. The reason it displayed is "skipped by user" but i never skipped anything!

Anyway, do you think it was the reason for that data exchange or it was a legit windows process downloading that data? My suspicion is on the latter one.