How to identify updates?

Please help. In South Africa, internet usage is charged according to the amount of data received and sent. I have a programme (I assume) that is updating itself and consuming large amounts of data that I cannot identify. Automatic updates are turned off, Firewall etc on. How can I seek and destroy the invading bugger?

 

You can check the running processes for anything with the word "sched" in the process name or "upd" or "update" in the process name. These types of processes are usually scheduled updaters for other programs. If you use a good 3rd party process manager, it ill tell you which process is linked to which program. An excellent process explorer is System Explorer. It's freeware and available from this link. If you pause the mouse on a process, the program gives you info about the parent program of the process, and if you look at the Connections tab, it shows you which programs are accessing the internet and through what port. You can use this information to block the culprit in your firewall, or to turn off the program's update feature, or to remove the program completely.
Good luck!

 

Many thanks dlb, I downloaded your System Explorer suggestion and think i have found the culprit. On the connections page there is a svchost.exe programme which is causing the problem. It's a generic host process for Win32 services and the parent process is services.exe. I've tried to cancel but it is automatically shutting down the pc. The path appears to be linked to: cds212.lon.llnw.net:http. Any further suggestions would be well received as I cannot seem to restrict/cancel its task.

Jason