Resource Monitor showing GWCtlSrv.exe activity, but GlassWire doesn't

Hi GlassWire,

Fantastic program first of all. Just installed it 2 days ago. Brilliant design and easy to grasp.

But, can you please explain to me why GWCtlSrv.exe is sometimes UPLOADING up to 1000 B/sec for 10-15 minutes and then stops, just to do it again a bit later?

The thing that’s worrying me is that I can see the activity just fine in Windows Resource Monitor, but I can’t see any trace of it in GlassWire other than the initial connection shown in the image below.

Why don’t you track that process? and what is it uploading? (I don’t mean to be rude, but I do wonna know).

Thank you in advance. Happy New Year.

Kind Regards,

GlassWire is checking for software updates and suspicious host updates. If you block GlassWire from accessing the network then you will not know about new versions of our software that contain security and bug fixes.

You need to click the spike on the graph to see the network data. We show all of GlassWire’s connections over the network. Your private data and network activity never leaves your PC unless you use our remote access feature to send your data to your other PC.

Hi Ken,

Thanks for the answer.

But. The problem is that although the activity shows up in Resource Monitor, it does not show up at all in GlassWire.

I believe it to be a bug in the tracking of the network traffic for that process. Everything else works fine, but that process (GWCtlSrv.exe).

Go to the graph period in the screenshot above, and then click the graph one time with your mouse and you’ll find the network traffic appears there. It’s very important that GlassWire shows all activity for our own software or people will not trust us. We make sure GlassWire shows all its own activity and also allows the user to have GlassWire block itself from accessing the network.

Sir, that is the initial connection. It’s been quiet ever since… but it is clearly making connections and uploading a great deal of data.

If it was checking for updates, wouldn’t it be rather quick in upload and not go beyond a 1000 kilobytes? And if it actually found an update, it would be tracked as “download”… not upload.

You see the problem here?

I stopped using it as I could not identify the data that was send to your servers, and I believe that the process didn’t stop after I closed GlassWire (I waited for at least 5 minutes, and it was still going).

If you can’t accurately prove what GlassWire uploads to your servers, then I will discontinue my usage of GlassWire and will not recommend it to my friends and collegues.

It is only for the sake of my own privacy. I understand that the statistical data on my usage is valuable, but it can hardly be only statistics it’s uploading.

We at GlassWire absolutely cannot see any network data on your computer and we have no mechanism in place to access that data even if we decided we wanted to do so. Your network/usage graph or data never goes to our servers at all in any way shape or form.

GlassWire checks for software updates and updates its suspicious host list. We also get a brief connection when GlassWire is installed so we can count how many installs we get. This is all described in our privacy policy

If users don’t like GlassWire to update its suspicious hosts or check for updates we made GlassWire have the ability to block itself from accessing the network. You can make GlassWire block itself under its Firewall tab, and this blocking is done through the Windows Firewall API.

We don’t care if the statistical data on your computer is somehow worth a million dollars. We cannot access it and we have no ability to do so technically, and we don’t want access to your data. We make money by selling our software here not by spying on our users.

GlassWire has a large audience, some of which are security professionals and if we were stealing user data without user permission we’d probably be sued out of existence. Stealing user data is the opposite of what our company is about.

We also have a large number of security professionals testing GlassWire for vulnerabilities and we pay out bug bounties to those professionals on HackerOne If GlassWire had some ability to send your graph data to our servers (which it absolutely does not) please submit a report to HackerOne and we’ll investigate and pay a bounty if you’re correct.

We at GlassWire are also extremely paranoid about our own security and privacy and we respect your opinion and we want our users to ask questions but in this case I can assure you we cannot see your data even if we wanted to.

I wanted to add that GlassWire does send data between its service and the .exe on your PC (not over the network at all). If you’re using a third party software to track what GlassWire is doing maybe that’s what you’re seeing?

1 Like

Thank you for your thourough answer. I will check the thirdparty application I use, to see if it’s misinterpreting the activity from tge GlassWire process I discribed earlier.

I see now that if GlassWire was capable of uploading any user data you would get in trouble pretty fast.

that program is a part of the glasswire program. glasswire it self is showing up in the firewall tab, witch is signifying the program as a whole. but I have noted that the program don’t always catch everything. for example…windows 7 64bit. windows update don’t show up @ all in the program when it should.

@clamo Did you reboot since installing GlassWire? We warn in the installer that GlassWire may not pick up all network connections until after a reboot, but we don’t force it.

yes I rebooted. what is happening now is that on boot, the program starts to consume ram like crazy till it hits about 2gigs, then it drops back down to about 500 MB. :astonished:

Please email our helpdesk and ask to join our testing group. We should have an update out this week for that testing group that helps people who have this memory problem.