I just got Windows 11 for the first time and I wanted to make sure that I didn’t bring over any malware from my previous windows installation (even though I already wiped my partition). After installing Windows 11, SysInternalsSuite, Malwarebytes, Wireshark, and chrome I reset my machine and ran “netstat -bn” off boot to check for any signs of Spyware and I noticed that one of the ip connections for a svchost.exe was pointing to a VPN server in Sweden.
I’m not aware of all of the Windows Services but I do know that it does have some sort of VPN integration. Never the less, I just wanted to check if this is normal behavior and not some malware running on my machine.
Edit: The Malwarebytes anti-virus is the most likely culprit here (even though I never enabled the VPN feature or have access to it). I tested this by uninstalling Malwarebytes which caused my computer to stop attempting to connect to the VPN Server, and only once I reinstalled Malwarebytes my computer starting attempting connection to the server once again.
This isn’t normal behavior after a clean install. This would lead me to believe that you still have traces of whatever malware was on your last build, or there is a network device redirecting traffic to the server in Sweden. I just did a clean install of Win11 yesterday and followed the directions from Microsoft here: https://www.microsoft.com/en-us/windowsinsider/cleaninstall
You’d need to have a clean 8GB or larger USB drive to follow the steps from them. I would also make sure that when you create the USB to do so on a known clean device and make sure you don’t use any infected media, drives, etc. that end up reinfecting you. Maybe others have some better ideas than I do, but this is what I did. Good luck!
Thanks for letting me know! But to be honest I was almost certain that I didn’t have any malware on my previous build as I have run multiple diagnostic checks and almost never run or download anything that could be considered malicious, I was more of just paranoid and taking extra precautions just incase I screwed up on my previous build.
But for my current Windows 11 installation I started out with a clean USB drive, then I installed Windows 11 on another machine that I am almost certain was clean. I then booted from it and followed the installation process, while making sure to wipe the entirety of the partition I was installing it to. After the installation I installed SysInternalsSuite, and used procexp64 and Autoruns64 (with admin permission) to verify that no malicious programs were running. After that I installed malwarebytes and ran a scan with rootkit detection enabled and followed that with a windows defender quick scan + offline scan. I then installed chrome and from chrome I installed Wireshark and verified that no packets from unknown sources were being sent out. Finally I rebooted my computer and saw the VPN connection attempt on my netstat command. I also later ran more malwarebyte scans and checked with procexp64 and autoruns64 and the only thing that I could find potentially malicious was that an installation that was part of Wireshark, Npcap, has a process called npcapwatchdog which is marked as (Not Verified) by Autoruns64 but is unlikely to be an issue after doing some research. Other then that I am unsure why svchost.exe attempted to connected to that VPN server but I might try to do another clean install as you suggested just to be safe.
Hmm, might be on to something there. OP - If you open MalwareBytes does it say it’s connected to a VPN? I don’t have the version that includes VPN, but perhaps you do?
Anything else weird happening, or just the VPN connection? Any other devices connected to the same network having similar issues?
I think you guys are right, even though I never enabled the VPN! It currently is shown as disabled (and even locked behind a paywall) but the region selected by default is in Stockholm, Sweden which could just be the VPN connection location rotating.
I ran a test by uninstalling Malwarebytes to see if I get the same results and my computer stopped attempting to connect to the VPN Server in Sweden. I then reinstalled Malwarebytes with the exact same settings and my computer starting attempting to connect to the same server again! So I am almost certain that the connection is due to Malwarebytes.
Wow, that’s pretty crazy that it’s connecting to a VPN even though you aren’t paying for it nor have it enabled. I’d maybe reach out to Malwarebytes Support to see if they can help.