McAfee Suspicious Connections

[Madhan]

Hello @Jay1771 

Sorry for the delayed response.

Could you please provide more information about Delta App? Is that a program installed by you?

A Full Scan usually takes sometime to complete since it scans the entire system. It also depends on the speed of your computer, number of files and programs installed. So whenever you want to run a Full Scan, ensure you complete all your work on your computer and then start a Full Scan and let it run.

Regards,
Madhan M

[Jay1771]

Hi @Madhan , 

Thank you very much for the reply, I think the extensive amount of time for a full scan could be caused by the failed hard drive.

In regards to the delta app. Malwarebytes classified it as generic malware and it was located in c:\Program Files (x86)\Delta\delta\1.2.21.5\uninstall.exe that's as far as I know.

Hope this helps 

[Madhan · Accepted solution]

Hello @Jay1771 

Thanks for the info.

I did a bit of research online about Delta and as far as I know, it could be related to Delta Airlines. I couldn't find any other popular program with the name Delta. I request you to research online about the Delta App on your computer. If you are not sure how it got installed, I suggest you to remove it, but only after a complete research.

I suspect that it could be a False Positive detection by Malwarebytes. So, I request to visit  www.virustotal.com and you can check if the file which is being quarantined by Malwarebytes is a legit detection or False Positive. 

If its False Positive, you can contact Malwarebytes and let them know so that they will fix it.

If its not a False Positive detection and McAfee is failing to detect the file as a Malware, you can follow the below Article that will help you report to concern team in McAfee,

How to submit virus samples to McAfee

Hope the above information helps you.

Regards,
Madhan M

[Jay1771]

Hi @Madhan ,

Your prompt reply is highly appreciated. I had in fact done some research and I found one thing which led me to deleting through malwarebytes as soon as I found out that it was quarantined, this was that it could have possibly been a browser hijacker. I think it was on a wikipedia page about browser hijackers that it included the name Delta as one of the known programs. Although wiki isn't the most reliable/accurate source of info I thought it was best not to let a potential risk remain on the device so I deleted the file/program through the malwarebytes app.

Just as an update the blocked connections are still happening, I understand from your previous advice that this is very much normal but one blocked connection had been reoccurring not in the past few days but just in general. I could not pin it down with my research, do you have any way of identifying the pc/site if I provide the IP?

*Next time I will also try my best to inform you or a member of the mcafee community before deleting any files to ensure that a potential vulnerability/exposure can be patched but hopefully nothing like this will reoccur in the future.

Kind regards 

[Jay1771]

Hi @Madhan, 

I have sent you a private message regarding this query and would highly appreciate it if you could have a look and provide some advice.

Thank you

[Madhan]

Hello @Jay1771 

I've responded to your Private Message. Please check.

Responding to your above query,

There are many browser hijackers that could steal your information, log your entries or perform any kind of malicious activity. Please ensure you have a look at your Extensions that are being added to your browsers. If you find any extensions or add on's that you are unaware of, please remove from the browser.

Also, if your browser malfunctions, redirects to unwanted sites or show unwanted Ads, I suggest you to reset the browser by removing cookies, cache, history etc. You can find steps in performing these from your browser help.

I recommend you to install WebAdvisor by McAfee that will help you browser safely online. This product is absolutely free. McAfee WebAdvisor is your trusty companion that helps keep you safe from threats while you browse and search the web. 

Regarding the blocked connections that appears on your console, please check the IP which is being blocked. Resolve the IP and check if its related to any suspicious site. 

Regards,
Madhan M

[Jay1771]

I have made an other private message as there was some misunderstanding. Also what is the process of resolving and IP.

Thank you

[Madhan]

Hello @Jay1771 

I've responded to your private message.

Resolving IP is to check the URL or the domain its related to. Please open command prompt as Admin and type nslookup<space><ipaddress>. If the IP is related to any website or a domain, it will list the output. If the IP or the connection is from a particular computer or a server, we cant find that out. Its better you connect with your ISP and seek help from them.

Regards,
Madhan M