Has my McAfee Security Scan Plus been compromised?

[julius21372]

I was using the Internet yesterday afternoon, when I received a pop-up saying that an update for McAfee Security Scan Plus was available.  I started the update and expected it to be a normal download.   However, within minutes of completing the download, my computer was attacked by the Fake Microsoft Essentials Alert Virus.  I was immediately suspicious of the Alert and cancelled out of it, rebooting my computer before doing anything else.  After returning to the Internet and learning what I could about this virus, I ran Trend Micro Titanium, which detected nothing suspicious on my computer.

I realize that it could be just a coincidence that the McAfee SSP download was immediately followed by the Fake Alert, but I'm worried that the download might have actually been a Fake Upgrade.   Any thoughts on that?

[selvan]

Hi julius21372,

McAfee Security Scan Plus is more of a Marketing tool which detects whether Virus Protection is available in the Computer and prompts to purchase McAfee if there is no Protection.

Please check the list of Installed programs whether a Security Suite of McAfee is Installed..!

[exbrit]

As Selvan states, it's merely a tool and not security software.   It's an option with many other 3rd party software downloads and the option not to install it can easily be missed, but you can uninstall it in the normal manner.

Here's one example (click to enlarge):

Message was edited by: Ex_Brit on 26/02/14 2:20:41 EST PM

[julius21372]

Hi Ex_Brit,

I realized, as Selvan stated, that McAfee SSP is primarily a marketing tool rather than security software.  I'm also sure that it was offered to me when I downloaded another company's software product about a year ago. My main concern is that the copy that I have on my computer now has been modified to download malicious software, like Fake Alert.   I checked the folder in which McSSP is stored and found that uninstall.exe is one of the programs that was modified during yesterday's download, so I will do the best I can by just deleting the folder.  The only reason that I haven't done that yet is that I thought a McAfee technician might want to examine some of the McSSP files to check to see whether these have been modified by a malicious hacker.   I thought that I might be doing a public service by reporting yesterday's incident.

[exbrit]

Well thanks very much for the thought, I'm sure McAfee would appreciate that.  It's probably simply a modification brought about by a more recent encounter with the MSSP installer, although of course one can't be certain.

You could try running GetSusp which is linked in my signature below, last line.   That would submit anything suspicious to them automatically.

Also I wouldn't keep it installed if I were you.

[tjjjtae · Accepted solution]

Thats exactly how I received it. I have removed it. Thank you again

[julius21372]

Hi Ex_Brit,

OMG! My email box was spammed 32 times between 6:03am and 7:49am CST this morning:

hjgsdhfsjdg            [General Discussion] JAAN-E-BAHA...  20 Spam

sonikatiwatri           [General Discussion] ANTY-1 L..       .     8 Spam

khjghjfgjhsdgdhsf  [General Discussion] ...Onida...              4 Spam

Is this common, or should I assume the worst, i.e. that whatever threw the False Alert Virus at me is now hard at work spamming me by way of McAfee Communities discussions?

[Peacekeeper]

No we here get these spammers and delete their access as soon as we see them but as we are volunteers we cannot be on line 24/7. I just banned another 1 as he joined.If the posts are in theads you are active in you would have got a reply for each spam post they added. Sorry but happens in most forums.

[exbrit]

You can always unsubscribe from General Discussion too which might help.  You weren't actually spammed, the board was and you simply got the notifications thereof.    It happens with any forums unfortunately despite all the best measures that are put in place.

As Tony says, we deal with it eventually.