Author Topic: This site flagged as a threat by McAfee? (Read 918 times)

zer0netgain · « **on:** November 05, 2020, 03:55:11 AM »

Something happening with my work PC. Is there a reason for this?

garry · « **Reply #1 on:** November 05, 2020, 05:27:43 AM »

We're a threat to your productivity?

Bounce · « **Reply #2 on:** November 05, 2020, 07:08:50 AM »

Quote from: garry on November 05, 2020, 05:27:43 AM

We're a threat to your productivity?

Nailed it in 1.

Work resources for personal use? That's a write up where I worked.

zer0netgain · « **Reply #3 on:** November 06, 2020, 03:55:43 AM »

Quote from: garry on November 05, 2020, 05:27:43 AM

We're a threat to your productivity?

Not really. A blacklist site gets a different page. McAfee is about detecting a threat from the website...or it was blacklisted by McAfee and not the IT department.

Bounce · « **Reply #4 on:** November 06, 2020, 07:58:23 AM »

Quote from: zer0netgain on November 06, 2020, 03:55:43 AM

Quote from: garry on November 05, 2020, 05:27:43 AM
We're a threat to your productivity?

Not really. A blacklist site gets a different page. McAfee is about detecting a threat from the website...or it was blacklisted by McAfee and not the IT department.

There's your problem. McAfee acts like a virus itself; it puts fragments of code all over your WinTel system and it's own uninstaller leaves huge swaths of that code behind when done. It's hard to completely remove without going into Registry Editor and hunting each reference manually. Meanwhile, it inserts itself into ALL I/O operations and creates enough overhead that performance hits can be felt. We got it for free as a function of the company license with them. After having to fix all the machines I worked on as a direct result of it, I actually PAID for something different for my home systems.

We even learned that McAfee culls old virus signatures from its list to improve performance. We got hit by an attack that was mitigated years before simply because McAfee decided it was too old to be a risk.

Much less intrusive (and only ANTI-VIRUS instead of trying to be more) are uBlock Origins for your HTML (browser) and eSet anti-virus for it's long signature list and low overhead.

Skee · « **Reply #5 on:** November 06, 2020, 09:15:27 AM »

Wish I had known that before I bought a new PC from Dell. Arrives today. Comes with McAfee pre-installed.

zer0netgain · « **Reply #6 on:** November 06, 2020, 09:51:20 AM »

I'm able to access now. Only difference is that I'm plugged into the network directly and not remotely. If I have issues back at home, that's the issue.

zer0netgain · « **Reply #7 on:** November 06, 2020, 01:42:08 PM »

Just tried from home. Blocked. This appears to be a quirk with the remote access protocol that is disabled when plugged directly into the network.

Bounce · « **Reply #8 on:** November 07, 2020, 08:18:07 AM »

Quote from: Skee on November 06, 2020, 09:15:27 AM

Wish I had known that before I bought a new PC from Dell. Arrives today. Comes with McAfee pre-installed.

First-time boot... decline activation and uninstall. It may not get all of it but it's a start.

Skee · « **Reply #9 on:** November 07, 2020, 10:01:23 AM »

Quote from: Bounce on November 07, 2020, 08:18:07 AM

Quote from: Skee on November 06, 2020, 09:15:27 AM
Wish I had known that before I bought a new PC from Dell. Arrives today. Comes with McAfee pre-installed.

First-time boot... decline activation and uninstall. It may not get all of it but it's a start.

Many thanks - that is exactly what I was planning to do.

Mid-90s McAfee was great stuff. They went south sometime after that. I installed it on my XP laptop circa 2008 and it crapped it up so bad I actually made the store give me my money back for the software. (A complete reinstall of the OS - which you had to do periodically with XP anyway - resolved that.) Figured McAfee should have improved since then - declining the "free" software wasn't an option on any of the Dell tower models I wanted - I figured what the heck; how bad could it be?

Back to the OP. Your employer may (or may not) have different security protocols for on-site and remote access. The warning might have something to do with STO's certificates. My iPad used to warn me that STO is a potential risk - it's not - ignore it and the warning goes away.

All that being said, your employer may still be monitoring you. We had a little piece of software that told us how long each webpage flagged as non-work related was open. While we never openly disclosed use of the software to employees, egregious violators were warned and it could factor into your performance review.

I can't tell you how many management theory books were written in the 80s about how to prevent the coming internet revolution from destroying office productivity. See how that worked out...

Bounce · « **Reply #10 on:** November 08, 2020, 09:05:28 AM »

viffergyrl · « **Reply #11 on:** November 08, 2020, 03:25:44 PM »

The only thing I've noticed and coincidental with the OP is that GMail is now warning me that emails from this site could be spam.... even though I've whitelisted it.

PatM · « **Reply #12 on:** November 08, 2020, 07:32:08 PM »

I had the same issue whenever I would login remote using the company VPN.
Anything regarding travel and touring was flagged because the corporation had a contract with Amex Travel. LOL

CLAY · « **Reply #13 on:** November 09, 2020, 06:07:30 PM »

Quote from: viffergyrl on November 08, 2020, 03:25:44 PM

The only thing I've noticed and coincidental with the OP is that GMail is now warning me that emails from this site could be spam.... even though I've whitelisted it.

I get the same thing.

Bounce · « **Reply #14 on:** November 11, 2020, 09:11:55 AM »

Quote from: CLAY on November 09, 2020, 06:07:30 PM

Quote from: viffergyrl on November 08, 2020, 03:25:44 PM
The only thing I've noticed and coincidental with the OP is that GMail is now warning me that emails from this site could be spam.... even though I've whitelisted it.

I get the same thing.

Take the time to flag is as "not spam" so we all benefit from the feedback.

viffergyrl · « **Reply #15 on:** November 11, 2020, 12:00:48 PM »

Quote from: Bounce on November 11, 2020, 09:11:55 AM

Quote from: CLAY on November 09, 2020, 06:07:30 PM
Quote from: viffergyrl on November 08, 2020, 03:25:44 PM
The only thing I've noticed and coincidental with the OP is that GMail is now warning me that emails from this site could be spam.... even though I've whitelisted it.

I get the same thing.

Take the time to flag is as "not spam" so we all benefit from the feedback.

I did; that was the original filter: Not spam; categorize under Forums. Nothing has changed, so not sure why GMail all of sudden has a problem, but I re-did the filter... just for you.

Bounce · « **Reply #16 on:** November 12, 2020, 08:17:10 AM »

I think they flag "behavior" and when some place (a forum) seems to be sending out a lot of mail to different places it gets flagged as "spam" or a bot of some kind. It will adapt based on feedback like you sent (if really impartial as claimed).

viffergyrl · « **Reply #17 on:** November 12, 2020, 02:48:27 PM »

Quote from: Bounce on November 12, 2020, 08:17:10 AM

I think they flag "behavior" and when some place (a forum) seems to be sending out a lot of mail to different places it gets flagged as "spam" or a bot of some kind. It will adapt based on feedback like you sent (if really impartial as claimed).

The emails failed DMARC, whatever that is. I sent Google an email. The filter had been working just fine. Even after redoing the filter and making sure 'admin@sport-touring.org' was in my Contacts, the warning still remains. All per Google's recommendations.

Bounce · « **Reply #18 on:** November 14, 2020, 09:54:46 AM »

What is DMARC. It might be due to a conflict between this site's DNS name and the security settings for DMARC. Perhaps sending this article with an explanation of the problems to the people who own this domain?

"Set up DomainKeys Identified Mail (DKIM) authentication

Setting up a DKIM email authentication record is required in order for your messages to pass DMARC. What DKIM does is "vouch" for any email you send from ActiveCampaign. This, in turn, helps you pass the DMARC policy check."

https://help.activecampaign.com/hc/en-us/articles/360010810180-Troubleshooting-failed-email-delivery-from-DMARC

viffergyrl · « **Reply #19 on:** November 14, 2020, 01:29:12 PM »

Quote from: Bounce on November 14, 2020, 09:54:46 AM

What is DMARC. It might be due to a conflict between this site's DNS name and the security settings for DMARC. Perhaps sending this article with an explanation of the problems to the people who own this domain?

"Set up DomainKeys Identified Mail (DKIM) authentication

Setting up a DKIM email authentication record is required in order for your messages to pass DMARC. What DKIM does is "vouch" for any email you send from ActiveCampaign. This, in turn, helps you pass the DMARC policy check."

https://help.activecampaign.com/hc/en-us/articles/360010810180-Troubleshooting-failed-email-delivery-from-DMARC

The person (singular) who owns this site is FJR1300, as it's always been.

Thanks for the research.

jadziadax8 · « **Reply #20 on:** November 14, 2020, 01:38:29 PM »

Seems suspicious that FJR1300's name is Marc...

viffergyrl · « **Reply #21 on:** November 14, 2020, 02:21:19 PM »

Quote from: jadziadax8 on November 14, 2020, 01:38:29 PM

Seems suspicious that FJR1300's name is Marc...

I see what you did there.

f'ckin' cops

PatM · « **Reply #22 on:** November 14, 2020, 04:07:47 PM »

Quote from: viffergyrl on November 14, 2020, 02:21:19 PM

Quote from: jadziadax8 on November 14, 2020, 01:38:29 PM
Seems suspicious that FJR1300's name is Marc...

I see what you did there.

f'ckin' cops

FJR1300 · « **Reply #23 on:** November 14, 2020, 07:30:03 PM »

McAfee is the WORST anti-virus known to mankind.

As far as the DMARC and DKIM records, we are good. I just rotated the keys and I am changing the encryption from 1024 bits to 2048 bits.

The spam issue is an unknown to me as the email is handled by Microsoft. I've been using Office 365 for the past four years.

FJR1300 · « **Reply #24 on:** November 14, 2020, 07:33:01 PM »

Quote from: viffergyrl on November 14, 2020, 02:21:19 PM

Quote from: jadziadax8 on November 14, 2020, 01:38:29 PM
Seems suspicious that FJR1300's name is Marc...

I see what you did there.

f'ckin' cops

RETIRED cop.

viffergyrl · « **Reply #25 on:** November 14, 2020, 09:21:58 PM »

Quote from: FJR1300 on November 14, 2020, 07:33:01 PM

Quote from: viffergyrl on November 14, 2020, 02:21:19 PM
Quote from: jadziadax8 on November 14, 2020, 01:38:29 PM
Seems suspicious that FJR1300's name is Marc...

I see what you did there.

f'ckin' cops

RETIRED cop.

Excellent. Thanks for looking into the issue.

M.Brane · « **Reply #26 on:** November 14, 2020, 10:35:01 PM »

Greedle.

Bounce · « **Reply #27 on:** November 15, 2020, 09:43:18 AM »

Quote from: jadziadax8 on November 14, 2020, 01:38:29 PM

Seems suspicious that FJR1300's name is Marc...

AKA: De Marc? (get it? demarc?)

FJR1300 · « **Reply #28 on:** November 16, 2020, 06:48:20 AM »

Quote from: Bounce on November 15, 2020, 09:43:18 AM

Quote from: jadziadax8 on November 14, 2020, 01:38:29 PM
Seems suspicious that FJR1300's name is Marc...

AKA: De Marc? (get it? demarc?)

zer0netgain · « **Reply #29 on:** November 25, 2020, 05:31:08 AM »

Interesting....

Yesterday it was flagged and blocked. It's working now. Only difference is that it's 6:30 am (local) and the "office" opens at 8:30 am. I wonder if these protocols kick in only during office hours...which is weird. I'll try again later when we should be "open."