McAfee has been blocking a connection from a certain IP address (I found the IP Adress to be from Hong Kong). Should I be concerned? McAfee says the program is "SYSTEM". Also if I should be concerned what could I do about it?
If the connection is originating from your computer, you should investigate why
Determining which process is attempting the connection
There are several tools in the [Sysinternals Suite] that can help you understand what program is making the connection. The TCPView program may show you the attempted connection, but as I understand it, it is basically just a GUI on netstat, so you might miss the connection.
The process monitor (ProcMon) tool will capture many different kinds of events concerning network connections, the file system and the registry (and much more). This page has details about how to use ProcMon to trace network connections to the responsible process.
Additionally, you can use the new sysmon tool. This page has some details on how to setup and use sysmon.
Once you determine the process that is sending the connection, you can use Process Explorer to submit the program to Virus Total. Virus Total will scan the sample across a few dozen AV products. A non-finding of a malicious signature doesn't necessarily mean it is benign, but its a good start. Launch
procexp.exe as Administrator, locate the process via it's PID and right click to select "Check VirusTotal".
Determining what the process is trying to send
Using a program like wireshark, you may be able to determine what the program is trying to send. If McAfee is blocking the connection then, then nothing may be sent because connection is blocked. However, if you can determine what DNS entry is being used (if one is being used at all), then you can edit your hosts file to your local host. You can then set up a temporary webserver, (I like using python's
python -m SimpleHTTPServer 80) to allow the connection to be established.
Follow Traditional Malware Investigatory Practices
If you can't track down the network connection, follow traditional approaches to determining if your computer is infected with malware. This post has many areas to investigate. Further, you can use tools like volatility to investigate your computers memory. Volatility can be especially helpful if a rootkit has been utilized to hide processes.