1 edit | Your computer may be infected Why does Comcast/xfinity insist on sending these emails? I imagine they garner a ton of business from unsuspected noobs who believe this sales pitch, directing them towards a paid service.
Admittedly the first time I received this email I panicked. I'm not new to computers, nor fighting/repairing virus infections. Ran all kinds of scans trying to find a virus that simply didn't exist. |
|
|
|
| If you have Comcast and you get a legitmate email from Comcast it's not a sales pitch. What would they try to sell you? Free Norton? Free ConstantGuard? Read this as to what'll eventually happen: »[HomeSecurity] Comcast service notice in browser |
|
| »xfinity.comcast.net/constantguar···istance/
Option 2 is for "...fast, affordable bot and virus removal" which means they are selling me a service. It links to this...
»signaturesupport.xfinity.com/cg-bot-removal
...only $19.95 per month!
This is for a bot/virus that DOES NOT EXIST on my computer. |
|
 tshirtPremium,MVM
join:2004-07-11
Snohomish, WA
kudos:3
 ·Comcast
| There are actually two products, a free bot notice (if the problem is severe enough you will get a popup and be unable to use your connection until you clean it up/acknowledge the notice) and a second paid cleanup and repair service.
Yes, the second service MAY send ads (you can set CC email to not send OFFERS (ads) ie opt out in the settings page )
Ads are a frequently item via email, and internet and certain not worth freaking out about.
Opt-out and reporting those that fail to comply can help stem the flow of actual SPAM. |
|
 ctgreybeardOld dogs can learn new tricksPremium
join:2001-11-13
Bethel, CT | reply to MiNdErAsR
I just received the "you may be infected with a bot" email.
There is no doubt that I am NOT infected with a bot.
What do you think might have triggered this? 
--
Old dogs can learn new tricks! |
|
 NetFixerFreedom is NOT freePremium
join:2004-06-24
The 'Boro
 ·Vonage
 ·Cingular Wireless
·Comcast
 ·AT&T Southeast
1 edit | said by ctgreybeard:I just received the "you may be infected with a bot" email.
There is no doubt that I am NOT infected with a bot.
What do you think might have triggered this?
Perhaps SMTP traffic? »Re: [HomeSecurity] Comcast service notice in browser
I would not be surprised if Comcast also started flagging traffic from Netflix as bot traffic. Comcast has certainly made it clear that they consider services such as Netflix to be infections that must be wiped out.
--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower |
|
 JohnInSJPremium
join:2003-09-22
San Jose, CA
·PHONE POWER
·Comcast
| reply to MiNdErAsR
Well, considering I regularly get scripted attacks from comcast addresses all the time on my servers, I'd say its possible some people are infected on comcast 
--
My place : »www.schettino.us |
|
tshirtPremium,MVM
join:2004-07-11
Snohomish, WA
kudos:3 | reply to MiNdErAsR
Also, If you check this page »xfinity.comcast.net/constantguard/Alerts/
you can see Phishing emails spoof as coming from comcast are a constant threat. |
|
 IowaCowboyPremium
join:2010-10-16
Indian Orchard, MA
·Verizon Broadban..
·Comcast
·AT&T Wireless Br..
·Verizon Wireless..
1 edit | reply to MiNdErAsR
I would suggest that you run an antivirus program on your computer(s) as Comcast has detected malware/bots going through your connection.
--
All of my CPE (including my EMTA) is customer owned. The only Comcast owned equipment in my house is the CableCards in the two TiVO boxes I own. |
|
| reply to IowaCowboy
Re: Your computer may be infected If you read my original post, I said I had run "all kinds of scans". The computer was and is clean. There is no malware/bot traffic going through my connection.
The scans I ran: MalwareBytes, TrendMicro, Avast, and Trinity Rescue disk. Clean on all counts.
Windows updates are current, as is my antivirus program. I am also behind a router. |
|
| reply to ctgreybeard
quote:
How did Comcast determine that I may have a bot?
We identify infected computers in several ways. First, we get data from reputable Internet research groups that specialize in bot identification. The data we get includes a list of Internet Protocol (IP) addresses that are infected and those that belong to bot command and control channels. Second, we look for malicious behavior exhibited by bots such as spam, distributed denial of service attacks and repeated connections requests to known command and control channels. We then aggregate this data to confirm whether one or more of your computers has been infected.
|
|
ctgreybeardOld dogs can learn new tricksPremium
join:2001-11-13
Bethel, CT | Thanks, but that's way too vague to be useful. I have five Macs on my network. One runs a Tor relay node, one is an Apple TV, one is turned off usually. I run Sophos AV on the two laptops and have not had any recent alerts and the only alerts I have ever received were for Windows problem files.
I'm treating this email alert as a false positive as I cannot determine what it is alerting on and in my own investigation I have not found anything at all.
Perhaps the TOR relay is triggering something? It is not an exit node so it only connecting to other TOR nodes and not to web sites or such.
Or, perhaps, the Apple TV? We do stream some video through that from Apple.
It would be good if Comcast could provide a more detailed signature of what they think might be BOT activity for my network. More detail would help define the problem and its possible source.
--
Old dogs can learn new tricks! |
|
NetFixerFreedom is NOT freePremium
join:2004-06-24
The 'Boro Reviews:
·Vonage
·Cingular Wireless
·Comcast
·AT&T Southeast
1 edit | said by ctgreybeard:Thanks, but that's way too vague to be useful. I have five Macs on my network. One runs a Tor relay node, one is an Apple TV, one is turned off usually. I run Sophos AV on the two laptops and have not had any recent alerts and the only alerts I have ever received were for Windows problem files.
I'm treating this email alert as a false positive as I cannot determine what it is alerting on and in my own investigation I have not found anything at all.
Perhaps the TOR relay is triggering something? It is not an exit node so it only connecting to other TOR nodes and not to web sites or such.
Or, perhaps, the Apple TV? We do stream some video through that from Apple.
It would be good if Comcast could provide a more detailed signature of what they think might be BOT activity for my network. More detail would help define the problem and its possible source.
Did you get the popup or injected "Your computer may be infected" message when using a web browser, or only the email? My impression is that valid Comcast notifications consist of both the browser message and an email. If you only got the email, it may not be a "false positive", but a scam/phishing email. Did you examine the email headers to see if it actually came from Comcast?
As for Comcast providing you any detailed information, that is highly unlikely. I have in the past been accused of running a bot by both ISP and hosting service abuse departments because of activity from my »portscan.dcs-net.net site (so far Comcast has not bothered me). Getting information about what you have been accused of is usually like trying to pull a wisdom tooth with the micro-sized tweezers from a Swiss Army knife. The reason for that is that often the accusation email is automated, and the abuse team really has no idea why it was generated, or they are too paranoid about giving away their detection secrets to tell you.
--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower |
|
Stumbles
join:2002-12-17
Port Saint Lucie, FL | reply to JohnInSJ
Hee hee... that would be a sure bet. Just to see what would happen. Once some years ago in Northwest Ohio with Roadrunner I fired up Apache on a Red Hat box and opened the port. In less than 24 hours the logs were filling up with the usual attempts looking for cmd.exe. Roughly half the IPs were in Roadrunners domain.
Anyway, your comment reminded me of that. |
|
ctgreybeardOld dogs can learn new tricksPremium
join:2001-11-13
Bethel, CT | reply to NetFixer
said by NetFixer:Did you get the popup or injected "Your computer may be infected" message when using a web browser, or only the email?
I received just the email and the headers show that it came directly from Comcast. Google received the email from qmta02-mdp.westchester.pa.bo.comcast.net. [76.96.68.102] and I also received a duplicate email through my alternate Comcast contact address.
I'm going to ignore it at this point as a false positive. If I receive any more then perhaps I'll dig deeper.
--
Old dogs can learn new tricks! |
|
 CajunTekInsane CajunPremium,MVM
join:2003-08-08
Arlington, TX
·RoadRunner Cable
| said by ctgreybeard:said by NetFixer:Did you get the popup or injected "Your computer may be infected" message when using a web browser, or only the email?
I received just the email and the headers show that it came directly from Comcast. Google received the email from qmta02-mdp.westchester.pa.bo.comcast.net. [76.96.68.102] and I also received a duplicate email through my alternate Comcast contact address. I'm going to ignore it at this point as a false positive. If I receive any more then perhaps I'll dig deeper. I am not sure I would ignore it. What they are telling you is that bot like things are happening on your IP. It may not be a virus but someone may be connecting to your network who is infected. So the other question here is... Is your network secure?
--
da Cajun Darn I hate Malware |
|
 jlivingoodPremium,VIP
join:2007-10-28
Philadelphia, PA
kudos:1 | reply to NetFixer
said by NetFixer:As for Comcast providing you any detailed information, that is highly unlikely. Really? You willing to take bets on that? 
--
JL
Comcast |
|
NetFixerFreedom is NOT freePremium
join:2004-06-24
The 'Boro Reviews:
·Vonage
·Cingular Wireless
·Comcast
·AT&T Southeast
1 edit | said by jlivingood:said by NetFixer:As for Comcast providing you any detailed information, that is highly unlikely. Really? You willing to take bets on that? It would be nice if Comcast did actually respond with details, but that has not been my experience with other ISP abuse teams regarding their automated (false) detection of traffic from my »portscan.dcs-net.net site as proof of malware activity.
I suspect that the only reason that I have not had a problem with Comcast in that regard is because since Comcast blocks some of the ports being tested (even though I have a business class static IP account, and such blocking is extremely rare for business class service), I have had to use an external hosting service for the actual port scanning, so that traffic does not directly appear on my business class connection.
--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower |
|
