Security and Anti-Virus

[swp8]

I just got an email from Comcast saying my PC may be infected with a bot.  I've already run an AV scan, and urrently running Microsoft's Malicious Software Removal Tool.  I honestly don't believe I've been infected.  I'm pretty careful about that stuff.

One thing that comes to mind is perhaps Comcast thinks my VPN activity is suspicious?  I use OpenVPN in a UDP configuration.  Could Constant Guard be throwing a fit about that?

It'll be at least another 4 hours MSRT to finish scanning.

Edit:  I just looked at the time stamp on the email from comast.  It was sent at 2:15 AM.  Are those alerts sent as soon as somethnig is detected?  Or is it delayed a bit?  All my PCs were powered off at 2:15 AM.

[trogers474]

the constant guard is probably conflicting with your virtual private network.  I got rid of constant guard and everything works fine.  tr

[swp8]

Oh no no, I don't have any Comcast software on my PC.  This was an email comcast sent me out of the blue.

I used my VPN again today, so we'll see if I get another email.

When I visit [ https://amibotted.comcast.net/ ], it says I'm in the clear.

[LoPhatPhuud]

Check here as well:

http://dns-ok.us/

If you use a router for wireless connections,make sure it is properly secured.

[trogers474]

Make sure your router supports 802:11N, the newsest type of router.  Also, WEP is an outdated type of wireless security.  Use WPA-PSK preferrably to keep people from snooping around on your network.  You can also choose not to dislplay your SSID, but you'll have to manually enter your network info on each attached device.  However, you will be invisible wirelessly.  Get into your router settings to do these things.

TR

[user888]

So apparently I can't log in as swp8.  Comcast banned me for some reason.

Anyways, I got another email from Constant Guard telling me I may be infected.  It just so happened that I was using a VPN last night.  I'm pretty sure Comcast's monitoring system is getting false positives from my VPN service.

Is comcast going to terminate my service if I keep getting those emails and ignore them?

It'll be interesting to see if this username gets banned too.

[cc_adame]

user888,

Have you looked at https://amibotted.comcast.net to see what we're seeing?

We wont terminate you for this, we're just letting you know that something behind your modem is infected.

[user888]

Yep, I've been checking amibotted many times since the first email, and any time I got an email alerting me that I may be infected.  Everytime I check, it tells me I'm in the clear.

I'm prety sure my VPN is producing a false positive.

[cc_adame]

user888,

When was the last time you got a notice? I'm not seeing any bad traffic since the 5th.

[user888]

I've gotten those Constant Guard Alert emails on 5/17/2012 2:15 AM and 5/25/2012 8:07 AM.

[user888]

Just got a new Constant Guard Alert email on 6/2/2012 11:05 PM.  I am absolutely sure those emails are false positives from my VPN service.  If what you said regarding my service not being terminiated is true, I'll just ignore these in the future.

[H_S]

I have also received two of these alerts. One thing that occured to me is that I don't use Comcast's DNS servers. I would think this is likely why they are detecting a potention bot infection as this is a common symptom of infection. 

[old_bigun]

I got a couple of those emails awhile back and I too thought it was a mistake but after the second one I did a complete scan rather than the quick scan. It found a rootkit trogan but was unable to remove it. I found a rootkit killer on the internet and it removed it with no problem. That stopped the emails. You might want to do a full scan if you haven't already

[old_bigun]

Well royperry, I'm by no means a comcast cheerleader but last I looked it's an optional program. You assume you have no malware on your computer but are you sure?

[BigDaddy011]

Hello all.  I too am getting these constant guard messages about being infected with a bot.  I just completely rebuilt my computer with brand new SSD drives not even 2 weeks ago and I got another alert from them yesterday.  I am not using a VPN application that often but I do use Carbonite online backup and I was wondering if that could be causing the alerts? 

Do any of you other folks who are routinely getting these bot alerts also use Carbonite or some other automatic online backup solution like Mozy?