Reply
New Visitor
camelotmonarch
Posts: 2
Registered: ‎07-01-2011

False Bot Email Tonight?

Tonight I received the Bot email saying my computer was infected with a bot. So I called Comcast, and then ultimately was sent to the folks over at Norton. About halfway through the conversation, the Nortom person tells me they are now getting hundreds of these notices, and that apparently the Bot email was sent to many people in error.

 

Is this true? If so, can Comcast please send out a follow-up email saying so for our peace of mind?

 

Thanks

Security Expert
USAF_E-8_RET
Posts: 5,137
Registered: ‎10-28-2003

Re: False Bot Email Tonight?

Please see this link to see how to contact the Comcast Customer Security Assurance Department .

 

http://forums.comcast.com/t5/Security-and-Anti-Virus/How-to-contact-the-Comcast-Customer-Security-As...

 

 

 

A veteran - whether active duty, retired, national guard, or reserve - is someone who, at one point in his or her life, wrote a blank check made payable to The 'United States of America', for an amount of 'up to and including my life.'

Official Employee
ComcastJordan
Posts: 788
Registered: ‎03-17-2008

Re: False Bot Email Tonight?

camelotmonarch,

I'm not sure why the person on the phone stated emails were sent in error.  They were not.  All bot notices are sent after the information is verified to the best of our ability.  If you recieved a ConstantGuard bot notification, you'll want to secure any computers in your house.

New Visitor
Posts: 3
Registered: ‎08-29-2008

Re: False Bot Email Tonight?

Does anyone know if this is real or a scam?

 

 

 

Comcast Customer Security Assurance Notice

Dear Comcast Customer,

Your immediate attention is required. Constant Guard™ has identified that one or more of your computers may be infected with a "Bot".

We strongly recommend that you visit the Comcast Constant Guard Center at https://constantguard.comcast.net for important information on how to remove malicious software from your computer(s).

A "Bot" is a malicious software or malware that is used to gain control over your computer, typically without your knowledge. Online criminals can use Bots to collect your personal and private data, such as Social Security numbers, bank account information and credit card numbers by monitoring your keystrokes. This can lead to identity theft and fraud.

We appreciate your prompt attention to this important online security notice.



Sincerely,

Comcast Customer Security Assurance

Security Expert
USAF_E-8_RET
Posts: 5,137
Registered: ‎10-28-2003

Re: False Bot Email Tonight?

It is real!

A veteran - whether active duty, retired, national guard, or reserve - is someone who, at one point in his or her life, wrote a blank check made payable to The 'United States of America', for an amount of 'up to and including my life.'

Bronze Star Contributor
JimC
Posts: 143
Registered: ‎11-02-2005

Re: False Bot Email Tonight?

Until Comcast provides you with logs showing exactly the activity they suspect to be bots, it's not real.

 

You will note that the only options Comcast gives you is to install Norton (software that causes more problems than it ever solves) or use Comcast's for-fee service. That's no way to treat a customer trying to solve a problem you've accused them of having.

Security Expert
USAF_E-8_RET
Posts: 5,137
Registered: ‎10-28-2003

Re: False Bot Email Tonight?


JimC wrote:

Until Comcast provides you with logs showing exactly the activity they suspect to be bots, it's not real.

 

You will note that the only options Comcast gives you is to install Norton (software that causes more problems than it ever solves) or use Comcast's for-fee service. That's no way to treat a customer trying to solve a problem you've accused them of having.


JimC, I disagree with you, the email is legit and that is what the question was - not if you think you or they are infected with a BOT!

 

In addtion to the 4 steps CG provides here: https://constantguard.comcast.net/, which is over and above the "only option" of installing Norton, it has been mentioned in this forum and others have been advised to also scan with the free version of MalwareBytes Anti-Malware program.  http://www.malwarebytes.org/products/malwarebytes_free

 

A veteran - whether active duty, retired, national guard, or reserve - is someone who, at one point in his or her life, wrote a blank check made payable to The 'United States of America', for an amount of 'up to and including my life.'

Bronze Star Contributor
JimC
Posts: 143
Registered: ‎11-02-2005

Re: False Bot Email Tonight?

You should note from your own link that Comcast's official recommendation is to install Norton Security or pay for Xfinity Signature Support. Malwarebytes isn't part of what Comcast itself directs the recipient of the email to. It's nice that other members recommend it, of course. But, again, it isn't part of Comcast's recommendation.

 

Regardless, if Comcast are not willing to share whatever activity they are detecting that leads to sending out the email, then they have only themselves to blame if paying customers treat the email as marketing spam.

 

A legitimate malware/bot warning would include dates and times of the activity for the customer, in order to help them track-down what problem there might be. IF, in fact, there is a problem.

 

I've gotten the email. I run ClamXav monthly. My Mac is clean as a whistle. As far as I'm concerned, that email is marketing spam to get people to install Norton.

Security Expert
USAF_E-8_RET
Posts: 5,137
Registered: ‎10-28-2003

Re: False Bot Email Tonight?


JimC wrote:

You should note from your own link that Comcast's official recommendation is to install Norton Security or pay for Xfinity Signature Support. Malwarebytes isn't part of what Comcast itself directs the recipient of the email to. It's nice that other members recommend it, of course. But, again, it isn't part of Comcast's recommendation.

 

Regardless, if Comcast are not willing to share whatever activity they are detecting that leads to sending out the email, then they have only themselves to blame if paying customers treat the email as marketing spam.

 

A legitimate malware/bot warning would include dates and times of the activity for the customer, in order to help them track-down what problem there might be. IF, in fact, there is a problem.

 

I've gotten the email. I run ClamXav monthly. My Mac is clean as a whistle. As far as I'm concerned, that email is marketing spam to get people to install Norton.


I'm not going to get into a senseless argument over the choices (as it is a 4 step procedure - of which Norton is only one step) vs the Signature Service.  If folks do not want to try the additonal "free" option (MBAM) that is their decision, just as it is yours to ignore the email!

 


 

A veteran - whether active duty, retired, national guard, or reserve - is someone who, at one point in his or her life, wrote a blank check made payable to The 'United States of America', for an amount of 'up to and including my life.'

Contributor
LAJOE
Posts: 13
Registered: ‎08-29-2011

Re: False Bot Email Tonight?

I got two bot notices (real ones) from Comcast even though:

 

  • My new cable modem and router had not been intalled yet and were turned off.
  • My computers were turned off.

I called Constant Guard (the sales people).  Once I explained the situation, they couldn't get me off the phone fast enough.  I chatted with Comcast and they said my computers were fine and could not tell me why I got the bot notice.

 

I strongly suspect this is 100% sales gimmick.

New Visitor
maximc
Posts: 1
Registered: ‎08-31-2011

Re: False Bot Email Tonight?

I got 2 emails from comcast about possible "bot". I would like to have mor technical info.

 I have many computers at home . Which one is infected. May be at least give me the time they detected it so I can see which one was up and runing at that time

Security Expert
USAF_E-8_RET
Posts: 5,137
Registered: ‎10-28-2003

Re: False Bot Email Tonight?


maximc wrote:

I got 2 emails from comcast about possible "bot". I would like to have mor technical info.

 I have many computers at home . Which one is infected. May be at least give me the time they detected it so I can see which one was up and runing at that time


Perhaps using this lik to contact Comcast Customer Security Assistance may provide an answer:

 

http://forums.comcast.com/t5/Security-and-Anti-Virus/How-to-contact-the-Comcast-Customer-Security-As...

A veteran - whether active duty, retired, national guard, or reserve - is someone who, at one point in his or her life, wrote a blank check made payable to The 'United States of America', for an amount of 'up to and including my life.'

Contributor
jb2400
Posts: 21
Registered: ‎05-19-2011

Re: False Bot Email Tonight?

I don't buy it.

 

If Comcast is going to contact a customer about a security issue--Why wouldn't the email start with the person's name? If they really know who I am, then they know my name and account number.

 

Any time you are contacted regarding your account from a service provider, if legit, they provide your name or at least a partial acct. number. No reason to trust this email. Otherwise, it smells like a mass email looking to sell something.

Contributor
LAJOE
Posts: 13
Registered: ‎08-29-2011

Re: False Bot Email Tonight?

I am not buying it either for similar reasons.  But I have added info in that Comcast admitted to me the following via their chat service (CHAT ID: 63e60f81-6741-42d1-bb10-848991a6cb79):

 

"I can see that the email you received is just a system glitch or prank email...I can assure you that there are no viruses on your software or computers."

 

I wonder if this is a money making initiative on Comcast's part, to send a wide range of users the above notice in order to sell their new service to as many customers as possible.  If you "follow the money", they would have little interest in narrowing the emails to those who actually have bots since they that would be more work and they are trying to sell a service to as many people as possible. 

 

Think of the many technically naive customers would sign up without a thought. 

New Visitor
ajawamnet
Posts: 3
Registered: ‎10-24-2011

Re: False Bot Email Tonight?

Get a managed switch

Set up a span port

do a clean install of your OS of Choice

Download Wireshark

Log activity

 

I too have been hit with this marketing ...

 

Here's my lab:

http://home.comcast.net/~ajawamnet/wc/wamcover.htm

Note the patents on security stuff - worked with ex-LOD guys hired by ex-NSA employees.

 

Oh and here's my Xfinity cable connection after the magic gophers from FIOS knocked out most of our neighborhood - http://ajawamnet.home.comcast.net/~ajawamnet/WhyIlikeDongles.html

 

If you really want to stay safe:

 

Use Firefox, install NoScript

Use a text only Email client

Practice Safe Hex.

 

Simple, really...

 

 

 

New Visitor
ajawamnet
Posts: 3
Registered: ‎10-24-2011

Re: False Bot Email Tonight?

And yes they should provide IP's/port numbers and dates/times of suspected connections for any real threat/infection.

New Visitor
ajawamnet
Posts: 3
Registered: ‎10-24-2011

Re: False Bot Email Tonight?

Also:

 

If you have a family and want to really keep things safe:

 

Get a managed switch

set up VLANs - share only the router connection between them

Set up one VLAN with no wireless - use this for critical machines

Set up another VLAN for all other machines/kid's netbooks

Set up a spanning port

get a cheap Atom based PC and set up Wireshark on this machine - lock it down (shut off everything) I suggest some flavor of Linux or if real paranoid OpenBSD

Log all traffic on the span port

 

 

 

Official Employee
jlivingood
Posts: 1,100
Registered: ‎05-09-2007

Re: False Bot Email Tonight?


ajawamnet wrote:

And yes they should provide IP's/port numbers and dates/times of suspected connections for any real threat/infection.


We're working that. 

JL
National Engineering & Technical Operations
Official Employee
jlivingood
Posts: 1,100
Registered: ‎05-09-2007

Re: False Bot Email Tonight?


ajawamnet wrote:

Get a managed switch

Set up a span port

do a clean install of your OS of Choice

Download Wireshark

Log activity

 

I too have been hit with this marketing ...

 

 


At the end of October, I see 3 malware families associated with your IP. Check your PMs in a few minutes.

 

 

JL
National Engineering & Technical Operations
New Visitor
dzurn
Posts: 1
Registered: ‎06-18-2010

Re: False Bot Email Tonight?

I got the bot notice as well, but there's only Macs at my house. Plus iPhones and iPod Touches.

 

I'm supposed to download "Norton Security Suite for Mac OS", but I'm running OS X Lion, and it's not compatible with this.

 

I guess I'll try to run it (once!) on the non-Lion Macs.

New Visitor
camelotmonarch
Posts: 2
Registered: ‎07-01-2011

Re: False Bot Email Tonight?

One of the added precautions I took was to really lock down my network. Not only do I require a password, but also restricted access to only those computers and devices whose machine addresses I approved. Even iPhones and iPod Touches have machine addresses.

 

So since you only have Macs, it's entirely possible that someone is piggy-backing off your wireless router, and it is their computer that is having the problem.

 

 

Security Expert
LoPhatPhuud
Posts: 2,829
Registered: ‎11-01-2005

Re: False Bot Email Tonight?


dzurn wrote:

I got the bot notice as well, but there's only Macs at my house. Plus iPhones and iPod Touches.

 

I'm supposed to download "Norton Security Suite for Mac OS", but I'm running OS X Lion, and it's not compatible with this.

 

I guess I'll try to run it (once!) on the non-Lion Macs.


You are under no obligation to install Norton. Scan all computers with whatever anti-virus/anti-malware programs you have installed. I would also suggest scanning each computer with a program specifically designed to detect/remove bots (if one is available for the Mac).

 

The bot notice was sent after bot like activity was detected coming from your cable modem.

 

For more information:

Comcast Customer Security Assurance team

1-888-565-4329
M-F, 9:00 am – 11:30 pm EST
S-S, 10:30 am – 6:30 pm EST




"Once I talked to the inmates of an insane asylum in Hartford. I have talked to idiots a thousand times, but only once to the insane..."
Mark Twain

Microsoft MVP, Consumer Security, 2005-2014
Visitor
cdwhatcott
Posts: 1
Registered: ‎01-27-2012

Re: False Bot Email Tonight?

I received the bot notice this morning. I'm wondering if there's a way for me to be given details about what triggered this notice so I can figure out which machine possibly caused it?

Security Expert
USAF_E-8_RET
Posts: 5,137
Registered: ‎10-28-2003

Re: False Bot Email Tonight?


cdwhatcott wrote:

I received the bot notice this morning. I'm wondering if there's a way for me to be given details about what triggered this notice so I can figure out which machine possibly caused it?


As LPP suggested in his poist above yours:

 

For more information:

Comcast Customer Security Assurance team

1-888-565-4329
M-F, 9:00 am – 11:30 pm EST
S-S, 10:30 am – 6:30 pm EST

A veteran - whether active duty, retired, national guard, or reserve - is someone who, at one point in his or her life, wrote a blank check made payable to The 'United States of America', for an amount of 'up to and including my life.'

Visitor
Posts: 2
Registered: ‎10-09-2008

Re: False Bot Email Tonight?

[ Edited ]

I just got this "you may have a bot" e-mail last night. Ran anti-virus searches on my PC's - all clean.  The computer attached to my router is a Mac. Not infected.  Called Comcast last nite - their internet security department was closed.  I have a 25 character random WPA-2 password.

 

But here's the thing.  If you REALLY think I have a bot, then do something more than send me a link to Norton or some other third party service.  Because if Comcast thinks I'm gonna install Norton AV on a Mac, then they live in fantasyland.   Norton has already loused up 2 PC's I've had in the last 15 years. There is zero chance I am putting it on a Mac.  

 

If Comcast suspects I have a malicious bot, call me.  Give me times, dates and addresses. Shut off my service if you have to. But a generic "you may have a problem - find out for sure by downloading this software that includes Norton AV for Macs!" to me is nothing more than a sales gimmick.

 

I already pay $45 a month to Comcast for internetI. They have smart people working for them. If they have evidence that my sysyem has been hijacked, then send ME the evidence. Not a link to Norton AV.

Security Expert
USAF_E-8_RET
Posts: 5,137
Registered: ‎10-28-2003

Re: False Bot Email Tonight?

@ ColoAtty,

 

I understand your frustration and have come to learn that all MAC users think they are not vulnerable. Thatis all good and well, however, Comcast will not call you - unless you stat the ball by rolling and contact the Security Folks at Comcst.  In the past they have been asble to at least provide you with the frequency and the date (not sure about the time) of the occurence.  So please give them a call for more info.

 

As a fellow customer, there is nothing I can do in regards to BOT other than pas onguidance as to who to contact for more info:

Please refer customers with concerns about infections etc. related to Constant Guard to the below URL.

 

 

 

http://security.comcast.net/get-help/contact-comca st-security.aspx

 

 

 

Specifically,

 

 

 

How to contact the Comcast Customer Security Assurance Department:

 

The Customer Security Assurance organization has been established to ensure a safe and secure online experience for Comcast customers. This team is a dedicated group of security professionals who respond to issues pertaining to phishing, spam, infected PCs (commonly referred to as "bots"), online fraud and other security issues.

 

Normal business hours (M-F, 9:00 am to 11:30 pm EST
S-S, 10:30 am to 6:30 pm EST)

1 -888-565-4329

A veteran - whether active duty, retired, national guard, or reserve - is someone who, at one point in his or her life, wrote a blank check made payable to The 'United States of America', for an amount of 'up to and including my life.'

New Visitor
Erin_CSA
Posts: 1
Registered: ‎01-31-2012

Re: False Bot Email Tonight?

[ Edited ]

Constant Guard from XFINITY identified that one or more of your computers may be infected with a bot. --

 

 

Looks like another marketing move...

I ran complete/ full scans with my Kaspersky Internet Suite and Windows MSRT - nothing found. Are we saying that Northon is better? Should I uninstall my anti-virus to install that thing? I'm sorry, this is BS>

Security Expert
USAF_E-8_RET
Posts: 5,137
Registered: ‎10-28-2003

Re: False Bot Email Tonight?


Erin_CSA wrote:

Constant Guard from XFINITY identified that one or more of your computers may be infected with a bot. --

 

 

Looks like another marketing move...

I ran complete/ full scans with my Kaspersky Internet Suite and Windows MSRT - nothing found. Are we saying that Northon is better? Should I uninstall my anti-virus to install that thing? I'm sorry, this is BS>


 

No one is suggesting you get rid of your Kaspersky for Norton.  My only suggestion for you would be to try MalwareBytesAnti-Malware (Free version) available here as a second opinion on-demand scanner.

 

http://www.malwarebytes.org/products/malwarebytes_free

 

A veteran - whether active duty, retired, national guard, or reserve - is someone who, at one point in his or her life, wrote a blank check made payable to The 'United States of America', for an amount of 'up to and including my life.'