Security and Anti-Virus

[Dozer58]

I received a call today and an email stating one or all computers may be infected with a bot virus and to go to xfinity/bothelp. I first called Comcast to see if this was legit and they couldn't tell me but suggested that I download CG. I ended up calling the number listed for CG, after it was installed, and after talking to 3 different people who gave me different numbers to call, the last person ended up giving me the original number I had called and told me I had to download Norton. I've used Norton in the past and it messed up my computer so bad I had to get a different one. One person told me if I had CG, I had Norton, another said I had to download Norton to get the protection. After talking to at least 3 more people, I was sent to Norton to download their software. One of the people I spoke with said in the past 10 minutes she had received 6 calls and didn't know what was going on but thought it must be a marketing ploy between Comcast and Norton. I can't tell you how angry I am that Comcast is using mass callings and emails to generate fear. I feel like I've been manipulated, deceived, and worst of all lied to and I wasted at least 2 hours of my time to get some help that I didn't even need. After the scan, there were NO viruses. I did call Comcast back, asked to talk to someone in authority and he was the only one who said he read his email this AM stating they would be making these mass callings. Comcast should at least let their employees know what is going on so they can assist the customers instead of getting the runaround. And it would be great if they quit misleading, lying and deceiving their customers and might I add overcharging. If I had a choice, I would not be with Comcast.  

[USAF_E-8_RET]

Hi Dozer58,

First of all, welcome to the Forums.  Secondly, I am not a Comcast employee (they have RED USER NAMES).  I am a customer just like you are ( as are most folks who post here).  You will see some of us are dubbed Experts - that means we spend a considerable amount of our time volunteering to assist other customers.  Many of us customers who post have "been there and done that".  We have faced the same frustrations you and others have with getting the "run around" and either not getting an answer or getting false information.

The Constant Guard Protective Suite download does include an option to download Norton Security Suite.  However CGPS has been causing various problems on folks' systems over the past 5 months or so.  There is a link for a stand alone download of Norton Security Suite here:  http://xfinity.comcast.net/constantguard/Products/CGPS/norton/  Of course you have to click the "NoThanks" on the CGPS offering in order to see the "Get It Now" button which will start the Norton download.

Please in the future, feel free to post on this forum and let the other customers who know what is happening assist you, before calling Comcst/Norton support.

[Dozer58]

Dear USAF_E-8_Ret,

Thank you for your information regarding the bot and downloading all the info I did. This is the first time I've used this forum (I actually didn't about it before) and next time will go to you or others for help. Thank you so much for responding.

By the way, I love the quote at the bottom of your page. I assume from your user name that you were in the service. It is my privilege and honor to thank you for your service to me, my family and our country. My dad is a WWII vet and we have a very special place in our heart for military men and women and our special veterans.

God Bless you,

Dozer58

[yrk314]

Dozer58, thanks for sharing your experience/

I also got a similar phone message from Comcast/Xfinity. The message sounded very suspicios to me (how did they know if one of my my computers got infected?  why did not they provide more specific info and/or callback number?).

My phone caller ID indeed showed 800-comcast number. My call to Comcast produced the same result - after being refered/redirected to other departments I was asked to dial 800-COMCAST (again?!) and was disconnected. The site they referred to at the phone message did not have any relevant information except offers to buy some software.

Looks like a marketing ploy from comcast. I happen to know a few real security experts and I will check the situation further with them. If I prove my computers are clean, I will cancel my comcast subscription immediately.

[cc_adame]

Dozer58,

I'm sorry to hear you had a poor experiance. No single AV will detect everything. I would recommend trying a couple more just to be sure you're not infected. I assure you it wasn't a marketing ploy - we did see traffic that resembled bot activity from your modem.

You can find more information about this program on this thread: http://forums.comcast.com/t5/Security-and-Anti-Virus/Comcast-Announces-Constant-Guard-security-progr...

Please let us know if you have any further questions.

-Adam

[USAF_E-8_RET]

@ Adam,

You link produces an "Unexpected error" page to display!

[ComcastKeisha]

Dozer58 and yrk314
Sorry about the issues that you have experienced. We do have a security team that monitors various aspects of our customers internet service from spam,abuse,bandwidth etc. I have created a repair ticket on both your accounts to have someone from this group reach out to you to inform you of what's going on with your account and more details about the calls you received to resolving your issues. Someone will be in contact with you soon. 

[BruceW]

---

cc_adame wrote: ... No single AV will detect everything. I would recommend trying a couple more just to be sure you're not infected. ...

---

"A couple more" is a little vague. Couldn't Comcast at least give the names of some malware scanners that it thinks might work? Maybe with links to them? And if the customer decides to go with the paid Signature Support option, why not offer to waive the fee if SS doesn't find an bot-level infection?

Oh, and could you fix your broken link so it points to http://forums.comcast.com/t5/Security-and-Anti-Virus/Comcast-Announces-Constant-Guard-security-progr... ?

[LoPhatPhuud]

Rather than installing a different antivirus which would require removal of the current product, try software more designed for malware, bot, and rootkit detection and removal. These programs can be installed in addition to, not in place of, your current antivirus program.

Two I use for malware removal that are highly effective and are free for use, or free for trial:

MalwareBytes: http://www.malwarebytes.org/

Sophos Anti-Rootkit: http://www.sophos.com/en-us/products/free-tools/sophos-anti-rootkit.aspx

Other Rootkit removal programs can be found here: http://www.dslreports.com/faq/16564

[yrk314]

I've scanned my computers with Microsoft Malicious Software Removal Tool and with half a dozen other respectable tools and did not find any infections. My Windows and McAfee professional are up-to-date. I have firewall on my computers and on my router. I never open email attachments that could possibly be infected. I did not use Comcast email (until yesterday, just to check if there was anything related to this bot warning). I do not visit suspicious websites and I use sandbox for most of my web browsing anyway.

Of course, all this does not guarantee my computers are not infected, but the chances are very low. So, unless Comcast shows any evidence that my computers are infected, I adhere to the opinion that it is just a marketing ploy.

[Wiliam2011]

For those of you who have received these phone calls and emails, ignore them.

I also received the same email and phone call. Comcast you should be ashamed of yourself. First of all, you have no business monitoring my activity. And second, I did a full scan using AdAware and SpyBot and no bots were discovered. I use you for internet access ONLY. You have never been invited to monitor my system nor will you ever be. This ploy you are using to try and sell Anti-Virus programs is shameful. We have been fighting this kind of scam for years with low lifes peddling anti-virus programs to remove bots that they used to infect, but for you to use this similar type of scam tactic is wrong.

[USAF_E-8_RET]

---

Wiliam2011 wrote:

For those of you who have received these phone calls and emails, ignore them.

IMHO (and a lot others), please do not ignore the phone calls and emails.  In fact William2011 is telling you to ignore them, when they in fact did not - evidenced by their admission that they ran AdAware & SpyBot.

I also received the same email and phone call. Comcast you should be ashamed of yourself. First of all, you have no business monitoring my activity. And second, I did a full scan using AdAware and SpyBot and no bots were discovered. I use you for internet access ONLY. You have never been invited to monitor my system nor will you ever be.

A couple of quotes if I may:

from LPP (security Expert)

"Comcast is not accessing your computer. They scan certain traffic from the modems looking for patterns indicative of a bot. In no way are they accessing any computer on your network."

From ComcastJordan (Comcast employee)

"Rest assured that Comcast is, in no way, accessing your computer.  The notifications are simply added to the HTML that your browser retrieves."

This ploy you are using to try and sell Anti-Virus programs is shameful.  We have been fighting this kind of scam for years with low lifes peddling anti-virus programs to remove bots that they used to infect, but for you to use this similar type of scam tactic is wrong.

---

May I ask what (which) Anti-Virus program Comcast is trying to sell?  I'll agree that Comcast has been accused of trying to selling their repair service, but all the programs listed under the DIY instructions are in fact free to the customers.

[EG]

---

Wiliam2011 wrote:

For those of you who have received these phone calls and emails, ignore them.

---

That would be silly...

[mle_ii]

I've just recently started getting calls as well.  Decided to check my comcast email which I never use and they've been sending me email about this for a few months or so.

So even though I'm behind a firewall (both software and hardware), have my OS, anti-virus/malware/etc scanner up to date, don't open attachments unless I know what they are, don't download and run software I don't trust, etc, etc.  I decided to do a full scan with various versions of tools and found no bots what so ever.  I even watched the network activity of my computer using various tools and saw nothing out of the ordinary.

Something has got to be wrong with the detection software as there seems to be a false positive or else all the tools I ran are lying to me or wrong as well.

I'd like to know what was detected so I can look for what the problem may be.  I've been in the software development industry for almost 20 years now so I have some very good experience with how computer hardware and software work along with some security understanding.

Please provide more information on what was found Comcast.

Thanks,

Mike

[kh1116]

---

USAF_E-8_RET wrote:

May I ask what (which) Anti-Virus program Comcast is trying to sell?  I'll agree that Comcast has been accused of trying to selling their repair service, but all the programs listed under the DIY instructions are in fact free to the customers.

---

How about "Xfininty Signature Support"? 

https://signaturesupport.xfinity.com/cg-bot-removal?__utma=117809878.1636963483.1318553645.131855364...

I run linux on all of my computers at home and have recieved this email and phone call 2-3 times already. There is no sign of any foul play as far as I can tell. The wireless network is secured with WPA2-PSK.

[gene94574]

I hope this isn't too far off topic, but I only found this forum because I was trying to clear up whether xfinity.com was a legitimate site. I received one of the emails being discussed, telling me to click on a lick to xfinity.com. Sorry, but I thought everything from Comcast would link to Comcast. I've been taught that the way to pick up a virus is to click on a link that you're not sure of, so I tried to make sure who it was. Whois told me that xfinity.com was stored on Comcast servers, but that wasn't good enough for me. I went to comcast.com and did a search for xfinity.com. The Comcast site had no idea what I was looking for. Somehow I finally landed on this forum, so I guess the email was really from Comcast, but it sure seems like poor planning to me.

[USAF_E-8_RET]

---

kh1116 wrote:

---

USAF_E-8_RET wrote:

May I ask what (which) Anti-Virus program Comcast is trying to sell?  I'll agree that Comcast has been accused of trying to selling their repair service, but all the programs listed under the DIY instructions are in fact free to the customers.

---

How about "Xfininty Signature Support"? 

https://signaturesupport.xfinity.com/cg-bot-removal?__utma=117809878.1636963483.1318553645.131855364...

I run linux on all of my computers at home and have recieved this email and phone call 2-3 times already. There is no sign of any foul play as far as I can tell. The wireless network is secured with WPA2-PSK.

---

Xfinity Signature Support is not an Anti-virus program - it is in fact a "repair service", as explained on the link your provided:

• Scan and remove bots, viruses and other threats
• Evaluate and update current security software
• Repair security software or firewall damaged by bots
• Perform and schedule system updates
• Improve computer performance with PC tune-up

It does not say anything about protecting your system from infections- as an Anti-virus program would do.
It is talking about removing such after the AV program ( or some other source) has found it. 

[mle_ii]

I agree it is silly to ignore the messages.  Problem is that until the process of how Comcast is handling this is fixed folks are going to lose faith in the process and then ignore it. 

[BruceW]

---

gene94574 wrote: ... I guess the email was really from Comcast, but it sure seems like poor planning to me.

---

You are wise to be cautious, and yes, the bot notification system is poorly designed. Forum advice for responding to bot emails is here: http://forums.comcast.com/t5/Security-and-Anti-Virus/What-do-I-do-if-I-receive-a-BOT-notification/m-...

[joeman11]

I too just received this email, actually several of them. Can I request a repair ticket on my account too?

[splibb]

This is to be ignored, I did install it but I knew deep down I should not have. I have 2 very good virus programs. As near as I can tell "Constant Guard™ Alert" is nothing more than a terrible marketing ploy. You will now get pop ups and all sorts of "offers", at a cost of course. I wish I could undo it now. I was fine before and now my PC is slow. I hope that is just a temporary thing. Will let you know later.

[GL99]

I received this email.  Was it real or a spam email?

From: Comcast Customer Central [mailtonline.communications@alerts.comcast.net]
Sent: Wednesday, May 30, 2012 4:15 AM
Subject: Constant Guard Alert

Constant Guard™ Alert
Dear XFINITY Customer,
Constant Guard from XFINITY identified one   or more of your computers may be infected with a bot. A bot is a malicious   form of software that is used to send spam, host a phishing site, or steal   your identity by monitoring your keystrokes without your knowledge. It may be   possible you are unaware that your computer is infected with a bot.
We strongly recommend that you visit XFINITY.com/BotAssistance for important information on how to remove   malicious software from your computer(s).
We appreciate your prompt attention to this   important security notice.
Sincerely,
Constant Guard from XFINITY
This is a service-related email. Comcast   will occasionally send you service-related emails to inform you of service   upgrades or new benefits to your Comcast High-Speed Internet service.     Copyright 2012. Comcast. All other trademarks are properties of their   respective owners.     Comcast respects your privacy. For a complete description of our privacy   policy, click here.     Comcast   One Comcast Center, 10th Floor   1701 JFK Boulevard   Philadelphia, PA 19103-2838

[LoPhatPhuud]

It's  real.

Go here for additional information on the detects:  Am I Botted?

You can check to see if DNS Changer is also involved here: Check for DNS Changer bot

[ffwfire]

You should only have one antivirus program and why pay when you can use Norton for free?  You should only have one.  Having two does not make you more secure.  It actually does the opposite.  I know this from reading the web.

I am I think a pretty safe surfer, but from time to time I do click on a link I shouldn't and Norton always catches it.

[splibb]

If Comcast simply "wanted" you to use this new software, then why not just suggest it? Instead they tell you, you have a virus or "BOT". Not a good business practice. I have bragged about Comcasts' support for years and this is the only outright scam I have ever expirenced with them.

Comcast: if you want/need us to use a program, tell us about it and what it will do to help us, do not tell us we are infected and NEED this to survive. For those of you thinking of installing this (providing you have at least Norton up to date) don't.

[BruceW]

---

splibb wrote: If Comcast simply "wanted" you to use this new software, then why not just suggest it? ...

---

What "new software" are you referring to?