Comcast Notice: Infected with a Bot

[endoftheline2]

I've been checking our Comcast Bandwidth usage because I know we are close to their 250GB Cap, and this month we were close at 230GB/250GB. So I actually checked the comcast account email to see if they were complaining about us using too much bandwidth only to find these messages saying you may be infected with a bot.

The messages say this:

>>>
Comcast Customer Security Assurance Notice

Dear Comcast Customer,
Your immediate attention is required. Constant Guard™ has identified that one or more of your computers may be infected with a "Bot".
We strongly recommend that you visit the Comcast Constant Guard Center at https://constantguard.comcast.net for important information on how to remove malicious software from your computer(s).
A "Bot" is a malicious software or malware that is used to gain control over your computer, typically without your knowledge. Online criminals can use Bots to collect your personal and private data, such as Social Security numbers, bank account information and credit card numbers by monitoring your keystrokes. This can lead to identity theft and fraud.
We appreciate your prompt attention to this important online security notice.

Sincerely,

Comcast Customer Security Assurance
<<<



They are really from comcast, but they don't say anything specific, however they do offer a security service to help you with the bots they say you have for $129. I'm just trying to determine if these actually mean anything or if they are more of a marketing tactic by Comcast to get more money.

It seems they started sending us to these message a few weeks ago, when we started to use more bandwidth, so I'm also wondering if they just assume that anyone that uses more bandwidth than the typical Comcast Customer (Say >50GB or >100GB a month), is likely to have a bot actually using that bandwidth, so they just send out the messages.

Anyone have any ideas on these?

 

[Schroff87]

They're probably just assuming and fishing for extra money. You just said that you started using more bandwidth so it's fine. You can keep a bandwidth meter installed on your pc just to keep a pulse on usage realtime. For peace of mind run a scan with your favoured anti-virus & malware software.

 

[A Guy]

It's a legit email:

Comcast.net Security

But they don't give any info on what triggers the alert. The forum posts are usually replied to by a Comcast employee asking to PM them and they will provide more info. However, their offering you some "security service' for a high fee makes me very leery. Sounds like any "unusual" behavior, like high bandwidth usage, probably triggers this email.

A Guy

 

[Borg 386]

If you want to double check (and it never hurts to), d/l this free tool & have a look at your internet connects. Also, a good tool to have in case there's a suspected infection.

TCPView for Windows

TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections. On Windows Server 2008, Vista, and XP, TCPView also reports the name of the process that owns the endpoint. TCPView provides a more informative and conveniently presented subset of the Netstat program that ships with Windows. The TCPView download includes Tcpvcon, a command-line version with the same functionality.