Welcome to the MacNN Forums.

Thorzdad · Jul 15, 2011, 08:36 AM

Is anyone else getting these emails from Comcast Security warning that they have supposedly detected bot activity on your computer?

I got one several months ago and just blew it off, after discovering a lot of other customers got the same email. I got another one this morning. All they ever say is that they've detected bot activity and that I should take action immediately!!! by clicking a provided link. That link takes you to...a page where you can download Norton for Mac.

Of course, they don't provide any specifics about when the activity supposedly happened, or logs to back-up their accusation. Just "Take our word and install Norton." Of course, there's no way I'm ever allowing Norton onto my Mac.

Just wondering if anyone else has been getting these emails from Comcast?

Waragainstsleep · Jul 15, 2011, 09:03 AM

Sounds like spam to me.

turtle777 · Jul 15, 2011, 09:08 AM

I didn't get any. But maybe my spam filter ate the emails

-t

-Q- · Jul 15, 2011, 09:14 AM

Never received them myself, but I also don't think I've ever checked my comcast-provided email and don't think they have any other address for me. Certainly sounds like a spam message.

ChrisF · Jul 15, 2011, 09:20 AM

It's not spam, but it also doesn't sound like Comcast's system is working properly (no real surprise there.)
https://constantguard.comcast.net/

-Q- · Jul 15, 2011, 09:25 AM

Oh, it most certainly meets my definition of spam.

Thorzdad · Jul 15, 2011, 09:30 AM

Well...It may not be textbook spam, but it certainly smells like it.
For one, as I said, they provide zero information about the supposed bot activity. Then, your only recourse is to either install and run Norton, or have Comcast's "Signature Support" run a for-fee sweep of your system.

My only fear is that they'll take some action against me down the line, if their system is somehow mis-identifying bot activity coming from my account. Like, suspend my account.

It's very frustrating that they refuse to provide any details. This lack of data leads me to dismiss the emails as corporate spam. FWIW, I have ClamXav installed and it monitors downloads and email. Everything's clean.

Waragainstsleep · Jul 15, 2011, 10:05 AM

Perhaps the word should be scam instead of spam.

mduell · Jul 15, 2011, 12:11 PM

Sounds like phishing.

Thorzdad · Jul 15, 2011, 12:14 PM

Originally Posted by mduell

Sounds like phishing.

Except the email IS a legitimate Comcast email. Their forums have a lot of posts from customers expressing confusion over getting them.

Tee · Jul 16, 2011, 01:29 PM

Or, maybe your system is in-fact infected with malware...

Thorzdad · Jul 16, 2011, 01:36 PM

Um. No.
I run ClamXav monthly. The system is clean.

besson3c · Jul 16, 2011, 03:16 PM

Originally Posted by Thorzdad

Except the email IS a legitimate Comcast email. Their forums have a lot of posts from customers expressing confusion over getting them.

According to the from headers or envelope headers?

Thorzdad · Jul 16, 2011, 03:42 PM

Originally Posted by besson3c

According to the from headers or envelope headers?

No.
According to Comcast themselves. They confirm that they have been sending out the emails. What they won't do, however, is share any information with you to help you track-down what activity they have detected that leads them to say you have a bot running. They only say to install and run Norton, or buy their remote service. Like I said, it's very frustrating.

besson3c · Jul 16, 2011, 04:13 PM

Originally Posted by Thorzdad

No.
According to Comcast themselves. They confirm that they have been sending out the emails. What they won't do, however, is share any information with you to help you track-down what activity they have detected that leads them to say you have a bot running. They only say to install and run Norton, or buy their remote service. Like I said, it's very frustrating.

That would piss me off. They won't even supply you the MAC address of your router so that you can tell whether it was you or the last guy/girl with your IP doing these alleged activities?

Waragainstsleep · Jul 16, 2011, 04:34 PM

It means they are taking a cut from Norton and basically just lying to you. There is no bot, its shameful profiteering.

Cold Warrior · Jul 16, 2011, 04:38 PM

Originally Posted by besson3c

That would piss me off. They won't even supply you the MAC address of your router so that you can tell whether it was you or the last guy/girl with your IP doing these alleged activities?

They'd only see the cable modem's MAC anyway, assuming there's a router between modem and LAN clients. MAC addresses don't go above the physical and data links.

Thorzdad · Jul 16, 2011, 04:40 PM

Originally Posted by besson3c

That would piss me off. They won't even supply you the MAC address of your router so that you can tell whether it was you or the last guy/girl with your IP doing these alleged activities?

Nope. All you ever get is an email saying they've detected bot activity, and link to their site where you can download Norton.

Originally Posted by Waragainstsleep

It means they are taking a cut from Norton and basically just lying to you. There is no bot, its shameful profiteering.

Well, that's sort of the feeling I get from it. But, if you go into their customer forums and read the threads, they're full of admonitions that the email warnings are legit. Some from Comcast mods, others from supposed "experts".

Cold Warrior · Jul 16, 2011, 04:45 PM

You could check the email headers, look for the originating IP. If legit, they're likely to come from a Comcast IP range.

Waragainstsleep · Jul 16, 2011, 07:28 PM

Forum threads are as easy to fake as emails.

Cold Warrior · Jul 16, 2011, 07:54 PM

Email from and server names, very easy, but IP addresses in the headers, fairly difficult.

besson3c · Jul 16, 2011, 08:01 PM

Originally Posted by Cold Warrior

They'd only see the cable modem's MAC anyway, assuming there's a router between modem and LAN clients. MAC addresses don't go above the physical and data links.

I know, but it would still be your unique signature to at least relate their problems to your household.

besson3c · Jul 16, 2011, 08:01 PM

Originally Posted by Cold Warrior

Email from and server names, very easy, but IP addresses in the headers, fairly difficult.

That's what I meant by envelope address, earlier in this thread

Thorzdad · Jul 16, 2011, 08:23 PM

Originally Posted by Waragainstsleep

Forum threads are as easy to fake as emails.

You have to be a Comcast customer to post to their forums. Actual Comcast employees post there as moderators and tech help.

Waragainstsleep · Jul 16, 2011, 08:40 PM

I'm sure Comcast could post fake threads from fake users to their own forums if they wanted to without anyone else being able to easily tell.

Tee · Jul 16, 2011, 09:12 PM

If it is an outright scam by Comcast in order to get people to purchase Norton, then it is not very well thought out.

What if they sent the notice to someone that already runs Norton??
Are they watching the connections to see who runs the Norton auto-updater and then filtering out those users from their spam emails?

Back in the earlier days of ClamXav the FAQ had a specific note that it was only for detecting *viruses* (sp?) and not designed to catch trojans or other types of malware. That doesn't seem to be in the FAQ anymore, but I never felt that it was worth using because of that. Perhaps it has become more comprehensive.

turtle777 · Jul 16, 2011, 10:47 PM

Excuse my ignorance, but are there even any known bot malware viruses/Trojans for OSX?

Not to my knowledge.

-t

4coughs · Aug 25, 2012, 08:09 AM

I believe this 'so called Bot' sent by Comcast or Xfinity to make you buy their anti-bot or anti-virus software. Apart from being extremely annoying it is surely illegal. We should all start a class action or boycott Comcast altogether.

mduell · Aug 25, 2012, 12:36 PM

Ask politely but firmly of some evidence to support their allegations.

4coughs · Aug 26, 2012, 12:09 PM

I don't get any email notification, presumably because I use hotmail. What I get instead is a semi-transparent box, maybe a third of the screen, that comes at the top of my browser page every time I log in. It has XFINITY on the top, informs me that I have a BOT and should use CONSTANT GUARD to remove it. I have deep formatted my drive, re-run windows and only used the internet explorer that ships with XP. I have left the modem off for half an hour completely disconnected and yet the first time I use the browser I get this thing (virus, bot, whatever) appearing. When I phone Comcast they transfer me to the Xfinity number who offer to fix the problem for $120. For something that they have put on there in the first place. We should boycott Comcast or start a class action. This must be illegal. I am changing to DSL tomorrow.

besson3c · Aug 26, 2012, 12:17 PM

Originally Posted by 4coughs

I don't get any email notification, presumably because I use hotmail. What I get instead is a semi-transparent box, maybe a third of the screen, that comes at the top of my browser page every time I log in. It has XFINITY on the top, informs me that I have a BOT and should use CONSTANT GUARD to remove it. I have deep formatted my drive, re-run windows and only used the internet explorer that ships with XP. I have left the modem off for half an hour completely disconnected and yet the first time I use the browser I get this thing (virus, bot, whatever) appearing. When I phone Comcast they transfer me to the Xfinity number who offer to fix the problem for $120. For something that they have put on there in the first place. We should boycott Comcast or start a class action. This must be illegal. I am changing to DSL tomorrow.

It sounds shady, but if you are concerned about your security I would recommend you using Firefox or Chrome, which are both better browsers than IE 8 anyway.

Thorzdad · Aug 26, 2012, 03:05 PM

4coughs...Switch your DNS settings to a non-Comcast set of servers and those in-browser Xfinity warnings will probably go away.
Those "warnings" Comcast throws at you are marketing ploys for their ConstantGuard service. If you go through the Comcast user forums, you'll find that no one has ever gotten a legitimate warning from them. It's all marketing bs.

4coughs · Aug 27, 2012, 08:18 AM

Thorzdad, Thanks for the reply. Would you mind telling me how to do that.

Thorzdad · Aug 29, 2012, 06:04 AM

Before you do anything, I suggest you read through this thread at the Comcast user forums. It sounds like you are not alone in seeing this popup. It also sounds like this may be another of Comcast's scammy attempts at upselling customers for a paid security scan.

PC Lady · Sep 4, 2012, 05:29 PM

I spent 8 hours trying to find a bot for a customer who has Comcast. I found nothing, which leads me to believe that nothing is wrong. If only Comcast paid professionals can fix this problem then I would suggest wiping your hard drive and shopping for a new internet provider.