Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 5

6,407 points

Heuristics.Phishing.Email.SpoofedDomain FOUND

Comcast sent me an email saying one of my computers was infected with a bot. And I have been getting a lot of Junk email lately. So I ran ClamXav and scanned my User Folder. The scan came up with one infected file in a deleted email folder / Heuristics.Phishing.Email.SpoofedDomain FOUND

Should I simply Secure Trash the file and I guess I should see if the file still exists on the server level.

iMac (21.5-inch Late 2009), OS X Mountain Lion (10.8.2), Airport, iPhone, iPad, Apple TV2

Posted on Mar 27, 2013 6:03 AM

Best reply

MadMacs0

Level 5

5,221 points

Posted on Mar 27, 2013 9:10 AM

Joe Gramm wrote:

Comcast sent me an email saying one of my computers was infected with a bot. And I have been getting a lot of Junk email lately. So I ran ClamXav and scanned my User Folder. The scan came up with one infected file in a deleted email folder / Heuristics.Phishing.Email.SpoofedDomain FOUND

Should I simply Secure Trash the file and I guess I should see if the file still exists on the server level.

No! All you need to do for this one is to go back to your Mail app and empty the "Deleted Messages" mailbox since you have apparently already decided it's not something you need.

Normally, I would tell you to read any e-mail that has the word Heuristics in the infection name, since this is only a warning that something about the format of the e-mail is suspicious. It did not match a specific signature of a known phishing attempt so the scanner is simply guessing.

Never use ClamXav (or any other A-V software) to move (quarantine) or delete e-mail. It will corrupt the mailbox index which could cause loss of other e-mail and other issues with functions such as searching. It may also leave the original e-mail on your ISP's e-mail server and will be re-downloaded to your hard drive the next time you check for new mail.

So, if you choose to "Scan e-mail content for malware and phishing" in the General Preferences, make sure you do not elect to either Quarantine or Delete infected files.

When possibly infected e-mail files are found:

Highlight the entry in the ClamXav window's top pane that needs to be dealt with.

Right-click/Control-click on the entry.

Select "Reveal In Finder" from the pop-up menu.

When the window opens, double-click on the file to open the message in your e-mail client application.

Read the message and if you agree that it is junk/spam/phishing then use the e-mail client's delete button to delete it (reading it is especially important when the word "Heuristics" appears in the infection name).

If you disagree and choose to retain the message, return to ClamXav and choose "Exclude From Future Scans" from the pop-up menu.

As far as Comcast is concerned, ask them for details as their are currently no known "bots" that impact OS X.

View in context

38 replies

MadMacs0

Level 5

5,221 points

Mar 27, 2013 1:57 PM in response to Joe Gramm

Just to let you know that I concur with John 100% on the possibility that it could easily be the Windows machine, and even an Android.

Joe Gramm Author

Level 5

6,407 points

Mar 27, 2013 4:13 PM in response to MadMacs0

Okay-

I have John and Galt & MadMacs0 saying possibility of malware on a Guest Network.

But then Linc Davis saying the Comcast email itself is a scam.

Can't be both. I'm now on hold with Comcast after 4 numbers to call and lots of menus. I want to find out if it's a legitimate Comcast email.

Linc Davis

Level 10

209,547 points

Mar 27, 2013 4:26 PM in response to Joe Gramm

Comcast seems to send that message to all its subscribers. It's been reported here many times by people who have no Windows computers and no "bots." That doesn't mean that you couldn't have a Windows computer with a bot. The email tells you nothing.

Joe Gramm Author

Level 5

6,407 points

Mar 27, 2013 4:35 PM in response to Joe Gramm

Talked to Comcast security. They did send the email. She said a bot was detected on one of the computers. The bot is associated with an IP Address, but she didn't have an IP address to give me. Told her about the Main & Guest Network, but she couldn't tell me from which Network or even if Comcast could tell which Network the bot was on.

She gave me this address to go to. http//:www.amibotted.net The site reads your IP Address and gives you the results basically as soon as the web page loads. My iMac has no bots according to the site. So now I guess I'll ask all the computers to visit the site.

But.. I deleted the email ClamXav said was infected. So I'll never know if it really was or was not.

Mar 27, 2013 4:40 PM in response to Joe Gramm

Joe,

this is one of those strange things, allow me to explain (1) Clamxav (2) comcast (3) other

Claimxav if you visit their support site has occassionally flagged emails (reliable sources with phising.email tag)

Comcast has sent out broadcast messages similiar to the one you mention "i received one and so have other parties" as part of constant guard http://customer.comcast.com/sitecore/content/customer_comcast_com/Home/help-and- support/internet/constant-guard-service-notice/

as for the guest network - anything is possible

Joe Gramm Author

Level 5

6,407 points

Mar 27, 2013 4:41 PM in response to Linc Davis

Linc Davis wrote:

Comcast seems to send that message to all its subscribers. It's been reported here many times by people who have no Windows computers and no "bots." That doesn't mean that you couldn't have a Windows computer with a bot. The email tells you nothing.

I agree. But since the email is legitimate, I'll ask the people with the PC on the Network to go to the amibotted site and check. But even if the PC(s) has a bot, which wouldn't be a surprise, how can anyone be sure if Comcast infact can detect the bots or they just send the email out as a routine thing.

Joe Gramm Author

Level 5

6,407 points

Mar 27, 2013 4:51 PM in response to michaelsip4

I hope I'm not sounding overly concerned because I'm not. I know ClamXav has flaws and Comcast tries to scare people and I know my machine is clean. I just want to follow thru and check the PC's on the Guest Network. Out of curiosity as well as not wanting any bots on the Network. But with PC's on the Network this may not be possible.

Linc Davis

Level 10

209,547 points

Mar 27, 2013 5:05 PM in response to Joe Gramm

But since the email is legitimate

The email is legitimate only in the sense that it did come from Comcast. It's not legitimate in the sense that Comcast is lying when it tells you it has detected a "bot" on your network. What's really happening is that it has a marketing agreement with Symantec to distribute the latter's useless crapware. It's free initially, but the future "upgrades" that you'll need in order to keep using it won't be.

Joe Gramm Author

Level 5

6,407 points

Mar 27, 2013 5:05 PM in response to Linc Davis

All the PC's on the Guest Network went to the Comcast "amibotted.net" site and no bots were detected.

So Comcast is either full of ...... or it was associated with the email ClamXav detected and I deleted.

Who Knows, thanks for the help

Joe Gramm Author

Level 5

6,407 points

Mar 27, 2013 5:08 PM in response to Linc Davis

Linc Davis wrote:

But since the email is legitimate

The email is legitimate only in the sense that it did come from Comcast. It's not legitimate in the sense that Comcast is lying when it tells you it has detected a "bot" on your network. What's really happening is that it has a marketing agreement with Symantec to distribute the latter's useless crapware. It's free initially, but the future "upgrades" that you'll need in order to keep using it won't be.

This is most likely the case.

MadMacs0

Level 5

5,221 points

Mar 27, 2013 5:15 PM in response to Joe Gramm

Joe Gramm wrote:

Talked to Comcast security. They did send the email. She said a bot was detected on one of the computers. The bot is associated with an IP Address, but she didn't have an IP address to give me.

Your network has only one IP address, that of the Comcast modem. Unless you paid extra for a static IP, it can change periodically. I would guess mine might change twice a month, but I don't really keep track. Comcast has no way of knowing which computer / device might be infected, let alone what network it's on. And the IP address could have changed since the time Comcast claims to have detected a bot.

But.. I deleted the email ClamXav said was infected. So I'll never know if it really was or was not.

Maybe I wasn't clear, but I never believed that e-mail had anything to do with this. It was flagged as a possible phishing attempt and was in your Deleted Messages folder. Either you or your ISP decided some time ago that it wasn't anything you needed. The worst thing that could have happened, assuming you looked at it on your Mac and not the PC/Android is that it had a link to a fake financial institution site and you filled in some privacy information. The e-mail itself was not infected with anything (except maybe a fake hyperlink) and the site you were taken to could not have downloaded anything to your Mac unless you had Java enabled in your browser. The only people I have heard of to suffer the last fate were Tibetan sympathizers.

Joe Gramm Author

Level 5

6,407 points

Mar 27, 2013 5:26 PM in response to MadMacs0

MadMacs0 wrote:

The e-mail itself was not infected with anything (except maybe a fake hyperlink) and the site you were taken to could not have downloaded anything to your Mac unless you had Java enabled in your browser. The only people I have heard of to suffer the last fate were Tibetan sympathizers.

No Java enabled in Safari, I'll have to think about the Tibetan Sympathizer thing, but all in all it was a bunch of nothing. Mentioning a virus, or bot in this case, in the Apple Forums, stirs up the juices.

Mar 27, 2013 6:11 PM in response to Joe Gramm

Joe,

I am certain a lot of other people went through the same steps as you did in a effort to be safe instead of sorry.

TildeBee

Level 7

31,917 points

Mar 27, 2013 6:33 PM in response to Joe Gramm

Joe --I got the same email from Comcast. Unfortunately,, they have always assumed all of their customers use Windoz, and actually might need an AV/Malware app.

Through the email out. And never put any apps, free or otherwise, that Comcast wants you to. I get spam too, and I delete it without looking at it. Eventually, they go away.

Joe Gramm Author

Level 5

6,407 points

Mar 28, 2013 4:03 AM in response to Linc Davis

Linc Davis wrote:

The Comcast email is a scam. Either ignore it or report it to your state Attorney General as the fraud that it is.

I will report this. The email clearly states XFINITY has identified one of my computers with a bot, which in the end is not true. For people in MA(USA) that received these emails from XFINITY Comcast you can File a Consumer Complaint Here. For other areas Search "Your States attorney general file a consumer complaint.

Heuristics.Phishing.Email.SpoofedDomain FOUND