The VM malware defence campaign

[Theodoric]

I noticed an interesting sentence in the forum news item on this subject.

Virgin Media’s own Internet Security team will be trialling an education campaign, they will be writing to customers whose computers are reported as showing signs of infection.

I take it that VM can't see directly whose PCs are infected (or can they?). So where do these reports come from? Are they from VM customers reporting that they are worried about a possible infection?

[beeman]

Usually isp's simply look for excessive SMTP data comming accross their network (someone sending a LARGE volume of emails) and assume (usually correctly) that there infected with a nasty

I would emagin that would bee the case here

[Raistlin]

There are other types/patterns of network traffic that could indicate that a customer's machine is 'infected'. I would guess that VM's network monitoring software is capable of identifying those behaviours and then alerting someone in VM accordingly.

[Peter_]

If your computer appears to be flooding the network with emails due to a potential malware infection it will flag up and the Abuse team with disconnect you and send out a letter explaining why plus you would no doubt call in and also be told why.

You would then have to provide evidence that your machine was clear of any infection before they allowed your connection to be reconnected to the network.

[mart44]

I switched to using ClearCloud DNS a couple of weeks ago and it has picked up on a couple of, what it considers, risky web pages already. As part of the anti-malware campaign, perhaps VM could think about some filtering of malicious sites/pages at this level. Keeping malware off the computer in the first place seems the way to go, rather than (or as well as) detecting it after the event.

[BenMcr]

It's fine if you sign up to a DNS service that does that, imagine the flack Virgin (or any ISP) would get if they did it by default

The recent Wikipedia image hiccup is a case in point