Yes, they can see if machine is infected. Once they blocked me, not because I was infected, but because I was playing with VM etc.

Note that your ISP usually knows your name, if this is missing from the email, you should doubt the validity of the mail

I read the initial "Dear Sir/Madam," and assumed this was just spam/some sort of scam, but apparently this address is actually used in legitimate mails in India...

@Mirsad: Why would playing around with VMs get you blocked by your ISP?

@R.. Knowing the subscriber's name doesn't always tell them gender. (Note that my name causes a lot of mistakes in this regard.) I can easily see doing Dear Sir/Madam as a way of playing it safe.

@Sean, running a malware in VM.

@LorenPechtel: Clearly I did not mean you should use "Dear Sir" or "Dear Madam" based on a gender field on a DB. Rather both come across as rather archaic, and the only place I usually see them is in scams.

The website the email links to says "Quick Heal" and "Free download". Those are definitely some red flags. Why would the Indian government link to a 3rd party "cleaner" tool, and why would your ISP link to a government website? The first rule of scams is that they shouldn't contact you and ask you to download something.

@Boann, ...assuming that's original language; I would expect that the text was translated before being posted.

Instead of trying to determine whether the email is legitimate using conjecture based on the content of the message - is there a valid DKIM signature in the header of the email and/or does the message pass an SPF check?

@At0mic I think the government has a tie up with QuickHeal .. see the links i referenced at the end of the question

FWIW VirginMedia in United Kingdom was doing similar dumb stuff, it appeared to be a blanket mailshot i.e. "everyone might be affected so lets tell them they all are" approach: twitter.com/esdaniel/status/827164382442438656

Well, they should know that there is no reason to capitalize the word malware, and as per is redundant, among other grammar errors in the body of the email.

Is "Greetings" a common salutation?

"It must have come from the ISP itself" is a bad thought track. Scammers can certainly spoof email addresses and generally they use a link in the email to continue the scam as replies do get routed back to them.

@Marc.2377 yes, they should know better English grammar. But they don't.

@stevengregory it is in India.

PHONE the ISP (using a number you look up elsewhere, not one from the message or its links) and ask if the message is really from them.

@NigelFds In regard that you "find it very odd that MTNL is actually taking trouble to find bots" - there might be actually self-interest here for them to do that: 1) Infected accounts can generate much more traffic than "normal" users (and thus more costs for them), 2) can be used to cause network disruptions (DDOS or similar) which no ISP wants, 3) can lead to additional infections (which makes 1 and 2 worse), and 4) might lead to them landing of anti-spam and other blacklists (which is a nightmare since customers want to send e-mails)...