Posted:
#26
Referring to that Windows 7 Security 2012 in post #1.
More viruses
Posted:
#27
Quote Originally Posted by Rizzo:
Believe me sir we are working hard to get rid of this once and for all. The last thing we want is for anyone not to want to visit our site for these reasons.
We are treating it very serious and taking the necesary steps to prevent it happening again.
Rizz
Believe me sir we are working hard to get rid of this once and for all. The last thing we want is for anyone not to want to visit our site for these reasons.
We are treating it very serious and taking the necesary steps to prevent it happening again.
Rizz
Rizz -- Thanks for responding. By my look, there are threads in the CT section going as far back as November 10 discussing the problems that users are having. I'm sure I'm not the only one that these problems are occurring with, but quite frankly, I'm pretty tired of having to re-boot my computer in safe mode and run full virus/malware scans. I've had to do it like 5 times now, its getting to be a little ridiculous at this point.
Perhaps you can give us users an idea of what steps are being taken by Covers to rectify this problem?
Posted:
#30
Hey Guys,
We are investigating this thoroughly. Below is some more info for you...
https://www.wiki-security.com/wiki/Parasite/Win7AntiVirus2012/
These viruses usually come bundled with free software. The reason why they appear as ads on our site is because the virus sniffs out the ads on our site and replaces them with their own ads – basically stealing our traffic and making money off it. It’s part of the scam.
The continuous virus warnings are designed to keep the victim updating and upgrading their fake virus software.
Posted:
#35
The IT team is naturally looking into this. they have been for a month. They haven't found anything, because there is nothing tto find.
The bottom line is that YOU HAVE TO DOWNLOAD THIS VIRUS AND INSTALL IT YOURSELF.
In other words, it does not come from our site.
Here are a couple of links:
Read them.
You will see that these viruses are caused by users getting tricked into downloading fake anti-virus programs.
Has Covers ever asked you to download anything? Never.
And those "crappy" ads you see running on our site???? Those are delivered by the virus, not Covers. If you are seeing those ads, it's because you already have the virus.
Right now, we are only running ads from Google. Pretty good ones too.
Now, I have to add that there are rare occasions where sites get hacked and can try to install these viruses without the user knowing.
I know it's useless for me to try to convince you that we have not been hacked (we haven't been) but regardless, you can always protect yourself from this by tightening your security settings on your browser. This works for every site.
Problem solved.
Posted:
#36
Quote Originally Posted by Lou:
The IT team is naturally looking into this. they have been for a month. They haven't found anything, because there is nothing tto find.
The IT team is naturally looking into this. they have been for a month. They haven't found anything, because there is nothing tto find.
The bottom line is that YOU HAVE TO DOWNLOAD THIS VIRUS AND INSTALL IT YOURSELF.
In other words, it does not come from our site.
Here are a couple of links:
Read them.
You will see that these viruses are caused by users getting tricked into downloading fake anti-virus programs.
Has Covers ever asked you to download anything? Never.
And those "crappy" ads you see running on our site???? Those are delivered by the virus, not Covers. If you are seeing those ads, it's because you already have the virus.
Right now, we are only running ads from Google. Pretty good ones too.
Now, I have to add that there are rare occasions where sites get hacked and can try to install these viruses without the user knowing.
I know it's useless for me to try to convince you that we have not been hacked (we haven't been) but regardless, you can always protect yourself from this by tightening your security settings on your browser. This works for every site.
Problem solved.
My computer has been consistently infected by those virues, that i provided above, through Covers.com even last night. If Covers thinks problem solved, then i will be forced to cut down or avoid totally on my computer from visiting Covers.com from now on to be safe from viruses attacked. i have been visiting Covers daily since late 2003 and this site has been a pleasure and safe site for me but it is increasingly difficult ever since the malware issues exit. Thanks for your attention. 
Posted:
#37
Lou -- that second link you mentioned states that the virus is transmitted either through the downloading of a file that installs the infection (in that case, the clear fault of the user for being uneducated) or "hacked web
sites that attempt to exploit vulnerabilities in programs that you are
running on your computer to install the infection without your knowledge
or permission."
Is it possible that its just a coincidence that a ton of users on covers are reporting complaints with viruses and spyware? Of course.
Is it also possible that maybe covers' website itself has a vulnerability that was used by the rogue spyware (either the ads or the site itself) to install itself onto users' computers?
If I'm reading you correctly Lou, you are saying there is zero chance as per your IT investigation that it is Covers that is the problem, and instead it is the fault of the individual users?
I just want to make sure I am understanding you correctly Lou.
Is it possible that its just a coincidence that a ton of users on covers are reporting complaints with viruses and spyware? Of course.
Is it also possible that maybe covers' website itself has a vulnerability that was used by the rogue spyware (either the ads or the site itself) to install itself onto users' computers?
If I'm reading you correctly Lou, you are saying there is zero chance as per your IT investigation that it is Covers that is the problem, and instead it is the fault of the individual users?
I just want to make sure I am understanding you correctly Lou.
Posted:
#38
kaponofor3
I don't want to be rude, but these are facts:
- Covers has a website that serves over 2 million people a month.
- Covers has been online for 16 years and has never been hacked. Note to all hackers out there: This is not a challenge! We are not claiming to be smarter than y'all, just that we think we are a very uninteresting site for you to attack. Peace out.
- Covers has a very talented and experienced team of developers and IT professionals. People who have worked all over the place and have experience dealing with shit like this.
- Covers deals with multiple ad networks, but after this issue arose, we throttled it down to just Google AdSense.
- The developers have combed through all of the code and haven't found any types of snippets that might cause false positives.
- The sys admin team runs daily virus checks and has up-to-date monitoring software that checks for intrusions. Since Covers needs multiple servers that need to be mirrored across the network, any possible hacks of this nature would need to change system settings which would get spotted by our mirroring software.
- The viruses that have been mentioned so far are all transmitted primarily by users downloading it themselves.
- Yes, there is a possibility that the site has been hacked, but due to all of the above facts, we have ruled that out. Not that we haven't fully checked, but there is no sign of it.
- Many of the reports involve users claiming to have received the virus from ads that we don't even serve on this site - a known indicator for the virus.
- Many of the reports claim that they are getting virus warnings while browsing Covers. There is no way to verify these reports without more information from the individuals. Virtually every time we do receive additional information, it inevitably shows that these users actually HAVE a virus already, and that is displaying false warnings.
- Judging from the reports, we figure there are a few dozen - maybe up to a hundred or so - users that are convinced they have a virus coming from Covers. And if the number was significantly higher than that, then we would definitely be hearing about it from more than just a few dozen people.
- Many of the complaints claim that they only receive these warnings while on Covers.
Again, please note that all of the above are pure unadulterated and incontrovertible facts.
Now, with all of those facts in hand, we have the following possibilities...
1) Google AdSense is delivering bad ads.
This is possible, but very unlikely as a Internet-wide uproar would be in full swing.
2) Covers is infected, but the virus only transmits to less than 0.01% of the visitors on the site... and those people repeatedly.
Again, this is possible, but seems like an unlikely design for a virus.
3) Perhaps. Just perhaps... the people infected and complaining have contracted the virus elsewhere and they just haven't figured out where it actually happened. It's known to be a very difficult virus to eradicate, and maybe they've had it for longer than suspected.
You are a gambling man, kapono. Knowing those above facts, which possibility would you bet on?
I'm not trying to insult you either. Seriously, if we could find out why some people keep having this problem specifically with our site, we would have fixed it by now. We want all of our users to be happy ones.
Perhaps since Covers is a large gambling site, we have been put on some sort of "list" of sites that the virus targets. We don't know.
What we do know is that we can't spend all our time chasing down a ghost that only exists for 0.01% of our users and for which the evidence strongly suggests that the problem not on our site anyway.
What more can I say?
Posted:
#39
Not much more you can say, Lou. I appreciate the response. I don't think you were trying to insult me in any way.
Again, appreciate the response. I know you want your users to be happy ones. I love this site which is why this issue is so important to me. Sounds like I'll need to do more digging on my end and see if I can't find something wrong.
Again, appreciate the response. I know you want your users to be happy ones. I love this site which is why this issue is so important to me. Sounds like I'll need to do more digging on my end and see if I can't find something wrong.
Posted:
#40
Europa,
I know you are not going to accept this, but I just checked with the IT team and this is what I can tell you...
Regarding the specific virus you mention (Exploit:Java/CVE-2011-3544.E)...
Please read this page from Microsoft
Specifically, read the part where it says: "Exploit:Java/CVE-2011-3544.E is a detection for a malicious Java applet stored within a Java Archive (.JAR) that attempts to exploit a vulnerability..."
And now consider this...
Covers.com's website contains no java whatsoever. None. Nada. We simply don't do java.
Therefore, it is physically impossible for Covers to transmit that file to you. We don't have any java or JAR files on our servers. None. You can't transmit a file that doesn't exist.
So Europa, there are two possibilities for you:
1) You got that infected file somewhere else.
2) You actually have a virus that's displaying false warnings.
Those are the only two possibilities.
Now, you can continue to blame Covers for your virus problems, but it's pretty clear that the specific problem you are mentioning (Exploit:Java/CVE-2011-3544.E) is not something that came from Covers.
kaponofor3... this is a perfect example of what we have been dealing with. It always comes from somewhere else.
Posted:
#41
Exploit:Java/CVE-2011-3544.E was detected by MME and successfully deleted last night. My computer only browsed few web sites, CBS Sportline, Yahoo news, Covers.com and my local book. One way to find it out is, i will NOT go to Covers.com for a couple of days and have Microsoft Security Essentials (MME) scanning everday when my PC is off from Covers.com, and see MME still pick ups viruses in the days without browsing Covers.com.
Thanks for your attention, Lou!
Posted:
#43
Thanks oddsbuster, but that's not much help.
We need to know the names of those viruses, as well as the name of your antivirus software. Finally, if you can tell us what pages you were browsing and the ads that were showing, that would be great.
I know that's a lot to ask, but as I mentioned above, we've looked at everything and found nothing. The more specifics we have, the more likely it is that we'll quickly find out the problem, whether it's on our site or your computer.
Posted:
#44
Quote Originally Posted by Lou:
The IT team is naturally looking into this. they have been for a month. They haven't found anything, because there is nothing tto find.
The IT team is naturally looking into this. they have been for a month. They haven't found anything, because there is nothing tto find.
And those "crappy" ads you see running on our site???? Those are delivered by the virus, not Covers. If you are seeing those ads, it's because you already have the virus.
Right now, we are only running ads from Google. Pretty good ones too.
Clearly this NOT TRUE! This is part of the SOURCE CODE from Covers that is loading on THIS PAGE to which I am replying.
<!-- begin ad tag--> <script language="JavaScript" type="text/javascript"> ord=Math.random()*10000000000000000; document.write('<scr' + 'ipt language="JavaScript" src="https://ad.doubleclick.net/adj/covers.forum/;vid=728x90-2;;sz=728x90;ord=' + ord + '?" type="text/javascript"></scr' + 'ipt>'); </script> <noscript> <a href="https://ad.doubleclick.net/jump/covers.forum/;vid=728x90-2;sz=728x90;ord=123456789?" target="_blank" rel="nofollow"> <img src="https://ad.doubleclick.net/ad/covers.forum/;vid=728x90-2;sz=728x90;ord=123456789?" border="0" alt=""></a></noscript><!-- End ad tag -->It is never good policy to spread false information to your customers!!!!
Posted:
#45
Quote Originally Posted by Lou:
Europa,
Specifically, read the part where it says: "Exploit:Java/CVE-2011-3544.E is a detection for a malicious Java applet stored within a Java Archive (.JAR) that attempts to exploit a vulnerability..."
And now consider this...
Covers.com's website contains no java whatsoever. None. Nada. We simply don't do java.
Here is source code from your MY SCORES page (which I love BTW) that CLEARLY DOES USE JAVA.
<script type="text/javascript" src="/ajax/common.ashx"></script><script type="text/javascript" src="/ajax/SportsDirect.Controls.LiveScoresControls.CustomScoreboard,SportsDirect.Controls.LiveScoresControls.ashx"></script><script type="text/javascript" src="/ajax/SportsDirect.Controls.LiveScoresControls.Scoreboard,SportsDirect.Controls.LiveScoresControls.ashx"></script><script type="text/javascript" src="/ajax/SportsDirect.Controls.LiveScoresControls.BetGraph,SportsDirect.Controls.LiveScoresControls.ashx"></script><script type="text/javascript" src="/ajax/SportsDirect.Controls.LiveScoresControls.BetStatus,SportsDirect.Controls.LiveScoresControls.ashx"></script>
<script type="text/javascript"> //<
Posted:
#47
As I've stated in other threads I've NEVER had a problem with Covers. I have four different computers between work and home, and two different countries. I have a great anti-virus system and always install all updates. Not once , in 8 years have I ever got a virus or a trojan from Covers.com There is no way that anyone would have to throw their computers away because of a virus anyway. You can see that some of these people are trying to set up liability claims, or they don't understand how IT works.It is often the equiv. of leaving your car door unlocked in the middle of a big city. You wouldn't do that to your car, why do it to your computer. A computer only does what you tell it to do...get with it boys and girls!!! Thanks for all you do Covers!!
Posted:
#50
Quote Originally Posted by Mr.Win:
I have Norton, and not one time has it ever happened on Covers...not once in 8 years.
I have Norton, and not one time has it ever happened on Covers...not once in 8 years.
My brother said to stop using IE, so I am using chrome now. what a differance. Much faster and so far no attacks on here. are you using chrome or firefox? maybe that is why nothing set off your norton.
Hot Forum Topics
