Downloading covers ? Beware Spyware !!

[cyflyer]

This has been mentioned elsewhere, but I will start it as a new thread, at the risk of getting my wrists slapped, because it is a rather important subject. Mention has been made that "dvdcoverart" is down, and members are being re-directed to "cdcovers". I will only say "beware of SPYWARE". "Beware of difficult to get rid of Spyware". "Beware of very very very malicious SPYWARE".
Those that have downloaded from cdcovers and may have noticed their computers slowing to snails pace, the screensaver grinding to a halt etc, get a spyware/adware/popups etc, scan done on your computer. Those that are considering downloading covers do so only if you have a GOOD filtering program. Yes, they have good choice of covers, but at what cost to your computer ?
Any members finding anything, it would be nice to post your findings here as a warning to others, or if anyone can recomend the best filtering programs for "gator" spyware amongst others.

"BE AFRAID. BE VERY AFRAID"

[Sabro]

If your speaking of ".cc" then I have been unable to reproduce or confirm the claims of malware being installed from the site you refer to.

If your not speaking of ".cc" then please disregard. I'm a computer security guy by trade and here's my results, yours may vary:

Test Subject
--------------
OS : XP Pro SP1a
Browser : Mozilla FireFox 0.08 (Free)
Spyware Detection : LavaSoft Ad-Aware 6.0 Personal Build 6.181 (Free)


Approach
-----------
Updated Ad-Aware sigs
Scanned test subject machine resulting in NUFFIN
Visited suspected badguy site and downloaded approx 15 covers
Scanned test subject machine again resulting in NUFFIN


Sounds like a false positive to me, speculation or its possible you picked it up somewhere else.

Sorry Mods for the waste of time, however I could find no evidence supporting this claim, at least, with my methods and applications.



Regards,

Sabro

[johns0]

You wont get spyware from d/l jpg pictures,only from installing those install me popup boxes that lots of sites are using now.

[lordsmurf]

Learn to edit your HOSTS file. Use SPYBOT, new version, with pre-emptives. Use adblocker like Norton. Use A/V software. Use pop-up stopper.

I do all this. No spyware, no ads, no banners. Easy sailing online.

[Xtreme]

I use Mozilla Firefox ..... it blocks popups..... so i dont have to worry about spyware.

[JohnnyCNote]

I've had good luck using Norton AV's pop-up blocker along with the Yahoo toolbar, which also has a pop-up blocker. MSN offers one, too. Then I also do regular sweeps with Ad-Aware and daily Norton AV scans. Still, it's ridiculous one should have to go to these lengths...

[jimmalenko]

I have Ad-Aware like one of the previous posters. I also have the google toolbar with inbuilt popup stopper. I also have XP SP2, which puts a popup stopper into IE, as well as an improved firewall that has basically everything closed by default. never had a problem with www.cdcovers.cc, which I have found to be the best covers site. If I'm struggling to find a cover I use www.coverkingdom.net, which seems to have a lot of Australian artists and movie covers.

cdcovers.cc has a shitload of popups which are now being stopped by IE. coverkingdom.net has a multitude of "Click yes to download cover" message boxes which are easy to close but annoying, and probably go to town with spyware/adware if you do actually click yes. I run my AV software and Ad-Aware twice a week, normally finding about 10-20 tracking cookies. I have found my methods to be pretty successful in the fight against popups and popunders. Sure it is a bit of a pain to have to "allow" certain websites such as banks, etc. free reign in order to use Internet Banking and the like, but I would much prefer that than having to close down popups all the time.

[RottenFoxBreath]

if you click these"click OK to install cover" windows,or whatever,then you deserve what you get.
as for service pack 2 for XP,im not gonna install it just now,as the pre release ones are beta,and the full finished one requires a full reinstall of windows,according to microsofts support pages.
SP2,IMO,is spyware,with whats planned for it.

[andyp1]

I get no problems with cdcovers.cc , Several months ago it wouldn't let me D/L a cover without turning of the privacy control in Norton Firewall.
I'm not sure what altered but I don't turn anything off now and I get covers no problem. I also have Adaware 6 installed.

[vioxx]

Usually jpg/jpeg file will be safe.

Someone mentions that gif file can hide virus.

I'm not sure about it.

? Any idea

[vhelp]

.
.
Yes. I've ben seeing a number of .GIF as attachments in my e-mails
lately. I investigated a few, by dbl-clicking them, and my graphis app would
hang. Painshop for instance.

Also, .zip files are showing up a lot now-a-days in my e-mails. Don't dbl-click
these. They somehow have the first few char in the .zip altered enough, that
they self-run (I think) and install .exe files or something. Probably worms or
other BAD files

Also, I D/L the latest build for Ad-aware 6.x and shortly after that, my
system was having it's PORTS scanned 8 times, by:

Remove Host - - - my port numbers that were scanned:
----------------------------------------------------
140.124.85.227 - 2745, 3127, 0080, 6129, 0139
140.124.85.227 - 0139, 6129, 1025, 0135, 2745
140.124.85.227 - 2745, 0135, 3127, 0080, 0139
140.124.85.227 - 6129, 0139, 0080, 1025, 2745
140.124.85.227 - 2745, 0135, 1025, 3127, 6129
140.103.211.38 - 6129, 2745, 3127, 1025, 0080
140.103.211.38 - 0080, 2745, 3127, 1025, 6129
140.103.211.38 - 2745, 1025, 3127, 6129, 0080

I'm using Sygates Pesonal Firewall v5.5

I performed a Backtrace on the IP numbers (there are lots of them per
port scan.., some go as high as 20 IP number per port scan) But I don't
understand how to read what it returns to me ???

Thanks guys,
-vhelp

[DVD_Ripper]

I have Norton AntiVirus, Kerio PF, run Adaware and Spyware Blaster... and I still get an occassional 'anamoly' in my startup.

I recommend Running MSCONFIG and check your start up items via the following link to make sure they are ok.

http://www.windowsstartup.com/wso/

[jimmalenko]

As for service pack 2 for XP,im not gonna install it just now,as the pre release ones are beta,and the full finished one requires a full reinstall of windows,according to microsofts support pages.

I attended Microsoft's Security and Management Summit a couple of weeks ago and we got a copy of SP2. I gave it a go and it seems OK. The best individual feature IMO is the merging of windows update and office update into windows update v5. I fired up windows update yesterday and noticed that I "required" a 100MB SP2-related download. Dialup is a drag so I might let it go overnight tonight.

[cyflyer]

I'm not as computer wise as I would like to be, but thanks for all the input guys. Sabro, yes I was talking of .cc. JohnsO, I have NEVER installed ANY of those pop-up boxes, or any other kind of 'click here' request. Only an idiot would do that. I never ever download anything else. As for the scans, I too have scanned with Sbybot, and found some nasties, but there is still something lurking in there that Spybot hasn't found, and cannot find. My cpu is working flat out at 100% when it should be ticking over at about 6% and the screen saver is freezing etc. Don't forget they use very very deceptive methods to get get their shitware on to our computers, they don't ask 'click here' before installing themselves, and they don't make it easy for you to find them. Maybe spyware doesn't install on .jpg, but they found a way in. All I know for sure, when looking through '.cc's own forums, there were a lot of complaints by their members, and webpdp.gator.com was the most common that others had found, and appeared in many complaints made that stuck in my mind. That was before I put my 'whinge' in and got banned, so I don't know what is being said there now, or how many others have been removed for hitting the nail on the head.

[jimmalenko]

If you are concerned about the CPU usage, take a look at what processes are running and how much memory they are using. For Windows 2000/XP, click Ctrl+Alt+Delete and go to the Task Manager. Click on the Processes Tab. This will list all processes running on your machine. Do a web search on any one of the filenames in your favorite search engine and you should be able to work out if the process should be running or not.

As a last resort, there is always System Restore, and as the absolute, point of no return, worst case scenario, clean install of windows. This is the mother of all spyware removal methods

[cyflyer]

Just to round off this thread, incase anyone is still looking, I thought you might be interested to read the following article on the anti-spyware programs we all mentioned. According to some fellow members they have scanned and found nothing. The pcworld test/reveiw shows that even the BEST of the programs mentioned, only finds at best 57% of the nasties ! Read the opening page on the link, and the following page for the direct comparissons. I hope you find it as interesting, and thought provoking, as I did.



http://www.pcworld.com/reviews/article/0,aid,115939,pg,6,00.asp

Have a nice day everyone.

[GabeB]

I remember trying to download the cover for Donnie Darko about a month ago. After clicking 'front' the 'Download Cover' botton was suddenly covered by a pop-up ad that slid in from the side and I accidently clicked on. For the next couple days my computer was overtaken by pop-ups but were easily removed with AdAware and Spybot. I tried to download the cover for a week or so but it was always covered with the same damn ad so I gave up.
btw: I just checked and the ad is now gone.

[iooi]

Well just to add my 2p's worth been using covers.cc for a long time now and many other covers site's far to numerous to list and i have never had a spy ware problem from any of them....
Sure you get the annoying pop ups saying you got to click me to download covers, but closing them 3 times is usually enough for them to disappear and allow download of cover...
Just never click Ok and always read them before shutting them down, some are worked back to front so you think you have cleared them but in fact you have allowed them onto your system....

[quiller]

cyflyer: A large part of your problem comes from the fact you're using IE. While some spyware still gets through other browsers, the vast majority of it is a result of holes in Internet Explorer. Before you go tearing apart IE, though, realize that every program has flaws. If 90% of the market was using FireFox, there would be plenty of holes found and exploited in that browser, as well.

Back to the point: Stopping spyware is all about being proactive. If you wish to stick with Interne Explorer, more power to ya, but keep in mind you're sacrificing your security at the same time. The best advice I can give you is to use a combination of what's out there:

1. Install and frequently update Ad-Aware and SpyBot.
2. Buy a hardware firewall and make sure everything is closed down except any normal ports (80, 21, etc).
3. Set up a software firewall such as ZoneAlarm
4. Switch to a less exploited browser such as Mozilla Firefox.
5. Stop clicking on banners and pop-up windows!
6. Run anti-virus and anti-spyware scans frequently.
7. Rinse. Wash. Repeat.

In closing: You can complain about a specific site containing "malicious" spyware, but the simple truth of the matter is all spyware is unwanted, annoying and possibly dangerous. Avoiding one site will not protect you forever!

[cyflyer]

The computer invasion saga continues. After the spyware scans, a scan by F-secure and Norton antivirus showed up these little bastards:

Exploit.HTML.Mht
I-Worm.Bagle.gen
I-Worm.Bagle.I
TrojanWin32.Qhost
TrojanDownloader.JS.Small.d
TrojanDownloader.Win32.Mitglieder.O
Worm.Win32.Padobot.m

There is still something there that aint showing up on the scans, and the Norton update page refuses to open up for a current update.
Where the hell did all this shit come from ? All I have ever opened in ages is hotmail, yahoomail, cnn, cdcovers, ebay. Oh, and present company of course. So who is the culprit ?

[quiller]

cdcovers.cc is probably the culprit, but I highly doubt you used only those sites. Any site could be filled with spyware, but you could've also gotten some of that outside of a website. If you can't get it with the latest updates from Spybot, Adaware and Norton... you're probably better off backing up and starting from scratch; either that, or fight an uphill battle for the coming months.

[iooi]

Where the hell did all this shit come from ? All I have ever opened in ages is hotmail, yahoomail, cnn, cdcovers, ebay. Oh, and present company of course. So who is the culprit ?

I would look more closely at the mail sites, more than anywhere else....
Either that or someone has entered your computer and added then in for you...
Are you running a routher in NAT mode or behind a firewall ??? other than Xp's
Visit one of the securty sites and get your ports scanned to see what you have open, you may well find several big holes....

[Sabro]

There's alot of free virus/trojan/security scans at http://www.sabronet.com

Just goto the Malware page and look towards the bottom.


Sabro

[quiller]

Interesting statistics and links, thanks.

[cyflyer]

Got the final little bastard out of my system just today. "W32 Blaster". This little shit prevents you from even getting onto the anti virus websites to update your Norton ! Thats why I thought the Norton site wasn't opening, cos this nasty actually prevents it. A friend had to update the anti virus on his computer, then transfer it on disc to mine before I could locate and delete this piece of scum on my harddrive. Be alert guys (the world needs more lerts).

[Sam Ontario]

I keep an updated clean version of Windows backed up by Norton Ghost. Whenever, my system is slow down, or attacked thru e-mail or downloading, I do the Norton Ghost restore and uprunning my computer again.

[aero]

If your speaking of ".cc" then I have been unable to reproduce or confirm the claims of malware being installed from the site you refer to.

Sabro

Whoa, actually .cc does have a pop up which will attemt to load some of the most malicious and teneacious malware there is. Zonalarm isn't going to stop it, nor will most malware eradicators get it off. This is malware, including keyloggers, that delates itself from registry if you invoke regedit and then re installs at closing regedit.

Yeah, 95% of users won't hit the install, but this is quite nasty stuff to unleash on the 5% who will.

[Sam Ontario]

2. Buy a hardware firewall and make sure everything is closed down except any normal ports (80, 21, etc).

I have a Linksys wireless Router B, the most common wireless B model. Pls enlighten me how to close down everything except ports 80 and 21. I have 4 machines connected LAN and only use them for surfing internet, receiving e-mails at the but will consider video conferencing at a later stage. How should I set up my machines and what will you recommend. I have Norton System Works installed, 3 machines with Noerton Personal firewalls and one machine with ZoneAlarm, non-pro.

[aero]

If your speaking of ".cc" then I have been unable to reproduce or confirm the claims of malware being installed from the site you refer to.

If your not speaking of ".cc" then please disregard. I'm a computer security guy by trade and here's my results, yours may vary:....

Sorry Mods for the waste of time, however I could find no evidence supporting this claim, at least, with my methods and applications.

sabro, you may be a technical expert but perhaps you should step back and see the big picture. Search cdcovers.cc's own forums and you will see the site's administrators recommending people turn off norton and/or add cdcovers.cc to their trusted zone!

Modify your "methods and applications" to include social engineering and greed on behalf of unscrupoulous site owners and you may find more results.

[Xtreme]

I am using this program now .... it is suppose to stop spyware, adware, etc before it even gets on your PC .... it has real time protection..... i am using it now to see how good it is, so far it is great.


http://www.javacoolsoftware.com/spywareblaster.html