Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[bluecar1]

Originally Posted by R Jones

Make sure that any keywords in the tags ARE replicated in the body text itself. Otherwise google can penalise you for keyword stuffing.

we need to get it right to get it up googles rankings and to as many people as possible, and certainly above PHORMS pages in the results

anyone else who knows how to get up the search engine results please help

peter

[mark777]

Originally Posted by vicz

Constructor.DOS.BWG

Aliases
Constructor.DOS.BWG (Kaspersky Lab) is also known as: Constructor.BAT.BWG (Kaspersky Lab),
Description added May 31 2002
Behavior Virus Constructor
Technical details
Constructor creates batch payload programs. It is written in Basic for DOS.

It creates payload programs of the following types:

internet worms
mIRC worms
pIRC worms
installing to the win.ini
installing to the system registry startup key
installing to the startup directory
deletes antivirus programs
Constructor inserts the following comment in the beginning of batch files:

REM generated with BATCH WORM GENERATOR x.xx

I had a problem as well. It was the first time I refreshed after Bluecar1's 21:21 posting with the thumbnail. (Bluecar1 - i'm not suggesting you did anything wrong, just pinpointing when it happened )

I could get the last page, but not the current page.

@vicz - are you saying you got the above warning from this site?

[Pencal]

Hi All

I have been lurking here for a long time and the usual thanks for all the hard work you have put in. I sent a question to the Webwise contact page some time ago and thought you may be interested in the header of my reply. It seems to have come via 121media.com, I'll let you tech buffs pick the bones out of it.

Return-path: <bt.webwise.help.desk@bt.com>
Delivery-date: Tue, 13 May 2008 11:52:34 +0100
Received: from [217.32.164.138] (helo=smtp3.smtp.bt.com)
by hermes.hosts.co.uk with esmtp (Exim 4.67)
(envelope-from <bt.webwise.help.desk@bt.com>)
id 1Jvs7W-0003JX-7L
for xxxx@xxxxx.co.uk; Tue, 13 May 2008 11:52:34 +0100
Received: from E03MVA2-UKBR.domain1.systemhost.net ([193.113.197.105]) by smtp3.smtp.bt.com with Microsoft SMTPSVC(6.0.3790.1830);
Tue, xx xx 2008 xx:52:39 +0100
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Subject: FW: BT.webwise.com Contact Request
Date: Tue, 13 May 2008 11:51:32 +0100
Message-ID: <xxxxxxxxxxxxxxxxxxxx@xxxxxx2-UKBR.domain1.systemhost.net>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: BT.webwise.com Contact Request
Thread-Index: xxxxxxxxxdw65ScKRtvQRUfeUJwfLtdw0
References: <xxxxxxxxxxx.xxxxxxxx@www.121media.com>
From: <bt.webwise.help.desk@bt.com>
To: <xxx@xxxx.co.uk>
X-OriginalArrivalTime: xx xxx 2008 xx xx .0899 (UTC) FILETIME=[7685E2B0:01C8B4E7]
X-namesco: xxx.xxx.xxx.xxx
X-Spam-Score: -0.9 (/)
X-Original-To: xxx@xxxxxx.co.uk

[bluecar1]

Originally Posted by mark777

I had a problem as well. It was the first time I refreshed after Bluecar1's 21:21 posting with the thumbnail. (Bluecar1 - i'm not suggesting you did anything wrong, just pinpointing when it happened )

I could get the last page, but not the current page.

@vicz - are you saying you got the above warning from this site?

from my AV(fsecure) LOG, changed details of domain / user info for privacy, this should pin point times and files etc

the clock on my PC is 1 - 2 minutes fast

peter

63 2008-05-28 21:30:53+01:00 cartoon-ties domain\userF-Secure Anti-Virus 1.3.6.1.4.1.2213.11.1.12
Malicious code found in file C:\DOCUMENTS AND SETTINGS\user\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\3O9LUJFX\NEWREPLY[1].HTM. Infection: Constructor.DOS.BWG.203

64 2008-05-28 21:30:56+01:00 cartoon-ties domain\userF-Secure Anti-Virus 1.3.6.1.4.1.2213.11.1.12
Malicious code found in file C:\DOCUMENTS AND SETTINGS\user\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\FQQTQU42\SHOWTHREAD[1].HTM. Infection: Constructor.DOS.BWG.203

65 2008-05-28 21:30:58+01:00 cartoon-ties domain\userF-Secure Anti-Virus 1.3.6.1.4.1.2213.11.1.12
Malicious code found in file C:\DOCUMENTS AND SETTINGS\user\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\DMRBACPE\BOARD[1].HTM. Infection: Constructor.DOS.BWG.203

66 2008-05-28 21:30:59+01:00 cartoon-ties domain\userF-Secure Anti-Virus 1.3.6.1.4.1.2213.11.1.12
Malicious code found in file C:\DOCUMENTS AND SETTINGS\user\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\DMRBACPE\BOARD[1].HTM. Infection: Constructor.DOS.BWG.203

67 2008-05-28 21:31:00+01:00 cartoon-ties domain\userF-Secure Anti-Virus 1.3.6.1.4.1.2213.11.1.12
Malicious code found in file C:\DOCUMENTS AND SETTINGS\user\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\FQQTQU42\SHOWTHREAD[1].HTM. Infection: Constructor.DOS.BWG.203

68 2008-05-28 21:31:00+01:00 cartoon-ties domain\userF-Secure Anti-Virus 1.3.6.1.4.1.2213.11.1.12
Malicious code found in file C:\DOCUMENTS AND SETTINGS\user\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\DMRBACPE\BOARD[1].HTM. Infection: Constructor.DOS.BWG.203

[vicz]

Originally Posted by mark777

I had a problem as well. It was the first time I refreshed after Bluecar1's 21:21 posting with the thumbnail. (Bluecar1 - i'm not suggesting you did anything wrong, just pinpointing when it happened )

I could get the last page, but not the current page.

@vicz - are you saying you got the above warning from this site?

No just some info on the class of virus mentioned earlier. No problems for me so far (smug on OSX though!)

---------- Post added at 22:23 ---------- Previous post was at 22:08 ----------

Originally Posted by Pencal

Hi All

I have been lurking here for a long time and the usual thanks for all the hard work you have put in. I sent a question to the Webwise contact page some time ago and thought you may be interested in the header of my reply. It seems to have come via 121media.com, I'll let you tech buffs pick the bones out of it.

Return-path: <bt.webwise.help.desk@bt.com>
Delivery-date: Tue, 13 May 2008 11:52:34 +0100
Received: from [217.32.164.138] (helo=smtp3.smtp.bt.com)
by hermes.hosts.co.uk with esmtp (Exim 4.67)
(envelope-from <bt.webwise.help.desk@bt.com>)
id 1Jvs7W-0003JX-7L
for xxxx@xxxxx.co.uk; Tue, 13 May 2008 11:52:34 +0100
Received: from E03MVA2-UKBR.domain1.systemhost.net ([193.113.197.105]) by smtp3.smtp.bt.com with Microsoft SMTPSVC(6.0.3790.1830);
Tue, xx xx 2008 xx:52:39 +0100
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Subject: FW: BT.webwise.com Contact Request
Date: Tue, 13 May 2008 11:51:32 +0100
Message-ID: <xxxxxxxxxxxxxxxxxxxx@xxxxxx2-UKBR.domain1.systemhost.net>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: BT.webwise.com Contact Request
Thread-Index: xxxxxxxxxdw65ScKRtvQRUfeUJwfLtdw0
References: <xxxxxxxxxxx.xxxxxxxx@www.121media.com>
From: <bt.webwise.help.desk@bt.com>
To: <xxx@xxxx.co.uk>
X-OriginalArrivalTime: xx xxx 2008 xx xx .0899 (UTC) FILETIME=[7685E2B0:01C8B4E7]
X-namesco: xxx.xxx.xxx.xxx
X-Spam-Score: -0.9 (/)
X-Original-To: xxx@xxxxxx.co.uk

It looks like someone/thing at BT is forwarding some of the questions to phorm and 121 for answers, and then forwarding the replies back to you. Going thru my inbox, Outlook / Exchange seem to use the references field to link threads of replied to and forwarded messages. It seems a bit odd but I would have thought if BT or phorm were up to some sort of subterfuge they wouldn't be setting the references field as its use is optional.

[SelfProtection]

Originally Posted by vicz

No just some info on the class of virus mentioned earlier. No problems for me so far (smug on OSX though!)

I had temporary problems also just after viewing that .png file.

So I flushed my Sandbox & checked my system, there were 14+ viewings of that .png file I suggest it is pulled & closely & carefully checked!

[vicz]

Originally Posted by AlexanderHanff

As I said, that is the only way I can interpret the evidence. I could of course be wrong and certainly hope I am, but something tells me I am not.

Alexander Hanff

What we don't know is what information is forwarded to phorm as part of the request. It would be normal to forward technical queries to specialist subcontractors, together with sufficient information to solve the problem / answer the question, but should otherwise be using some sort of case reference number rather than personal details. So if we ask a) would they answer b) would we believe them?

[mark777]

If it helps, I had the problems, but did not click on the thumbnail, just refreshed the screen.

[AlexanderHanff]

Originally Posted by vicz

What we don't know is what information is forwarded to phorm as part of the request. It would be normal to forward technical queries to specialist subcontractors, together with sufficient information to solve the problem / answer the question, but should otherwise be using some sort of case reference number rather than personal details. So if we ask a) would they answer b) would we believe them?

I don't think this is BT consulting with Phorm, from what I have read about the References header, it is the origin of the message they are replying to. If that message was a technical email from Phorm, then the reply would go to them, not you.

This seems like it is definitely referring to the origin of the contact us form data.

Alexander Hanff

[Cogster]

Originally Posted by mark777

If it helps, I had the problems, but did not click on the thumbnail, just refreshed the screen.

I have np... reloaded pages using bottom page no's only seems ok..

[bluecar1]

Originally Posted by bluecar1

interesting

see attached png image

it's from the ww3.phorm.com

it seems to suggest if you opt-out your profile is destroyed!!

no mention that phorm view all sites and what they are comparing against only monitor WHEN ON THEIR SITES

as you see blatently incorrect

peter

just checked the bmp and png files on my local machine and opened the png i uploaded, no issues or viruses found

not sure what happened

i had just updated paint.net from 3.22 to 3.31 that was the only thing i did just before the issue

peter

[serial]

Originally Posted by mark777

Very useful. Could you include a link to the inphormationdesk as well?
http://www.inphormationdesk.org/

Was split on linking inphormationdesk.org or badphorm, I figured I wanted a place people could ask questions other than emailing me

Originally Posted by R Jones

I did a lookup on www3.phorm.com and got this:

Technical Contact:
Clark, Allan allan.clark@phorm.com
Phorm, Inc
264 W40 Street
16th Floor
New York, New York 10018
United States
2123592030 Fax --

I was scrolling past this and this entry caught my eye, we've had a user called AlanC start a thread on BadPhorm which has caused a long argument with him.

Originally Posted by bluecar1

we need to add more in these two lines, you are allowed 256 chars in each, and google etc scan these i believe at a higher wieghting than page content.

As has been said, trying to keep meta content the same as content on the page. I'm getting good advice on the SEO side

[wecpc]

Originally Posted by mark777

If it helps, I had the problems, but did not click on the thumbnail, just refreshed the screen.

I did click on the thumbnail, but had no problems. I have since run a full scan with Norton v.8 just in case and no problems were found.

Colin

[davethejag]

Hi All, I have just seen a thread on Hot UK Deals ref privacy. -

http://www.hotukdeals.com/item/19129...urbing-privac/

Is anybody singned up with them? Perhaps you could add a post about Phorm? I think that this site gets a lot of hits and it may help to spread the word!

Best to all. davethejag

[bluecar1]

Originally Posted by serial

As has been said, trying to keep meta content the same as content on the page. I'm getting good advice on the SEO side

what about a link to http://www.theregister.co.uk/2008/02/29/phorm_roundup/

it's got the full archive of register articles about phorm from chris williams

peter