Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[Dephormation]

Enjoyed this spoof story;

BT offers to ‘rip customers off some more’

Has anyone seen this before... first a bit of background, I used to be on BT BroadBand, after last nights security hits and Avast stopping one trying to infiltrate my laptop decided its time to do a thorough scan of all system.
Found the following on the desktop (not the machine which was attacked, but the machine I originally setup with BT) using Microworld Anti Virus EScan (MWAV.EXE) in safe mode...

c:\windows\motive\BTBB\Uninstallhelper.exe//WISE0004.bin tagged as "not-a-virus:RiskTool.Win32.PsKill.1101"

anyone still on BT check for the same file c:\windows\motive\BTBB\Uninstallhelper.exe

This was flagged as crytical with MWAV

and no doubt compressed within the exe you will have the same

Obviously a leftover from bt broadband, any suggestions as to where someone might make a good analysis of this file, my system seems to be safe and cant find any links to auto run the file, so made a copy and deleted the original location. There were no registry entries pointing to it either so I am pretty sure whatever it did is history wiped away by multiple scans and ccleaner sweeps/registry cleanups.

Wonder if this was part of the btbroadband setup disk, I installed it once to see if anything was necessary then promtly un-installed it having found the usual unnecessary installations.

[Rchivist]

Originally Posted by alt3rn1ty

Has anyone seen this before... first a bit of background, I used to be on BT BroadBand, after last nights security hits and Avast stopping one trying to infiltrate my laptop decided its time to do a thorough scan of all system.
Found the following on the desktop (not the machine which was attacked, but the machine I originally setup with BT) using Microworld Anti Virus EScan (MWAV.EXE) in safe mode...

c:\windows\motive\BTBB\Uninstallhelper.exe//WISE0004.bin tagged as "not-a-virus:RiskTool.Win32.PsKill.1101"

anyone still on BT check for the same file c:\windows\motive\BTBB\Uninstallhelper.exe

This was flagged as crytical with MWAV

and no doubt compressed within the exe you will have the same

Obviously a leftover from bt broadband, any suggestions as to where someone might make a good analysis of this file, my system seems to be safe and cant find any links to auto run the file, so made a copy and deleted the original location. There were no registry entries pointing to it either so I am pretty sure whatever it did is history wiped away by multiple scans and ccleaner sweeps/registry cleanups.

Wonder if this was part of the btbroadband setup disk, I installed it once to see if anything was necessary then promtly un-installed it having found the usual unnecessary installations.

I definitely remember files in the BTBroadband Desktop help (which is what you had) throwing up false positives - mentioned and discussed on BT internal support newsgroup

We advise people never to use the BT CD for anything other than bird scaring in the garden. Their software is truly abysmal.

Here's a google search on uninstaller.exe refined with "btbroadband"
http://tinyurl.com/65x5nb
you will see several posts with similar issues

and here is a straight google search on the file WISE0004.bin
http://tinyurl.com/5coadz

NB - if concerned about tinyurl links - you can set tinyurl.com to give you a preview of the real link text before being directed to it. I'm using the tinyurl so as not to spread the forum horizontally over six feet of screen real estate.

[fidbod]

Originally Posted by Dephormation

Phorm seem to be updating their web site at present. I reckon they are dressing themselves up, to attract a takeover.

There's a section I haven't seen before, which regurgitates the non-committal statements of the various partner ISPs;

http://webwise.phorm.com/current_pilots.php

Hi all,

A quick thanks to all the regulars on this board. You commitment has made it possible to stop Phorm.

Given we are about to hit a horrendous recession I don't think Phorm or BT can afford a national rollout... Having said that I think we take off and nuke the entire site from orbit. It's the only way to be sure.

keep going. I will try and be at the protest

ps the reason for the quote of Pete.... Phorm have a horredous cash burn rate and no chance of raising finance. Happy days

[ilago]

Originally Posted by alt3rn1ty

Has anyone seen this before... first a bit of background, I used to be on BT BroadBand, after last nights security hits and Avast stopping one trying to infiltrate my laptop decided its time to do a thorough scan of all system.
Found the following on the desktop (not the machine which was attacked, but the machine I originally setup with BT) using Microworld Anti Virus EScan (MWAV.EXE) in safe mode...

c:\windows\motive\BTBB\Uninstallhelper.exe//WISE0004.bin tagged as "not-a-virus:RiskTool.Win32.PsKill.1101"

anyone still on BT check for the same file c:\windows\motive\BTBB\Uninstallhelper.exe

This was flagged as crytical with MWAV

and no doubt compressed within the exe you will have the same

It's classified as a Risktool rather than malware. Risktool is a category used by AV software to define what a file can do, rather than anything else. I would guess that the uninstallhelper file is capable of stopping a running a process to enable the uninstall to proceed. The pskill classification would imply that is the case. Most process termination utilities are classified as risktools. Many specialist malware removal utilities are classified as risktools because of the actions they are capable of performing. AV software would be remiss if it didn't try and make a determination, but everything that AV software finds is not a virus or any sort of malware.

Thanks all for the re-assurances and I dont want this to lead off-topic into a virus problem, my curiosity was sparked by it being a BT uninstaller linked with WISE on a cd I received somewhere between the 2006 and 2007 trials (which at the time everyone was blissfully un-aware of)(cant remember exactly when I received it but the CD wont have been updated very often I shouldnt think).
And could this have been a measure by BT to cover any remnant trace of the activities. In which case the cd has evidence.
I remember when joining BT Broadband I felt like they were pushing the installation of the CD a bit too much for my liking, which could have been just to ensure the target audience didnt stuff up the installation of the HomeHub, but it turned me away from keeping any part of it on the computer, apart from the fact which I concur.... it was mostly crap. Suspicious old me, but right now I think we ought to be.
EDIT: I wonder how many of those problems we just googled fall in the same time period.

Edit2: @ALEX... I have spent a couple of hours tweaking the recording, managed to clean it up a little so that the background noise is not so shrill and the voices come through clearer, and eliminated hum and hiss, but anymore editing using my software starts to result in loss of parts of the Earls voice, particularly when you try to get rid of the crockery clashing sounds. Those are now slightly quieter, but if your sound engineer friend is still on the case then he will probably do a better job if he has dedicated equipment. For your own benefit, after playing around with various methods and undo-ing, I decided to give WavePad (didnt install the extras which are offered during installation) a try instead of audacity, and using Wavepads 'Remove Noise or Hiss' in the sidebar, followed by an Effects High pass filter at 250hz resulted in the improvements I have over your version. Also you have to Edit Select all before these work I believe

[Berealwith]

"Tops" oop's

I dunno if we missed this?

Over on "What Do They Know?" - FOI requests, including one with an answer from 9th July:

1. Overdue request to Home Office here: http://www.whatdotheyknow.com/reques...mation_about_r

2. Request to West Mercia Police due 23rd July:
http://www.whatdotheyknow.com/reques...lating_to_line

3. Request with response from Home Office about contact with BT and Phorm/121Media:
http://www.whatdotheyknow.com/reques...#incoming-1874

All interesting stuff!

[Dephormation]

Originally Posted by Hank

I dunno if we missed this?

Over on "What Do They Know?" - FOI requests, including one with an answer from 9th July:

1. Overdue request to Home Office here: http://www.whatdotheyknow.com/reques...mation_about_r

2. Request to West Mercia Police due 23rd July:
http://www.whatdotheyknow.com/reques...lating_to_line

3. Request with response from Home Office about contact with BT and Phorm/121Media:
http://www.whatdotheyknow.com/reques...#incoming-1874

All interesting stuff!

That's fascinating. I'm getting much the same result with the Home Office. My FOI is currently under 'internal review' at the Home Office.

Simple questions to answer. Who asked for advice, when did they ask for it, what was the request & reply. Why should that be difficult to answer?

Regards the ICO response, they just don't seem to 'get it'. You can't guarantee to me you can anonymise a block of data from the internet, its not possible. Your web traffic is personal data; BT/Phorm processed it, QED. And how do they decide there was no privacy risk without a critical analysis of the evidence of leaking profile information in forums and blogs.

ICO shouldn't be dabbling in stuff they don't understand. They need to hire independent expertise if they don't understand the internet. They are hopeless, absolutely incompetent to be regulating BT/Phorm.

[Rchivist]

From Baphorm - a blog about what Phorm appear to get up to in South Korea. It is an email thread relating the tale of someone allegedly a Phorm VP, exploiting old Doubleclick contacts in S Korea to garner some contacts/intro's in S Korea so they could allegedly do some 4-6 week trials of their technology. The guy gets strung along, promised a paid hotel room in Seoul for a face-toface meeting - spends time and money going to Seoul, but Phorm allegedly never pay for the hotel room and never turn up. Hotel boot him out.

This is certainly compatible with the Phorm we know.
http://therealsouthkorea.wordpress.c...ok-not-to-use/

Enjoy. Of course - I cannot verify this. It may not be true. Decide for yourself.

If it is true, is this the sort of company BT want to keep?

---------- Post added at 09:55 ---------- Previous post was at 09:34 ----------

Originally Posted by Dephormation

That's fascinating. I'm getting much the same result with the Home Office. My FOI is currently under 'internal review' at the Home Office.

Simple questions to answer. Who asked for advice, when did they ask for it, what was the request & reply. Why should that be difficult to answer?

Regards the ICO response, they just don't seem to 'get it'. You can't guarantee to me you can anonymise a block of data from the internet, its not possible. Your web traffic is personal data; BT/Phorm processed it, QED. And how do they decide there was no privacy risk without a critical analysis of the evidence of leaking profile information in forums and blogs.

ICO shouldn't be dabbling in stuff they don't understand. They need to hire independent expertise if they don't understand the internet. They are hopeless, absolutely incompetent to be regulating BT/Phorm.

In addition- they repeat the assertion that no one suffered significant harm - which Stephen Mainwaring would disagree with, and they know that.

Originally Posted by R Jones

From Baphorm - a blog about what Phorm appear to get up to in South Korea. It is an email thread relating the tale of someone allegedly a Phorm VP, exploiting old Doubleclick contacts in S Korea to garner some contacts/intro's in S Korea so they could allegedly do some 4-6 week trials of their technology. The guy gets strung along, promised a paid hotel room in Seoul for a face-toface meeting - spends time and money going to Seoul, but Phorm allegedly never pay for the hotel room and never turn up. Hotel boot him out.

This is certainly compatible with the Phorm we know.
http://therealsouthkorea.wordpress.c...ok-not-to-use/

Well the two people mentioned are listed as being on Phorm's executive team, so the story has some credence.

[Ravenheart]

I'm having a problem doing the transcribing at the moment due to the painkillers after my surgery.I thought it would be an easy task, but the morphine is really knocking me about at the moment. I'll continue to work on the section, but i'm not sure how long it will take me

Sorry for letting folks down.

[warescouse]

Originally Posted by Ravenheart

I'm having a problem doing the transcribing at the moment due to the painkillers after my surgery.I thought it would be an easy task, but the morphine is really knocking me about at the moment. I'll continue to work on the section, but i'm not sure how long it will take me

Sorry for letting folks down.

What we really need is someone who can take shorthand and then type it up. The efforts of the transcribers are to be applauded but it must be really hard work, stopping and starting the 'tape' so to speak.

[rryles]

Originally Posted by warescouse

What we really need is someone who can take shorthand and then type it up. The efforts of the transcribers are to be applauded but it must be really hard work, stopping and starting the 'tape' so to speak.

I'm using some this software:

http://www.nch.com.au/scribe/index.html

It is free, does variable speed playback and various other functions designed to make the job easier. It's available for most OS's though I'm finding the hotkeys don't work properly under Ubuntu.

Ravenheart - Don't feel bad. Anything, no matter how small, is a help. Your personal health is more important though.

[Kymmy]

Originally Posted by Ravenheart

I'm having a problem doing the transcribing at the moment due to the painkillers after my surgery.I thought it would be an easy task, but the morphine is really knocking me about at the moment. I'll continue to work on the section, but i'm not sure how long it will take me

Sorry for letting folks down.

Oh stop moaning and get back to work!!!!!

Kymmy

PS...before anyone has a moan at me I've known this slacker for years