Virgin Media Phorm Webwise Adverts [Updated: See Post No. 1, 77, 102 & 797]

[warescouse]

I thought this may be of interest.

This was the record on the wayback machine which keeps a history of web pages over time.

When Phorm was 121Media
This was a page advertising ContextPlus

http://web.archive.org/web/200601101...ntextplus.com/

Does any of that that sound familiar?

Next an interesting comment on a blog :- see the eweek reference
http://www.realtechnews.com/posts/3067

Next the same page from the wayback machine when ContextPlus shut down
http://web.archive.org/web/200606130...ntextplus.com/

And finally
What f-secure says about it all
http://www.f-secure.com/sw-desc/apropos.shtml

Reading between the lines I see the same smoke and mirrors then that I see today from Phorm. They may have changed their name from 121Media, but they still seem to see everything in a different light to myself and many others.

[Wildie]

the fact is online ads has always been small cos we got the tools to block every single one of them till now, they just do not get the msg we do not want adverts.
come on the power demand goes up every time there is a break in tv programming, why cos we all turn the kettle on or make more popcorn.

[OldBear]

Originally Posted by warescouse

<snip>
When Phorm was 121Media
This was a page advertising ContextPlus

http://web.archive.org/web/200601101...ntextplus.com/

Does any of that that sound familiar?

Yes, and what they actually tell you they will do with your info, as laid out in the "Privacy Policy" (yeah! privacy, my arse!), is quite frightening.

Next the same page from the wayback machine when ContextPlus shut down
http://web.archive.org/web/200606130...ntextplus.com/

Love their version of events here:

Originally Posted by Kent;

Due to concerns over the practices of some of its distribution partners, ContextPlus has determined that it is no longer able to ensure the highest standards of quality and customer care and therefore is discontinuing further distribution of its software.

I heard a different story, ie. "Due to concerns over the the fact that the US authorities are after us due to our dodgy practices, ContextPlus has determined that it is wise for us to shut down and get the Hell outta town before we all do some serious jail time."

OB

[Florence]

Originally Posted by warescouse

I thought this may be of interest.

This was the record on the wayback machine which keeps a history of web pages over time.

When Phorm was 121Media
This was a page advertising ContextPlus

http://web.archive.org/web/200601101...ntextplus.com/

Does any of that that sound familiar?

Next an interesting comment on a blog :- see the eweek reference
http://www.realtechnews.com/posts/3067

Next the same page from the wayback machine when ContextPlus shut down
http://web.archive.org/web/200606130...ntextplus.com/

And finally
What f-secure says about it all
http://www.f-secure.com/sw-desc/apropos.shtml

Reading between the lines I see the same smoke and mirrors then that I see today from Phorm. They may have changed their name from 121Media, but they still seem to see everything in a different light to myself and many others.

Reading between the lines they stopped just long enough to move in on the BT managment and started illegal trials. The legal advice must have taken all of one day to do max..

Another reading betwen the lines why they are not releasing the proof of the legal advice it is lacking on quality...

On a better note F secure still has them down as malware/spyware so BT customers could have problems if their AV is F Secure cant see them changing phorms status from malware..

[tdadyslexia]

Originally Posted by Privacy_Matters

[snip]
VM Customers

Are any other VM Customers having serious difficulties browsing including the following:

- Pages not loading, requiring a refresh - Yes
- Pages timing out consistently - Yes
- Pages loading in Plain Text only - No
- Tracerts indicating Traffic Management with Specific types of Traffic through the UBR - Havn't done a test

Replies in Bold

[tdadyslexia]

Originally Posted by Privacy_Matters

I've noticed that particular media sources are routed through the same IP on the UBR - and these I never have problems with:

five.tv (213.86.253.5): 77-96-1-33.cable.ubr01.azte.blueyonder.co.uk
bbc.co.uk (212.58.224.131): 77-96-1-33.cable.ubr01.azte.blueyonder.co.uk
itv.com (83.98.74.134): 77-96-1-33.cable.ubr01.azte.blueyonder.co.uk
thesun.co.uk (143.252.148.160): 77-96-1-33.cable.ubr01.azte.blueyonder.co.uk
channel4.com (83.98.28.10): 77-96-1-33.cable.ubr01.azte.blueyonder.co.uk
virginmedia.com (212.250.162.12): 77-96-1-33.cable.ubr01.azte.blueyonder.co.uk
pokerstars.com (77.87.179.127): 77-96-1-1.cable.ubr01.azte.blueyonder.co.uk
poketstars.net (217.20.47.4): 77-96-1-2.cable.ubr01.azte.blueyonder.co.uk
bt.com (217.32.165.148): 77-96-1-2.cable.ubr01.azte.blueyonder.co.uk
tiscali.co.uk (212.74.99.30): 77-96-1-34.cable.ubr01.azte.blueyonder.co.uk
diy.com (62.6.240.94): 77-96-1-1.cable.ubr01.azte.blueyonder.co.uk
homebase.co.uk (129.35.70.107): 77-96-1-1.cable.ubr01.azte.blueyonder.co.uk
pcworld.co.uk (195.92.228.186): 77-96-1-34.cable.ubr01.azte.blueyonder.co.uk

The others I have intermitent problems with. It should be noted that this pattern has only started over the past few weeks, and the routing is consistent.

Now, they are not all in the same locus, so why route the same way? I wonder if this is a for prioritising services delivered to PCs? Or possibly caused by the Tech issues that are preventing Edinburgh's upgrade?

What about with you? Anything similar?

Tracert List:
www.five.tv - 30 hops
www.bbc.co.uk - 12 hops
www.itv.com - 10 hops
www.thesun.co.uk - 10 hops
www.channel4.com - 11 hops
www.virginmedia.com - 9 hops
www.pokerstars.com - 13 hops
www.poketstars.net - 21 hops
www.bt.com - 30 hops
www.tiscali.co.uk - 30 hops
www.diy.com - 11 hops
www.homebase.co.uk - 30 hops
www.pcworld.co.uk - 30 hops

I am in Middlesbrough

[icsys]

Originally Posted by Florence

Reading between the lines they stopped just long enough to move in on the BT managment and started illegal trials. The legal advice must have taken all of one day to do max..

Another reading betwen the lines why they are not releasing the proof of the legal advice it is lacking on quality...

On a better note F secure still has them down as malware/spyware so BT customers could have problems if their AV is F Secure cant see them changing phorms status from malware..

F-secure has this to say about Phorm...

The effect [of phorm] is similar to most adware solutions today — except it's installed on your ISP instead of your home computer.
It has also come to our attention that Phorm was previously known as 121Media.

121Media was the company behind the brand PeopleOnPage. PeopleOnPage is the friendly wrapper around the advertisement engine ContextPlus. Another wrapper was called Apropos, which was one of the most widespread malicious rootkits of 2005. In 2006 the heat was too much and they shut it down. DNS registrars and website content supported that they were all in it together.

Using multiple brands and not having full disclosure is common in the adware business. Renaming a company to clear a bad reputation has also been seen before.

http://www.f-secure.com/weblog/archives/00001420.html

I quite like the quote on the blog in one of the links posted by warescouse....

Their *demise* is like digging a hole in a landfill… some other garbage will come along and fill it up.


I aso note that AVG classify phorm as 'lying just outside the boundaries of being classified as adware - they [phorm] adhere to the recommendations laid down by the Anti-Spyware Coalition requiring user consent. A user must accept the user licence agreement to make the service active and they allow users to unsubscribe from the service.'

User consent? What user license agreement?
I would suggest that AVG take the time to look a little closer at phorm rather than rely purely on public sources.
http://www.theregister.co.uk/2008/03...lassification/

[Dephormation]

I've had a letter from OFCOM indicating they are considering my complaint.

http://www.badphorm.co.uk/e107_plugi....php?6833.last

Please, if you haven't done so already, now would be a good time to write to OFCOM complaining about Phorm;

Address to write to;

OFCOM
Riverside House
2a Southwark Bridge Road
London
SE1 9HA

General topics to include;

• Competition
• Secret trials, and consent
• Privacy, security, and integrity of communications
• Transparency of information

Legal topics to include;

• Communications Act 2003
• Article 8 of the Directive 2002/21/EC

See here for earlier detailed analysis which you could adapt;

Originally Posted by Dephormation

OFCOM

[TheBruce1]

Originally Posted by Paul Delaney

Ok go here and download ComboFix.exe to your desktop

physically disconnect the modem cable

shut down avg (right click icon and select exit)

Double-click ComboFix.exe and follow the instructions

Avoid clicking the mouse inside the combofix blue command window

Combofix may reboot windows for you

The program has finished running when the Notepad page appears showing you the log.

Combofix should Not be run blind, Combofix only targets certain infections, not all, ComboFix is a dangerous tool and is not for private use. It is strongly suggested by the creator of ComboFix that you do not download and run ComboFix unless you have first posted a HijackThis log, and the procedure is being supervised by an analyst at one of the forums that handles logs.

I found a program called "Sibelius Scorch (Activex Only)" lord knows where that came from but I removed it although it looked legitimate when going to their website.

http://www.sibelius.com/cgi-bin/down...sh&prod=scorch <--- is this the website, it could be a false/Positive.

[Wild Oscar]

Can some kind soul remind me what were the list of definite Phorm sites?

I can recall a few .. ie
Phorm.com
Webwise.com
OIX.com

I'd like to deny cookie access to all of them .. not a total fix I know, but it's a start!

Originally Posted by TheBruce1

Combofix should Not be run blind, Combofix only targets certain infections, not all, ComboFix is a dangerous tool and is not for private use. It is strongly suggested by the creator of ComboFix that you do not download and run ComboFix unless you have first posted a HijackThis log, and the procedure is being supervised by an analyst at one of the forums that handles logs.

Yes it can be - I've never personally had a problem with it but...

Do you think I would recommend running a program that would damage rather than cure?

You'll have to trust me on this one because there are several tools I use daily to remove these parasites, part of my work involves providing a non - destructive virus removal service mostly to small businesses.

All of them can be dangerous if handled in the wrong way.

I don't think DaveTheJag's PC is absolutely riddled with infections as he would find it difficult to even post here and I'm sure that dozens of hijack this posts will not be either neccessary or be welcome on this forum.

So confident am I that running combofix will remove this infection without any further damage that I'm willing to provide him with the name of my company (which I own) and a personal contact telephone number should he have any concerns.

It would be irresponsible of me to post a cure for this problem without first knowing what I was talking about and I see identical problems every week.





EDIT: Alternatives would be: Disable/Enable ActiveX Addons in Internet Options Programs tab / Manage Addons one by one until you find the culpret (or not) that's causing the problem. Run SpyBot S&D (as a clean up) but be very carefull when removing items that it suggests are problems.

[SimonHickling]

Originally Posted by Dephormation

I've had a letter from OFCOM indicating they are considering my complaint.

http://www.badphorm.co.uk/e107_plugi....php?6833.last

It's interesting that their passing of your details to a market research firm is opt-out.

[Woodgar]

VM Customers

Are any other VM Customers having serious difficulties browsing including the following:

- Pages not loading, requiring a refresh
- Pages timing out consistently
- Pages loading in Plain Text only

I'm on the old NTL portion of the network (in the Midlands) and have been seeing the above for a good few weeks now.

For reference, I am using Firefox 2 and I have seen the behaviour whilst running Windows Vista, and with Ubuntu and SUSE linux distributions, and so I doubt it is a software related issue.


Also, in the spirit of helping out, I've just posted this to the BBC Webwise feedback section.

Sirs,

Whilst using google to research the new spyware program called Webwise that BT and other major internet providers are planing to implement, the first thing I came across was your very own BBC beginner's guide to the internet.

I am concerned that a prestigious public funded organisation such as yourselves are allowing your good name to be associated with such an intrusive and underhanded venture. In my mind, and in the minds of many others, Webwise will always be connected with the BBC and I hate to think that people will be duped into clicking YES on any pop-up invitation box simply because they have come to trust your advice and will assume that you are sponsoring the new scheme.

Please, for the safety of many innocent webusers, the very webusers your site is aimed at informing, I am urging you to look further into this pernicious hijacking of your reputation.

[Florence]

Originally Posted by Woodgar

I'm on the old NTL portion of the network (in the Midlands) and have been seeing the above for a good few weeks now.

For reference, I am using Firefox 2 and I have seen the behaviour whilst running Windows Vista, and with Ubuntu and SUSE linux distributions, and so I doubt it is a software related issue.


Also, in the spirit of helping out, I've just posted this to the BBC Webwise feedback section.

Sirs,

Whilst using google to research the new spyware program called Webwise that BT and other major internet providers are planing to implement, the first thing I came across was your very own BBC beginner's guide to the internet.

I am concerned that a prestigious public funded organisation such as yourselves are allowing your good name to be associated with such an intrusive and underhanded venture. In my mind, and in the minds of many others, Webwise will always be connected with the BBC and I hate to think that people will be duped into clicking YES on any pop-up invitation box simply because they have come to trust your advice and will assume that you are sponsoring the new scheme.

Please, for the safety of many innocent webusers, the very webusers your site is aimed at informing, I am urging you to look further into this pernicious hijacking of your reputation.

Well said lets hope they get enough to act and force them to look elsewhere for a name to pimp... Seem sPhorm pimp everything like the name Phorm is the name for a small design company in Sheffield he was using the name before Kent decided to pimp it almost the same log suprise.. Reading in the history it isnt the first time they have used a name some other company already use since F secure have a line saying there is no link with another company with the rootkits name..

Later today after my guests have left wil look up and post the names and other companies that traded under those names at that time..

[Ryewolf]

I found this list of Webwise OIX domains in a HOSTS file
http://someonewhocares.org/hosts/

127.0.0.1 a.oix.com
127.0.0.1 a.oix.net
127.0.0.1 a.webwise.com
127.0.0.1 a.webwise.net
127.0.0.1 a.webwise.org
127.0.0.1 b.oix.com
127.0.0.1 b.oix.net
127.0.0.1 b.webwise.com
127.0.0.1 b.webwise.net
127.0.0.1 b.webwise.org
127.0.0.1 bt.webwise.com
127.0.0.1 bt.webwise.net
127.0.0.1 bt.webwise.org
127.0.0.1 c.oix.com
127.0.0.1 c.oix.net
127.0.0.1 c.webwise.com
127.0.0.1 c.webwise.net
127.0.0.1 c.webwise.org
127.0.0.1 m01.oix.com
127.0.0.1 m01.oix.net
127.0.0.1 m01.webwise.com
127.0.0.1 m01.webwise.net
127.0.0.1 m01.webwise.org
127.0.0.1 m02.oix.com
127.0.0.1 m02.oix.net
127.0.0.1 m02.webwise.com
127.0.0.1 m02.webwise.net
127.0.0.1 m02.webwise.org
127.0.0.1 ns1.oix.com
127.0.0.1 ns1.oix.net
127.0.0.1 ns1.webwise.com
127.0.0.1 ns1.webwise.net
127.0.0.1 ns1.webwise.org
127.0.0.1 ns2.oix.com
127.0.0.1 ns2.oix.net
127.0.0.1 ns2.webwise.com
127.0.0.1 ns2.webwise.net
127.0.0.1 ns2.webwise.org
127.0.0.1 oix.com
127.0.0.1 oix.net
127.0.0.1 webwise.com
127.0.0.1 webwise.net
127.0.0.1 webwise.org
127.0.0.1 www.oix.com
127.0.0.1 www.oix.net
127.0.0.1 www.webwise.com
127.0.0.1 www.webwise.net
127.0.0.1 www.webwise.org