BS: Mudcat problem (FunWebProducts)

Subject: BS: Mudcat problem
From: Louie Roy
Date: 13 Apr 05 - 11:16 AM

I hope everyone read the article that was posted on front page of mudcat on 4/13/05( This is what was written)15 January 05 Alert the recent mud cat problems are due to adware installed on a mudcat users computer pacifically something called FunWebProduct there is and article about it here(Blue Clickety Thing)Appartently driving WebMasters crazy all over the world

Subject: RE: BS: Mudcat problem
From: GUEST,Jon
Date: 13 Apr 05 - 11:51 AM

I still haven't found anything to substantiate this. The link is to an article witten a few years ago and refers more to users risks to them. I know of no other webmaster with a problem caused by Funweb Products.

Subject: RE: BS: Mudcat problem
From: GUEST,MMario
Date: 13 Apr 05 - 12:00 PM

jon - I do. And some rather large ones at that.

Subject: RE: BS: Mudcat problem
From: GUEST,Jon
Date: 13 Apr 05 - 12:05 PM

Can you point me to one please MMario.

Subject: RE: BS: Mudcat problem
From: GUEST,MMario
Date: 13 Apr 05 - 12:22 PM

jon - I don't have any documented sites haven't bothered to look and frankly - can't be bothered to look.- but local (Rochester, NY) roadrunner webmail was taken down by FunWeb a couple months ago; and according to friends who work for them they had several other regional hubs that have had the same problem. They didn't admit it then and they don't admit it now - but we were fighting the same problem at the time and tracked several waves of attacks to their servers.

We had a school district go down with fun-web last August - and sproradic attacks of it since - mainly blocked and we've kept it from production servers since last August- but it's not hard to see how it could take out sites. - especially when you don't have 24/7 coverage and multiple redundancy.

Not to mention the gazillion other products out there that hammer at firewalls filters and blocks.

Subject: RE: BS: Mudcat problem
From: GUEST,Jon
Date: 13 Apr 05 - 12:46 PM

Thanks Mmario. I remain baffled. I have traced 3 Mudcat regulars and one "guest" who have visited the Annexe over the past 3 days with funweb products on their system all I see is maybe as many as 6 pages opened on a vist - no more than many without it open. Maybe my turn will come but I've run since Jan, being aware of it and not attempting to block it without any problems.

Subject: RE: BS: Mudcat problem
From: SINSULL
Date: 13 Apr 05 - 01:13 PM

Is there any way of finding out which members are causing the problem and request that clean up their systems?

Subject: RE: BS: Mudcat problem
From: GUEST,MMario
Date: 13 Apr 05 - 01:15 PM

*grin* yeah, jon I know. Part of the problem is that there isn't that much difference between "servers" and "workstations" these days. It used to be that what would effect a workstaton wouldn't function on a "server" - but that just doesn't hold true anymore.

Subject: RE: BS: Mudcat problem
From: GUEST,Jon
Date: 13 Apr 05 - 01:29 PM

Well I won't do that Sinsull as it is not causing me a problem but "Funweb Products" is supposed to show up in the User_Agent string if a page is visited by a browser on a system with funweb products installed.

People are quite welcome to click here and see if the word "Funbeb" comes up amongst the details.

Jon

Subject: RE: BS: Mudcat problem
From: Sorcha
Date: 13 Apr 05 - 01:41 PM

While I was in Kansas I was using Mom's computer. It was slow as frozen molasses, and I asked if I could try to clean it up. She had FunWeb, comet cursor and a bunch of other stuff. PS--I now know why everyone hates XP Home......I also showed her Mozilla Firefox and told her to tell the grand kids NO Downloads!

Subject: RE: BS: Mudcat problem
From: artbrooks
Date: 13 Apr 05 - 01:41 PM

OK...so if I get "USER_AGENT:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; AIRF; SV1; .NET CLR 1.1.4322)", then I'm clean?

Subject: RE: BS: Mudcat problem
From: GUEST,Jon
Date: 13 Apr 05 - 02:01 PM

As far as I know Art.

Subject: RE: BS: Mudcat problem (FunWebProducts)
From: GUEST,Jon
Date: 13 Apr 05 - 02:56 PM

As an experiment, I installed Smiley Centray (one of the funweb products) on my laptop, rebooted and visited the page I gave. It reported:

USER_AGENT:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; DigExt; FunWebProducts; .NET CLR 1.1.4322)

I have since removed it and am back to:

USER_AGENT:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; DigExt; .NET CLR 1.1.4322)

Jon

Subject: RE: BS: Mudcat problem (FunWebProducts)
From: katlaughing
Date: 13 Apr 05 - 03:10 PM

Thanks for the link to check this. Seems I am clear, too. Thanks be to Mozilla!**bg**

Subject: RE: BS: Mudcat problem (FunWebProducts)
From: GUEST,Jon
Date: 13 Apr 05 - 03:42 PM

Just thinking and looking again. To be really sure, I would advise running spybot.

Subject: RE: BS: Mudcat problem (FunWebProducts)
From: JohnInKansas
Date: 13 Apr 05 - 05:48 PM

Part of the difficulty here is that "Fun Web" and "My Way" have been moving targets. Early versions of both caused a lot of trouble and were really obnoxious. Hijacked toolbars and deceptive/difficult removal instructions were common. Removal according to instructions may have(?) frequently left functioning tracking and adware components that were buried and disguised.

Early versions of the "My Way" package were available to anyone who wanted to download them, and could be merged into other programs. The "My Way" identification may or may not be visible where the search engine components were "repackaged." With repackaging, the actual program might be disguised as "just Fun Web" or "just My Way" when in fact it included other spyware/adware added on by an unknown agent.

To further complicate things, during the early distribution of these "My Way" components, an identity often used was "IWon." That name apparently(?) is no longer used for current software.

Mark Gibbs at NetworkWorldFusion (dated 12/10/03) is from about the same time period as the item linked by Max.

An archive item at My Search Bar is undated, but apparently goes back to about the time of the complaint linked to Max's post or even a little earlier (ca. 2000?):

[quote]
Overview
"My Search Bar" and the variants "My Way Speedbar" and "My Way Search Assistant", are browser helper objects that allows you to search on multiple search engines. The software is bundled with file sharing programs such as Morpheus. The search form is added to Internet Explorer under the default address field. The software might update itself without notice.

"The MySearch" and "MyWay" variants have been bundled with Grokster, Morpheus, WeatherBug, and software from mgshareware.com. MySearch has also been installed by the FavoriteMan parasite. The MyWeb variant is bundled with software (Popswatter, SmileyCentral, My Mail Stamp) from "Fun Web Products" (the same people as MyWay)."
[endquote]

From about the same time period as the warning from Max:

PowWeb from "CrocHunter." (1-5-04, 06:35 PM)

[quote]
I've been noticing alot of "FunWebProducts" (FWP) appearing in my access log - user agent strings lately. Like this: "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; FunWebProducts; .NET CLR 1.0.3705)"

Turns out FWP offer Smiley Central, PopSwatter, My Mail Signature, My Mail Stationery and My Mail Stamp, email "enhancers". All of these enhancers have inbuilt adware or hijackers. The unsuspecting user suffers slow IE speed, tags on all email and it takes over their browser. It can also damage the Windows enviroment.

Serves them right you say?.. wrong. Often they are simply unaware. And we as webmasters suffer to!. Bloated logs and repeated calls for help. In the above example my access logs alone jumped 300kb+ through one heavy user. If you spot FunWebProducts encourage the user to remove it."
[endquote]

A little further down, from "csramotorsports"

"I have been shut down for excessive resource abuse, and BAM! Sure nuff going through my log for today, I see FUNWEBPRODUCTS...Dangit! Shows up A LOT. I'm going to try to track this user. This is probably most definitely what pushed me over the edge today."

A fairly recent post from free-web-browsers identifies:

"My Search, MyWebSearch, My Web Search, My Way Speedbar, Speedbar, Popular Screensavers are trademarks of Focus Interactive, Inc. (www.funwebproducts.com). Smiley Central is a trademark of Focus Interactive, Inc. (www.smileycentral.com)."

So far as I've seen the "Focus Interactive" identification was not used with early versions. (Be careful how you pronounce "Focus" ????)

RECENT AND CURRENT versions of "Fun Web" products are not considered spyware by most organizations that work on defining what's acceptable. They have cleaned up their act considerably, and now publish a legible EULA and Privacy Statement. Both contain links to separate "incorporated by citation" terms, but the only essential "buried" agreement is the My Way Privacy Statement.

Agreement to install ANY Fun Web or My Way component constitutes an agreement to install MANY Fun Web components. The agreements allow them to install "other components" automatically, which is a somewhat questionable condition, but apparently has not been abused FOR CURRENT VERSIONS.

The newer versions of these products, when obtained from Fun Web, apparently do cause significant "program bloat" for individuals who use them, and slow down the user's machine; but the "performance hit" may be acceptable to those inclined toward such "cutesy toyware" – they probably don't know it happens.

The newer versions of these products, when obtained from Fun Web, do apparently cause some increase in server traffic load when people who visit have these products installed. In most cases the "traffic hit" is within tolerable limits. It remains possible that mudcat traffic is close enough to capacity that the increase causes a problem. It is also possible that the somewhat "different" site structure – perhaps the extremely high density of links on nearly every page - causes these programs to have a more severe effect at the 'cat.

It is unknown (by me at least) whether the Fun Web people still produce search engine components for bundling into other "products." It is certain that such products, using older "My Way/IWon" search engine versions, have appeared as components of other programs. The old IWon people exercised NO OVERSIGHT with regard to who used their "tools" or in what way, so even they likely don't know where a "Fun Web" or "My Way" identity may appear associated with other programs or utilities which may not identify themselves to a web site except as "Fun Web."

With the number of mudcat users who are still using Win98 (and older) systems, it is entirely possible that the "mudcat problem" comes from a user who has an IWon/My Way component as a bundled part of some forgotten program from 5 or 10 years ago.

Since Fun Web has "cleaned up its act" and is now no longer recognized as "Spyware" it is uncertain whether malware detection software will identify the older (and more likely malicious) versions. It's also possible that someone who really wants "cute" instead of "content" – and wants to label themselves as a "newby who needs gimmicks" could get rid of old versions and get "the new Fun Web stuff" – with some benefit to the rest of us. But that's just speculation.

Malware incorporated in OLD programs, particularly those associated with "search" and "file sharing" functions may still identify itself to a server as "Fun Web" or "My Way" or "Iwon" programs. Some of this stuff was in fact pretty nasty.

John

Subject: RE: BS: Mudcat problem (FunWebProducts)
From: Louie Roy
Date: 13 Apr 05 - 07:09 PM

Log into The Mudcat Help And Trouble page and read my comments as of April 8 05

Subject: RE: BS: Mudcat problem (FunWebProducts)
From: GUEST,Jon
Date: 13 Apr 05 - 07:17 PM

Interesting info John, thanks, I've just looked at the folkinfo logs and see I also have visitors there with it. I notice a couple of entries started at /songs. Even if it was just hitting that level, there would be 33 links to follow but the only actions/page requests I can see look like normal human action. eg. Someone with funweb went to the songs, then did a search for skinnermarinky + dink (whatever that is) and then logicaly decided to browse the letter S, had a quick browse of the forum and left. A computer action from /songs, even if just one level down was taken would lead to 33 links being followed. If that level was then followed like a spider, we would have some 650+ page requests (one per song) and then that multiplied by 7 (forum thread related to song, txt, abc, pnd, pgf and transpose)... Fortunately for me, nothing like that is happening...

Jon

Subject: RE: BS: Mudcat problem (FunWebProducts)
From: JohnInKansas
Date: 14 Apr 05 - 03:15 AM

Jon -

I don't really have much of a way to poke into it, but just from a look at the history of the IWon/MyWay/FunWeb products and distribution, I have to speculate that it's the earlier "search engine product(s)" incorporated into some other program or buried in another application that would be most likely to cause problems.

While the current Fun Web stuff is annoying, they have apparently tried to be a little more careful than they were when the IWon stuff first appeared. The few reports I've seen of the earlier distributions though would indicate that they don't know where the "modules" went or who's using them.

Although the current EULA and Privacy documents imply they won't (normally) use it, it does appear that the newer installations open a backdoor that would permit them to install other stuff (updates?) without the user's knowledge, and someone who incorporated an early version into something could certainly use the same opening for more invasive things - possibly while still looking like "Fun Web," but doing other/additional things - or just doing the same things badly.

John

Subject: RE: BS: Mudcat problem (FunWebProducts)
From: Nigel Parsons
Date: 14 Apr 05 - 03:57 AM

Jon:
Someone searching "skinnermarinky + dink " was probably after The Rich Man & The Poor Man"

Nigel

Subject: RE: BS: Mudcat problem (FunWebProducts)
From: GUEST,Jon
Date: 14 Apr 05 - 05:55 AM

Thank Nigel. Do you by any chance know where it came from? And have you got a tune?

As for the song, I googled after and don't think that was the one (s)he was looking for (we do have that in a forum thread but it's not been added to the song database as we only add if it's "traditional", we have a source and a tune). I think it would have been this:

Skinnamarink

Skinnamarinky dinky dink, Skinnamarinky doo,
I love you;
Skinnamarinky, dinky dink, Skinnamarinky doo,
I love you.
I love you in the morning and in the afternoon.
I love you in the evening underneath the moon.
Skinnamarinky dinky dink, Skiinnamarinky goo,
I love you.

Jon

Subject: RE: BS: Mudcat problem (FunWebProducts)
From: GUEST,Jon
Date: 14 Apr 05 - 05:58 AM

Opps, forget the tune. I can't see for looking. There is a dirty big "CLICK TO PLAY" in the dt...

Subject: RE: BS: Mudcat problem (FunWebProducts)
From: JohnInKansas
Date: 20 Apr 05 - 06:49 AM

For those still curious about what the "FunWeb" thing really is - no answers, but I've seen an increasing number of sites with "anti-robot" statements posted.

For the curious, the Web Guide Robot Policy is pretty typical. It doesn't name a specific robot program, but does indicate a continuing problem. Looking for comments/policies of this kind may be a better way to get an estimate of exactly what's going on - or at least of how big the problem is - than concentrating on the products that have been named.

A general Google for something like "bots" turns up a number of sites offering "do it yourself searchbot design" and many of these appear to incorporate "kernels" or core parts of existing programs. The older FunWeb products were widely distributed for embedding into other programs, so the identity may persist in DIY junk.(?)

Note: this was the shortest of the related threads up recently. No particular reflection on previous comments, or intent to revive them.

John