[RESOLVED] ATDMT.com (bad cookie)

[Suttonite12]

Hi all,

Just became a member of your site as i am pulling my hair out here trying to get shut of ATDMT.com, hopefully somebody will be able to point me towards a solution to get shut of this as i have tried everything and now it's infected my laptop too.

Forgive me if i am posting in the wrong place, but i thought i would say hello to the other members whilst i get used to the website

Regards.

[Train]

Using McAffe ?
http://vil.nai.com/vil/content/v_131993.htm

[Suttonite12]

Using McAffe ?
http://vil.nai.com/vil/content/v_131993.htm

Hi Train,

I am using Norton IS 2009 at the moment, plus i have spybot s&d, IObit 360 security & spywareblaster, malwarebytes. What confuses me is that most of the programs pick it up and remove it, but it re-appears once IE opens/Google Chrome. These programs have it blocked also however, i can only assume that there is possibly a file which activates when i open explorer for it to track what i am doing, so annoying this is and from what i have read it's a company called "Atlas Solutions".

Now would it be beneficial for me to post a combofix log & a hijackthis log for one of you experts to look at?.

Mcaffee i have access to (provided by my ISP as a freebie). If i remove Norton and use Mcaffe will that get rid off this adware/malware?.

Thanks guys any comments are appreciated.

Regards.

[Train]

Well, in your browser, do you have it set to allow 3rd party cookies.
If yes, change it to no.

http://utconline.utc.edu/online/third_party_cookies.php

Neither AV is worth a hoot in my book either.

[Train]

If you put a check in Blocked, this would then look like mine.

[Broni]

http://alenblog.wordpress.com/2008/1...yware-removal/

[HAN]

First, if the only thing that is showing up in scans on your PC are cookies from ATDMT, you are NOT infected with adware/malware. Cookies can be related to privacy issues but they are NOT security violations.

Norton Internet Security 2009 is better than anything McAfee. IMO, changing to McAfee would dramatically reduce your security!

The simplest way to ban cookies is either block them as already mentioned (ATDMT are almost always 3rd party cookies), or by listing the unwanted cookie websites in your HOSTS file.

[SpywareDr]

Add the following to your HOSTS file:

127.0.0.1  atdmt.com
127.0.0.1  att.atdmt.com
127.0.0.1  click.atdmt.com
127.0.0.1  clk.atdmt.com
127.0.0.1  image.atdmt.com
127.0.0.1  rmd.atdmt.com
127.0.0.1  spd.atdmt.com
127.0.0.1  spe.atdmt.com
127.0.0.1  switch.atdmt.com 
127.0.0.1  view.atdmt.com
127.0.0.1  www.atdmt.com

[HAN]

Doc: Thanks for the list!

[SpywareDr]

Doc: Thanks for the list!

No problem.

[Suttonite12]

Hi folks,

Thanks for all the info, it's appreciated.

To be honest i never thought about pinging the website and adding it to the Hosts file as i thought spybot s&d would have done that within it's immunise program.

ATDMT is a blocked program within spybot, so why have they not added it to the list?..

I will implement the changes you have suggested and thanks so much for the advice

Regards.

[Suttonite12]

Hi guys,

Blocking third party cookies has no effect and also trying to add ATDMT to the hosts file apparently is not permitted as the file path is incorrect

Any ideas guys?.

Regards.

[fink]

Do a file search for "hosts" that will get you the hosts file that you should be able to edit by opening in notepad. (not hosts.sam... that's a sample file.. hosts has no extension)

[Suttonite12]

Do a file search for "hosts" that will get you the hosts file that you should be able to edit by opening in notepad. (not hosts.sam... that's a sample file.. hosts has no extension)

Hi fink, thanks for your comments, i will try that. The actual Hosts file that i opened had all spybot search & destroys entries listed, however it would not allow me to enter any details.

Will let you know if i find any other Hosts files.

Regards.

[Suttonite12]

ok, there are various entries for a spywareblaster backup, but thats it!.

Surely i should be able to update the Hosts file when i have Administrator privilidges.

Regards.