Re: Spyware in Live mail, messenger etc

[Crosspost to Windows Live Mail & Messenger newsgroups]

The cookie is harmless. That being said, you could disallow such cookies if
you wish:

IE Tools | Internet Options | Privacy | Sites: type in...

atdmt.com

and press the BLOCK button.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002


Japio wrote:
> Hello.
> I hope i am in the right place to ask for help.
> Since new installation of Windows XP Home sp 3 and later Windows Live
> Mail,
> Messenger, etc. I am receiving a cookie jaap@atdmt{1} or (2}.
> My virusscanner (Panda) removes it everytime when i start one of the Live
> programms. I have checked al lot of programms, but it just happens with
> Live
> progs. Maybe it is not dangerous but it nerves me.
> When i scan my computer in Safe mode with Panda or in normal mode with
> Panda
> or for exemple Superantispyware nothing is found about ATDMT.
> Is there a possibility to avoid this cookie, do I have to reinstall the
> Live
> components of is there something else I can do?
>
> I would be happy is someone could tell me some more.

PA Bear [MS MVP] wrote:

> [Crosspost to Windows Live Mail & Messenger newsgroups]
>
> The cookie is harmless. That being said, you could disallow such cookies if
> you wish:
>
> IE Tools | Internet Options | Privacy | Sites: type in...
>
> atdmt.com
>
> and press the BLOCK button.

And here is an example of PA Bear cross-posting to an unrelated
newsgroup. Cookies have nothing to do with either the Windows Live Mail
e-mail client or the Messenger prattle client. Even PA Bear's reply
shows that he cross-posted to the wrong groups: he cross-posts from a
security group to the WLM and WM groups but his response says to change
configuration for the IE. Cookies might be considered a security issue
by some users. The forced wandering of posts to become off-topic
through unsolicited cross-posting by PA Bear degenerates a bit more. It
starts, it continues, and it gets worse.

Original newsgroups: microsoft.public.security.homeusers
Added newsgroups: microsoft.public.windows.live.mail.desktop,
microsoft.public.windows.live.messenger
Effector/Respondent: PA Bear

This is to warn that Effector has copied [only a subthread of] an
existing discussion to other groups by cross-posting their reply to
groups not originally specified by the OP (original post[er]). There
may be additional replies back under the original post in its original
group(s) than just those shown under the subthread for the Effector's
cross-posted reply. If the OP and others wish to ensure that they see
ALL replies then they must visit the original groups to check if there
are subthreads *other* than under the Effector's reply.


<rant_start>
If the OP wishes to move or copy their discussion to another group, that
should be *their* choice and not as an UNSOLICITED action enforced by
another *user*. Despite his pretense, the Effector is not a moderator
or admin but just another user who is propagating the OP's discussion to
different group(s) that he has divined are more appropriate and to
enlarge the audience or hopefully provide a more focused community on
the topic but which may not be a correct action (since the source of the
problem may not be relevant to those other groups simply based on where
the OP reported the symptoms). If the OP wants to move or copy their
discussion to another group, that should be THEIR choice and not of the
Respondent. The Respondent should only recommend to the OP that there
may be more appropriate or useful groups to which the OP should repost
or cross-post their message, not enforce the propagation of the OP's
discussion to other groups.


There are times when the Newsgroups header should be modified to a
different set of groups than was originally specified by the user.
Examples are: using a *.test group to redirect negative or expository
replies into the bit bucket (common with spammers or trolls); removal of
completely unrelated groups (i.e., the OP cross-posted to invalid
groups), an attempt to flame a smaller community or low-bandwidth group
with a rash of replies from other groups (i.e., an intentional attempt
to vengefully or maliciously flood forward into other groups), inclusion
of *.kook or other groups with the intention to flame the other groups
with the inflamed responses (i.e., attempt to flood backward into other
groups), responding to a spam exhibit or announcements but discussions
about them belong in another group, and so on. A misguided need to
enlarge exposure for a discussion based on a choice made by the
Respondent is not an adequate reason to alter the Newsgroups header.


Recommend the OP should move. Do not SHOVE them over. It should be the
OP's choice in what communities to focus on their post, not a forced
change made by the Respondent.
<rant_end>

^_^ Amen....

"VanguardLH" <> wrote in message
news:h4g6hv$6f6$...
> PA Bear [MS MVP] wrote:
>
>> [Crosspost to Windows Live Mail & Messenger newsgroups]
>>
>> The cookie is harmless. That being said, you could disallow such cookies
>> if
>> you wish:
>>
>> IE Tools | Internet Options | Privacy | Sites: type in...
>>
>> atdmt.com
>>
>> and press the BLOCK button.
>
> And here is an example of PA Bear cross-posting to an unrelated
> newsgroup. Cookies have nothing to do with either the Windows Live Mail
> e-mail client or the Messenger prattle client. Even PA Bear's reply
> shows that he cross-posted to the wrong groups: he cross-posts from a
> security group to the WLM and WM groups but his response says to change
> configuration for the IE. Cookies might be considered a security issue
> by some users. The forced wandering of posts to become off-topic
> through unsolicited cross-posting by PA Bear degenerates a bit more. It
> starts, it continues, and it gets worse.
>
> Original newsgroups: microsoft.public.security.homeusers
> Added newsgroups: microsoft.public.windows.live.mail.desktop,
> microsoft.public.windows.live.messenger
> Effector/Respondent: PA Bear
>
> This is to warn that Effector has copied [only a subthread of] an
> existing discussion to other groups by cross-posting their reply to
> groups not originally specified by the OP (original post[er]). There
> may be additional replies back under the original post in its original
> group(s) than just those shown under the subthread for the Effector's
> cross-posted reply. If the OP and others wish to ensure that they see
> ALL replies then they must visit the original groups to check if there
> are subthreads *other* than under the Effector's reply.
>
>
> <rant_start>
> If the OP wishes to move or copy their discussion to another group, that
> should be *their* choice and not as an UNSOLICITED action enforced by
> another *user*. Despite his pretense, the Effector is not a moderator
> or admin but just another user who is propagating the OP's discussion to
> different group(s) that he has divined are more appropriate and to
> enlarge the audience or hopefully provide a more focused community on
> the topic but which may not be a correct action (since the source of the
> problem may not be relevant to those other groups simply based on where
> the OP reported the symptoms). If the OP wants to move or copy their
> discussion to another group, that should be THEIR choice and not of the
> Respondent. The Respondent should only recommend to the OP that there
> may be more appropriate or useful groups to which the OP should repost
> or cross-post their message, not enforce the propagation of the OP's
> discussion to other groups.
>
>
> There are times when the Newsgroups header should be modified to a
> different set of groups than was originally specified by the user.
> Examples are: using a *.test group to redirect negative or expository
> replies into the bit bucket (common with spammers or trolls); removal of
> completely unrelated groups (i.e., the OP cross-posted to invalid
> groups), an attempt to flame a smaller community or low-bandwidth group
> with a rash of replies from other groups (i.e., an intentional attempt
> to vengefully or maliciously flood forward into other groups), inclusion
> of *.kook or other groups with the intention to flame the other groups
> with the inflamed responses (i.e., attempt to flood backward into other
> groups), responding to a spam exhibit or announcements but discussions
> about them belong in another group, and so on. A misguided need to
> enlarge exposure for a discussion based on a choice made by the
> Respondent is not an adequate reason to alter the Newsgroups header.
>
>
> Recommend the OP should move. Do not SHOVE them over. It should be the
> OP's choice in what communities to focus on their post, not a forced
> change made by the Respondent.
> <rant_end>

On Sun, 26 Jul 2009 16:42:40 +0800, Milo wrote:

> ^_^ Amen....

The only saving grace of your post is that you top posted. Full quoting just
for a AOL-style, "me too" post? You would have done better not to trim it.
Best if you had not responded.

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

^_^...

"N. Miller" <> wrote in message
newsr786bqvoqp7$....
> On Sun, 26 Jul 2009 16:42:40 +0800, Milo wrote:
>
>> ^_^ Amen....
>
> The only saving grace of your post is that you top posted. Full quoting
> just
> for a AOL-style, "me too" post? You would have done better not to trim it.
> Best if you had not responded.
>
> --
> Norman
> ~Oh Lord, why have you come
> ~To Konnyu, with the Lion and the Drum

Not true...

Close IE, close WLM, close WLMsgr..clear your cookies, and open WLM...at least 4 or 5 cookies will appear
- bing.com, windowsmarketplace.com, zune.net, msn.com and on some systems **atdmt.com**

It does not matter is a Live ID is used to sign on to Windows Live in WLM or not..


--
...winston
ms-mvp mail

"VanguardLH" <> wrote in message news:h4g6hv$6f6$...
Cookies have nothing to do with either the Windows Live Mail
> e-mail client or the Messenger prattle client.

On Mon, 27 Jul 2009 06:05:39 +0800, Milo wrote:

> ^_^...

It isn't that top posting is better than bottom posting; rather that by top
posting a full-quoted body of text just to be an AOLler saves people from
reading the whole shebang just to find a "me too" at the end. :P

--
Norman
~Oh Lord, why have you come
~To Konnyu, with the Lion and the Drum

N. Miller wrote:

> It isn't that top posting is better than bottom posting; rather that by top
> posting a full-quoted body of text just to be an AOLler saves people from
> reading the whole shebang just to find a "me too" at the end. :P

Probably would've meant more if you told Milo to trim the quoted reply
(which is relevant whether top- or bottom-posting).

....winston wrote:

> Not true...
>
> Close IE, close WLM, close WLMsgr..clear your cookies, and open WLM...at least 4 or 5 cookies will appear
> - bing.com, windowsmarketplace.com, zune.net, msn.com and on some systems **atdmt.com**
>
> It does not matter is a Live ID is used to sign on to Windows Live in WLM or not..

I will test for this in a virtual machine. Would be strange if an
e-mail client needs cookies for anything (before opening any HTML
e-mails which might've been from where they came).

....winston wrote:

> Not true...
>
> Close IE, close WLM, close WLMsgr..clear your cookies, and open
> WLM...at least 4 or 5 cookies will appear - bing.com,
> windowsmarketplace.com, zune.net, msn.com and on some systems
> **atdmt.com**
>
> It does not matter is a Live ID is used to sign on to Windows Live in
> WLM or not..

In a virtual machine containing a fresh install of Windows XP Pro SP-3
(with IE7) + all Windows updates + no applications:

- Went to http://download.live.com/ to get Windows Live Mail (WLM). Of
course, Microsoft does not permit installing just WLM so I had to:
o Click the "download" link.
o Download the wlsetup-web.exe file and run it.
o Deselect everything except WLM (i.e., uncheck Messenger, Photo
Gallery, Toolbar, Writer, Family Safety, & Silverlight).
o Click the Install button.
o Unchecked the "Set your search provider" (to Live Search) and "Set
your home page" (to MSN) options at the end of the install. The
"Help improve Windows Live" option was already unchecked.
o Did NOT signup my Live Hotmail account (wanted to first start WLM
with no accounts defined).
- Uninstalled the ancilliary crap included in the WLM install which are
*not* part of WLM, which include:
o Windows Live Update Tool
o Windows Live Sign-In Assistant
o Can no longer get rid of other ancilliary programs that used to be
listed separate of WLM because now WLM is rolled under the "Windows
Live Essentials" package.
- Emptied the TIF folder.
- Checked there were no .txt cookie files in %userprofile%\Cookies.
- Loaded WLM. Cancelled creating an e-mail account within WLM.
- No files added/created in TIF or Cookies folders. (An .xml file for
Messenger got added to TIF folder but Messenger wasn't installed and
this isn't a cookie file, anyway).
- Added a POP3 e-mail account to WLM. This was at my ISP, *not* at Live
Hotmail.
o 4 old e-mails got retrieved from this non-Hotmail POP account.
o Still no files added to TIF and Cookies folders.
- Added a Live Hotmail account to WLM. This was using POP3 to access
the Hotmail account (not HTTP/Deltasync).
o No TIF or Cookies files yet.
o Polled my Hotmail account (via POP). No e-mails to retrieve from
there but wanted to see if WLM created files in TIF and Cookies
folders.
o No files added to TIF or Cookies folders.
o Sent myself a test e-mail (from my ISP e-mail account) to my Live
Hotmail account.
o Retrieved the new e-mail using WLM.
o Still no files added to TIF or Cookies folders.
- Deleted Hotmail account (POP access) and created a new account for
Hotmail using Deltasync.
o Now WLM does an automatic sign-in using my Live ID (although I did
not want it to sign in).
o The same test e-mail as before gets retrieved (because it is seen as
a new e-mail under the other and new Hotmail account defined in
WLM).
o Now cookies files were added (as pointers in TIF folder to the real
.txt files in the Cookies folder). They were for MSN and Live
domains. No other cookies.
- Decided to see if it is possible to retrieve e-mails using Deltasync
in WLM without also logging into Live ID account. That is, *not* have
WLM log into my Live ID (since the login credentials for the e-mail
accounts defined within WLM should be sufficient to actually do ONLY
an e-mail poll of my Hotmail account).
o In WLM, go to Tools -> Connection and clicked "Stop signing in"
button.
o Cleared the TIF folder (which also deleted the real .txt cookie
files in the Cookies folder).
o Sent a new test e-mail to my Hotmail account.
o Polled my Hotmail account (using Deltasync) in WLM.
o Test e-mail got retrieved into WLM.
o No files added to the TIF and Cookies folders.

So WLM will generate cookies if you have it automatically log into your
Live ID account which is not required to only use their e-mail service.
WLM does not auto-configure itself (i.e., without ever prompting for
permission by the user) to login to the user's Live ID account unless
the user adds a Hotmail account AND uses Deltasync to access that
Hotmail account. From my testing, it DOES matter whether or not WLM
logs into the user's Live ID account. No cookies were generated *until*
WLM logged into my Live ID account.

I did not test further to find out when using a Live Hotmail account via
HTTP/Deltasync and with WLM auto-logging under your Live ID might
generate a cookie for ATDMT, Bing, Windows Marketplace, or Zune. Under
the right setup, WLM will create some cookies. As I mentioned to the OP
under the *ORIGINAL* newsgroup to which the OP posted (and not under
this unsolicited cross-posted subthread), doing anything with Microsoft
can incur references to ATDMT since Microsoft uses them for tracking
downloads and gathering demographic information.