Tumri.net

AOL email user (software installed) with tumri.net taking over when I open any email. Been a problem 2 days now. Have tried many options with no positives. Lousy email likely infected my main desk and when I tried a work around ,its now rampant on my lap. You guys got me clean 3 weeks ago on a browser redirect , hope tou can help me here. OTL log attached, I hope..

Hi, Club210.

It appears you are already receiving help from Essexboy. As indicated in the thread that Essexboy is helping you with here and what I've read others using AOL email, the problem appears to be with the AOL software.

Getting help from multiple sources seemed a good idea as things had stalled considerably with essexboy and I had great success here previously. It does seem to lie in the software. This morning both my laptop and main appear to be free from infection after a reboot. I am uninstalling the software and using AOL on the net vs. the Desktop version. Thank you for your attention.

Please understand that we are volunteers, in different countries/time zones, and not expected to respond 24/7. Not only was Essexboy providing help to you at the other forum, he is on staff both here and at GTG. So, you very likely would have seen him again here. Anyway, based on conversations with others using the AOL client, it does appear that is the problem. With the hope that he still has contacts at AOL, I have sent an e-mail to a friend who was one of the original AOL employees and managed the software development and user experience for many of the AOL products, also serving as consultant for many years after leaving AOL. If he is able to provide any information, I will let you know.

Clearly a small world. My issues appear to have subsided as I am no longer accessing the putitive culprit site through my desktop software and all is good. Thanks again for your help. If any info becomes available on this topic I would certainly be grateful if you pass it on .

Following is the information from Bill, who as I indicated previously, was one of the original AOL employees and is the developer of WinPatrol (my favorite system monitor):

I use the AOL client daily and typically read a couple dozen emails a day. I haven't run into anything related to tumri.net or any similar attacks. I see the same ads in the Email window so it doesn't sound like some advertiser snuck something past them. I doubt it comes with AOL especially because reinstalling fixed the problem but I wouldn't be surprised if it targeted AOL.
During the best of its time AOL was the largest platform for attack. Even before spyware and adware were known terms AOL was a target of very sophisticated "password surfers". Just like we see now on Facebook and Twitter the easiest way to distribute malware is for it to come from a trusted friend or associate. The first step is to own someone else's account.

WinPatrol was actually created in response to an AOL password stealer that added different randomly named programs to three different startup locations. It even used the old Win.ini load= command but proceeded the filename by 200 spaces so it wasn't obvious if you just viewed the win.ini file.
The delivery used an OLE object embedded in what appeared to be a text file. Some may remember if you tried to open a text file that was to large for notepad, Windows would offer to open it in WordPad. WordPad supports OLE and before I lifted my finger off the mouse when I clicked OK, I knew I was toast. The files came from a trusted friend who had obviously had their password stolen by the same attack. The text of the mail was something that made sense and didn't have grammar or spelling errors.

When I called AOL support they insisted the only solution that would allow me to get back online was to format my hard driver. Obviously I said, #$%& that and WinPatrol was born. That was the last time I ever fell victim to what is now called a social based infection.

Bill

Thanks for the update. I'll keep WinPatrol in mind.

You're welcome!