tumri.net AOL popup malware

LilBambi

LilBambi

BSOD Kernel Dump Senior Analyst
Joined
Apr 17, 2012
Posts
292
Location
Virgina, USA
This turned out to be a very strange one. tumri.net is an old piece of crapware, but it appears to have a newer twist.

A client has the latest version of AOL. He has used AOL for the 20 +/- yrs and never had anything bad installed through AOL so he never was interested in using anything else.

Recently though, his bank told him that AOL was not secure enough, and that he should try using Firefox or Google Chrome if he wants to use online banking.

He also last night was looking at emails from folks he gets emails from frequently and ended up getting constant popups from tumri.net plus a ton of local to him places.

I blocked the site within every browser, but had to block it via host file (127.0.0.1 tumri.net) for it to work in AOL.

But that was was only partially successful; prevent the content, but the popups themselves continued every 5 seconds as before in AOL.

It did not do that in any other browsers.

That is the backdrop of today's mess.

I tried various tools: Malwarebytes Antimalware, aswMBR.exe, JRT, the client's ESET NOD32 scanner, Kaspersky's TDSSKiller, Combofix, CCleaner, Oldtimer's OTF for deeper cleaning.

I read all the logs and there was nothing that any of them found that would cause the problem. aswMBR, Malwarebytes, ESET's NOD32, and TDSSKiller found absolutely nothing.

I checked the processes and nothing looked amiss.

What it finally came down to was uninstalling AOL completely and downloading it fresh and reinstalling it. That took care of it. And he was very happy in the end.

Between this problem today, and what his bank said, he is now willing to move to another browser where we could install Adblock Plus with Malware Domains enabled in Adblock Plus, and WOT.

He used web based AOL email before when traveling so it worked out well. He has a lot of work to do to get all his hundreds of Favorites moved over to the other browser but hopefully he will be happy enough with his alternative browser to keep himself safer.

I think it came from an email, possibly from Yahoo. It is also possible that we had it fixed, until he opened the email from yahoo again each time. There's no way to be sure on that. Except to open it again in the newly installed AOL and neither of us are going to try that.

The yahoo email doesn't do anything in the new browser with that domain blocked six ways to Sunday, and he is very happy about that.

I think there is a very good chance that it modified some dll for AOL's network sock because Combofix actually removed it's networking and it had to be re-installed after Combofix reboot but apparently either it re-installed after the email was reopened or it really needed a full uninstall and re-install of AOL to fix it.
 
Yes, it is very difficult for those that have never known anything else and can't imagine not using it. He is in his 80s and can sometimes be difficult to teach old dogs new tricks.

It was awesome that he finally decided it was worth it!
 
A quick search for "tumri.net AOL" shows that your client is not alone. As Essexboy said after cleaning the other malware from the computer here and the person reported that Tumri.net opens even before opening the mail component in AOL:

OK so it is related to the way the e-mail client runs in AOL. Looks like they have been hacked again
Click to expand...
 
Yep, he found that it was doing the same thing.

Uninstalling AOL and reinstalling AOL is the only thing that worked. Nothing else did.

Of course, I got him using his AOL email from AOL.com now instead. It seemed that it was Yahoo that was hacked, but it could have been AOL software for sure.

And from the topic you posted, likely so.

Thanks!
 
He is in his 80s and can sometimes be difficult to teach old dogs new tricks.
Click to expand...
Especially when they have no desire to learn something new. I went through the same thing with my parents and AOL.
 
I should revise my first posting. I forgot that JRT did find several things and removed them, but when he went back into AOL and looked at the email again, it appeared that those things did not take care of it. But as I mentioned earlier, it appears that the yahoo emails may have been what infected AOL software.

I talked to him today since he has been using AOL.com in another browser for email with Adblock Plus with Malware Domains and tumri.net manually added in the custom urls, (I also as noted added it to the HOST file), and WOT, no more issues even with existing yahoo emails that no longer have all that yahoo crap at the bottom of the emails.

The only thing that is frustrating to some degree and he knows that will end in time, when he tries to go to a new website that is in AOL but not yet in his alternative browser, it is frustrating to have to go get his favorite (copy, paste, then save it). I told him I knew that was frustrating but that too will end soon enough once he gets them all copied and saved to the alternative browser.

He knows not to use AOL for any email. And I think that is why it didn't come back after we uninstalled and reinstalled AOL software.
 
You know that VirusTotal URL Scanner and Sucuri SiteCheck say that tumri.net is not infested with malware. Very frustrating given the problems folks have had with this.

So have they cleaned up their act overnight? Or is this whole thing a malware purveyor that hacked AOL via some sort of email such as from Yahoo, etc. that is trying to make money off tumri.net advertising?
 
In all the threads I've read, the issue with tumri.net is not restricted to any email provider so nothing to do with Yahoo mail. Rather it is the AOL client software. From all reports, there are no issues when accessing mail via the AOL web interface.
 
Good to hear. At least AOL users can can get their email safely somewhere.

The odd thing is that the software's vulnerability is being triggered by something either in their email or by their surfing of certain compromised sites since not everyone using AOL software is experiencing this. I have several clients that are on AOL that still use AOL software and this was the only one with this issue.
 
I use the AOL client daily and typically read a couple dozen emails a day. I haven't run into anything related to tumri.net or any similar attacks. I see the same ads in the Email window so it doesn't sound like some advertiser snuck something past them. I doubt it comes with AOL especially because reinstalling fixed the problem but I wouldn't be surprised if it targeted AOL.
During the best of its time AOL was the largest platform for attack. Even before spyware and adware were known terms AOL was a target of very sophisticated "password surfers". Just like we see now on Facebook and Twitter the easiest way to distribute malware is for it to come from a trusted friend or associate. The first step is to own someone else's account.

WinPatrol was actually created in response to an AOL password stealer that added different randomly named programs to three different startup locations. It even used the old Win.ini load= command but proceeded the filename by 200 spaces so it wasn't obvious if you just viewed the win.ini file.
The delivery used an OLE object embedded in what appeared to be a text file. Some may remember if you tried to open a text file that was to large for notepad, Windows would offer to open it in WordPad. WordPad supports OLE and before I lifted my finger off the mouse when I clicked OK, I knew I was toast. The files came from a trusted friend who had obviously had their password stolen by the same attack. The text of the mail was something that made sense and didn't have grammar or spelling errors.

When I called AOL support they insisted the only solution that would allow me to get back online was to format my hard driver. Obviously I said, #$%& that and WinPatrol was born. That was the last time I ever fell victim to what is now called a social based infection.

Bill
 
bu
t I wouldn't be surprised if it targeted AOL.
Click to expand...
That's what I was thinking. And also that tumri.net was legit but that malware often masqueraded as it.

WinPatrol was actually created in response to an AOL password stealer
Click to expand...
That sure dates WinPatrol, huh? Interesting read - thanks! :)
 
Thanks, Bill! I appreciate that you took the time to respond to my inquiry.
 
You are welcome, Corrine! ;)

You would think with "Bill" being such an uncommon name there could never be two Bills in the same thread! ;)
 
:lol: You got me.

After LilBambi's post and then seeing a bunch of the same "tumri.net AOL" bit posted elsewhere within the past few days and knowing his long-time former connection to AOL, I sent Bill Pytlovany an email (ok, so it was several emails but who's counting?).
 
You know I love you, Corrine - so I just had to give you a hard time to show it! ;)
 
Thank you Bill P., I really appreciate your input and thank you Corrine for emailing him!

What a story about how WinPatrol got it's start! Very cool! Oh, boy, do I remember those things that injected crap into the Win.ini and sometimes even the system.ini in addition the computer folders. Grrrr! Kinda the precursor to the Registry. Now they litter the Registry as well as the folders with crap.

It's amazing the start we all got into this side of computing. I have talked about my start before and may put it in a topic here one day too.
 
You must log in or register to reply here.

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top