Every time I visit Ebay site, when using Firefox (at Ebay), I continue to randomly be prompted to download a file titled "firefox-patch.js" despite NEVER asking or clicking on anything to prompt this, simply loading Ebay at an random given time, and also a fake Firefox page (which looks very authentic) is automatically opening a new tab in my browser, circumventing my popup blocker and security software. I have confirmed with Mozilla/Firefox and reported the issue to Norton Small Business, as this continues to be a problem In reaching out to Mozilla support, I am informed that this and others are surely fake, and pose a threat to security - such as Trojans, worms and other malware which seems only to happen when at Ebay. I have confirmed, these threats (which have been confirmed as fake and security risks) with Mozilla and have had Symantec perform several scans and investigate that this has not actually successfully infiltrated my systems, however every time I visit ebay, these or similar attacks are occurring; and per Mozilla support they are receiving several reports every day regarding these attempted attacks.
The last two potential threats that nearly have circumvented my security (fortunately, I have been cautious after noticing that they were suspicious due to the URLS) are from the following:
Threat Source URL or Spoofed URL: https://kahdacitylinkexpress.org Incident URL: https://kahdacitylinkexpress.org/2571196760355/7b393ecf118dc15d4f6e925feea6ab53/13f5cda28c1df11a7536ab141ede954.htm
Threat Source URL or Spoofed URL: https://ohgeifrommymama.org Incident URL: https://ohgeifrommymama.org/4511196760355/128000dfb0f3957954e96e6a8152c861/a7cf6027104131b46f4795a97a9c3532.html
EBAY MUST ADDRESS THIS MATTER AS IT IS CAUSING ALARM AND OUR COMPANY NOW QUESTIONS WHETHER OR NOT EBAY IS A SAFE MARKETPLACE AS THUS FAR, THIS IS ONLY OCCURRING WHILE AT EBAY!
Please, we respectfully request that your security department attempt to stop these attacks, as it has been happening fairly regularly, despite the attacks appearing to being somewhat random. The only certainty we have experienced is: IT SEEMS IT IS ONLY OCCURRING WHILE ON EBAY! We have reported this issue to Mozilla, Norton/Symantec (NSB) and Ebay.
We kindly ask that this matter be investigated, and please note, we have reported this to Mozilla and to Symantec to help warn customers of a potentially serious risk.
Kind Regards, Rmzey Z Allen, Owner RZC, RZ-Xchange
Additional System Details
- Intel web components updater - Installs and updates the Intel web components
- Adobe PDF Plug-In For Firefox and Netscape 11.0.17
- Adobe PDF Plug-In For Firefox and Netscape 15.20.20039
- Creative Cloud Desktop Plugin.v_3_0_0_0
- Battlelog Game Launcher (2.6.2)
- Google Update
- Happy Cloud Web Plugin
- NPRuntime Script Plug-in Library for Java(TM) Deploy
- Next Generation Java Plug-in 11.31.2 for Mozilla browsers
- Office Authorization plug-in for NPAPI browsers
- The plug-in allows you to open and edit files using Microsoft Office applications
- NVIDIA 3D Vision Streaming plugin for Mozilla browsers
- NVIDIA 3D Vision plugin for Mozilla browsers
- The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
- Raidcall plugin
- SentryBay Update
- Shockwave Flash 23.0 r0
- iTunes Detector Plug-in
- User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
Thank you for your post. We are aware of these fake updates and were urge people to take care and make sure that they update Firefox and use anti-malware software.
As per your post, it looks like advertising on an ebay site has become infected, at least temporarily and hopefully ebay will remove this infection soon.
Thank you. I am aware that you are also aware, however I wanted to post the new information and thank you for your prompt reply. Only through awareness will people be able to protect themselves. Symantec was happy to receive the initial reports and tickets that I filed so they could get this out to their users as well. Thanks again.
Corrected URL - (html not htm site)
WARNING THE FOLLOWING URL AND ASSOCIATED DOWNLOADS MAY CONTAIN MALWARE AND POSES A THREAT. IF YOU LOAD THIS PAGE, WE STRONGLY URGE THAT YOU BE AWARE, IT MAY ATTEMPT TO DOWNLOAD A FILE - DO NOT ACCEPT THIS FILE, BY HITTING CANCEL, IF IT APPEARS AND AS WELL, IT MAY CIRCUMVENT YOUR POPUP BLOCKER.
Corrected URL - (html not htm site) https://kahdacitylinkexpress.org/2571196760355/7b393ecf118dc15d4f6e925feea6ab53/13f5cda28c1df11a7536ab141ede954.html
Also, You may have ad / mal-ware. Further information can be found in the Troubleshoot Firefox issues caused by malware article.
Run most or all of the listed malware scanners. Each works differently. If one program misses something, another may pick it up.
Would be best to stay as one thread on this subject /questions/1143060