Avast is reporting Malware on eBid

[TiasTreasures]

There was a thread about this in the Kitchen Table yesterday:
http://www.ebid.net/forums/showthrea...-I-access-eBid

I ran a virus full scan last night and nothing was found. I did have problems with eBid this morning, the first time I tried to open the site (on both FireFox and IE), I got "URL not found" messages.

I tried again an hour later and got a Wordpress screen with a non-existent URL. This has happened before, I have to turn off my computer, wait a few minutes, and open it again. It doesn't happen very often.

I don't know if either of these events have any connection to this report that I got from Avast about ten minutes ago.

================================================== ============

Infection Blocked.
URL hxxp://54.201.107.94/904445/0/3605/112542085/60220426/452014/0/0/0/1.ver?at=p&d=Post&ta=0&tp=100&vd=1&jf=0&jt=2&jsv=4 .5.0&oc=ADO&nc=0&num=0&sr=1525x858x24&tz=8&url=htt p%3A%2F%2Fus.ebid.net%2Fperl%2Faccount.cgi

Infection URL:Mal
Relax, your Avast just saved you from a virus.

================================================== ==========

[FirstGreenIsGold]

I haven't received any Avast threat messages today.

I don't know what that was all about. Maybe one of the ads?

[Posbear]

It's probably due to Malvertising..

http://en.wikipedia.org/wiki/Malvertising

https://blog.malwarebytes.org/malver...ising-attacks/

[suesjools]

Malvertising, good grief, what will they come up with next? Makes you wonder what's wrong with some people...

Best wishes for many sales to all,

[ZonkersCollection]

It is not a virus.
It is the link or bookmark.
(or maybe a virus changed the link or bookmark.)

================================================== ============

Infection Blocked.
URL hxxp://54.201.107.94/904445/0/3605/112542085/60220426/452014/0/0/0/1.ver?at=p&d=Post&ta=0&tp=100&vd=1&jf=0&jt=2&jsv=4 .5.0&oc=ADO&nc=0&num=0&sr=1525x858x24&tz=8&url=htt p%3A%2F%2Fus.ebid.net%2Fperl%2Faccount.cgi

================================================== ==========

=================================================

hxxp://flx407.lporirxe.com/flp/flifc.php?ver=1.4r1&qid=838363f5039363f5730343&cid =407&kqt=999&p=1&s=ebid.net&x=DC1&xc=&test=&od1=&o d2=&tx=805&wf=88&pt=0&ptt=2&irf=http%3A//us.ebid.net/perl/account.cgi%3Fsuccess%3DN%26mo%3Daccount-closed

================================================

Those are not links to ebid.

They send your browser to the MALsite first
hxxp://54.201.107.94/904445/0/3605....
hxxp://flx407.lporirxe.com/flp/flifc.php.....
Whoever they are?
And then redirects to ebid, without you knowing you've been hijacked.

Only the url=http:// part is ebid

Delete your ebid bookmarks and start over with this:
http://us.ebid.net/

[TiasTreasures]

Aha! Thank you. So Avast was doing its job, found a virus (or in this case, Malware), and blocked it.

But it was in my Bookmarks, not eBid.

I took your advice, deleted all of my eBid Bookmarks, recreated them, and the problem hasn't occurred again.

[FirstGreenIsGold]

I did the same thing. I deleted my eBid bookmarks in Firefox and now it seems fine.

[JimmyCee]

Very interesting
Thanks for your thoughts, I never gave bookmarks a consideration

[ZonkersCollection]

OK, so now that you are aware of the evil redirects. I need to point out that not all redirects are evil.

For example, on my website, most links pass through CCBill, a billing agent.
h++p://refer.ccbill.com/... ...&HTML=h++p://www.site-you-want
"Site-you-want.biz" uses CCBill to keep track of who gets the commissions on sales sent to them by folks like me.
Harmless to you. Important to me.

EBid links should not have any redirects, since paypal or whoever does the billing.

On the flip side, ANY link to DoubleClick or clickZs is ALWAYS evil.

Also note that in some posts http has been changed to h++p or hxxp, to make those links un-clickable.
Don't bother looking for h++p or hxxp in your actual bookmarks.