ebay virus'??? can anyone confirm??

Discussion in 'other anti-virus software' started by zfactor, Apr 4, 2008.

Thread Status:
Not open for further replies.
  1. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,012
    Location:
    on my zx10-r
    is there a place i can upload this page to so i can know for sure if this does contain a virus...

    hxxp://motors.search.ebay.com/_W0QQsassZhidwholesale88//motors.search.ebay

    (please do not click on this if you are not comfortable with doing so) this as well as many other pages now come up with a fraud.gen trojan?? can anyone confirm this? i have sent these to ebay about a week ago and they still seem to come up with the same trojan alert. this was from kaspersky and avira...

    id like to inform ebay directly but their live chat simply gave me a link to send it to which doesnt look like it helped unless it is a fp.. thanks

    edited the link please change the xx to tt to try the link...
     
    Last edited: Apr 4, 2008
  2. lodore

    lodore Registered Member

    Joined:
    Jun 22, 2006
    Posts:
    9,006
    nothing popped up here using opera on vista with kis7.0 125 lastest defs.
     
  3. Banshee

    Banshee Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    543
    I clicked on that link but Avira Sec. Suite didn't complain at all.
     
  4. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,012
    Location:
    on my zx10-r
  5. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,012
    Location:
    on my zx10-r
    hmm just tested with bitdefender i have on another systems and i get the same message?? i run kis .325 right now here.

    here is another one that does the same [noparse]http://search.ebay.com/ebaymotors/_W0QQsassZhidwholesale88[/noparse]
     
  6. solcroft

    solcroft Registered Member

    Joined:
    Jun 1, 2006
    Posts:
    1,639
    Have you considered the possibility of an ARP attack?
     
  7. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,012
    Location:
    on my zx10-r
    not till you just said that...hmmm.. thanks ill look more into that

    well question then.. this does it at home or here on 2 different wireless networks..and it also only does it on few select ebay pages. no where else?? i know sometimes arp spoofing is used in some situations for places that allow users to connect to their wireless network but this is out own network which is constantly monitored by kis and i run bitdefender and nod as backups...??
     
    Last edited: Apr 4, 2008
  8. Banshee

    Banshee Registered Member

    Joined:
    Nov 10, 2004
    Posts:
    543
    I clicked on this one too.Nix, nada, zilch.
     
  9. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,012
    Location:
    on my zx10-r
    hmmm wel then i guess i need to look more into this.. thanks
     
  10. trjam

    trjam Registered Member

    Joined:
    Aug 18, 2006
    Posts:
    9,057
    Location:
    North Carolina
    checked it with Mcafee here at work and no issues. Nada, zilch.;)
     
  11. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,012
    Location:
    on my zx10-r
    i am running firefox 3 beta 5 here wonder if it could be that??
     
  12. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,012
    Location:
    on my zx10-r
    hmm just had one of my neighbors in the next business try it with kis (.325) and they get the same pop up i get? maybe the verizon then?? not sure. how do i send this to kaspersky (dont see a way to do that) to see if its a real threat?? im doing a full scan now and ill try that with bd, kis and nod and se if they find anything on the system now..this is what it states in kis:

    detected: Trojan program Trojan-Spy.HTML.Fraud.gen (modification) URL: hxxp://motors.search.ebay.com/_W0QQsassZhidwholesale88//motors.search.ebay

    thanks again btw
     
  13. lodore

    lodore Registered Member

    Joined:
    Jun 22, 2006
    Posts:
    9,006
    kis7.0 detects the same trojan and blocks it with webav if i use that direct link.
     
  14. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,012
    Location:
    on my zx10-r
    well then i feel somewhat better knowing its not just me, still sucks for people if this is a real threat on ebay
     
  15. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,012
    Location:
    on my zx10-r
    not sure if its a fp or not.. for me here bitdefender found it as well as nod?? so i assume its not.. but ....
     
  16. lodore

    lodore Registered Member

    Joined:
    Jun 22, 2006
    Posts:
    9,006
    would the detected new variant of trojan program trojan-spy.html.fraud.gen indicate a heristic detection?
    just working from the new variant part?
     
  17. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,012
    Location:
    on my zx10-r
    good question not sure i keep hueristics set to medium all the time and high for a full scan.. ??

    i will say ebay basically does not care about this.. at least from talking with them..
     
  18. lodore

    lodore Registered Member

    Joined:
    Jun 22, 2006
    Posts:
    9,006
    i have heristics set to high in every module.
     
  19. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,012
    Location:
    on my zx10-r
    i would normally but here at the office i have people that do not know what a fp is lol.. i dont want things getting deleted if they are fp's..
     
  20. lodore

    lodore Registered Member

    Joined:
    Jun 22, 2006
    Posts:
    9,006
    update kav and go to link again.
    i did about two secs ago and it says the user id entered no longer exists.
    maybe ebay deleted the member because of something bad emebeded in the page?
     
  21. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,012
    Location:
    on my zx10-r
    nope its still there: hxxp://search.ebay.com/ebaymotors/_W0QQsassZhidwholesale88
     
  22. ronjor

    ronjor Global Moderator

    Joined:
    Jul 21, 2003
    Posts:
    57,757
    Location:
    Texas
    Send the link to your antivirus vendor. No need to post possible malware links here on the forum.
     
  23. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,012
    Location:
    on my zx10-r
    anyone have a direct link to send a http file to kaspersky?? i know i can send a file but what about a http link??
    i made sure to post thats what i thought it was.. didnt mean for anyone to get any nasties from it.. just wantedto make sure it wasnt just a attack on my system here.. i def appreciate the input from everyone though. please do be careful on ebay as a friend just called me and said his nortons just picked up something as well and its not the same as what i found.. not sure whats up with all the ebay stuff now??

    thanks
     
    Last edited: Apr 4, 2008
  24. lodore

    lodore Registered Member

    Joined:
    Jun 22, 2006
    Posts:
    9,006
    yes the user ID is still there but there is no malware detected.
     
  25. zfactor

    zfactor Registered Member

    Joined:
    Mar 10, 2005
    Posts:
    6,012
    Location:
    on my zx10-r
    mine still shows the malware even after the update. ill try another update maybe i was one behind not sure..also just tried another link a friend sent me and that comes up to with a different malware than this one..
     
Loading...
Thread Status:
Not open for further replies.