always messages "JS:Downloader-DEF [Trj]" blocked

[REDACTED]

Since days I often get messages

The pop-up says:
Object:
https://ad.adtr.02.com/js/ad.js?v=72
Infection:
JS:Downloader-DEF [Trj]
Process:
C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Have tried adwcleaner, CCleaner and Malwarebytes - no success

Get this message mostly on ebay site

[Eddy]

https://forum.avast.com/index.php?topic=194892.0

[Pondus]

ad.adtr.02.com/js/ad.js?v=72   seems to be down  >>  https://isitdownorjust.me/ad-adtr-02-com/

Not sure if CCleaner empty firefox cache, but you may try this  >>  https://support.mozilla.org/en-US/kb/how-clear-firefox-cache

If still problem follow instructions in the link Eddy posted

[DavidR]

I used another site checker and only used the top level domain, 02.com no sub-domains and that too suggests it is down for everyone. Even the full sub.domain URL ad.adtr.02.com results in the same down for everyone.

http://downforeveryoneorjustme.com/02.com

[savcin]

Can you please submit particular file?

[REDACTED]

which file?

[REDACTED]

log files attached as explained (https://forum.avast.com/index.php?topic=194892.0

[REDACTED]

again... (whilst on ebay site)

[Pondus]

The malwarebytes log you attached is not the scan log, anyway if nothing was detected there is no need for it

Malware experts are notified, they may not be online before tomorrow

[Sass Drake]

• Open Notepad (click Start button -> type notepad.exe -> press Enter)
• Copy text from code block below and paste it into Notepad

Code: [Select]

GroupPolicy: Beschränkung - Chrome <==== ACHTUNG
GroupPolicyScripts: Beschränkung <==== ACHTUNG
CHR HKLM\SOFTWARE\Policies\Google: Beschränkung <==== ACHTUNG
OPR Extension: (Video Downloader Prime) - C:\Users\rw\AppData\Roaming\Opera Software\Opera Stable\Extensions\diefijfleiebcgdkmaefbjehgcokpdjl [2016-12-16]


• Go to File -> Save As
• Make sure that  UTF-8 is selected as Encoding (left side of Save button)
• Save it as fixlist.txt on Desktop
• Open again FRST and click on button Fix
• Wait until FRST finishes
• fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

Tell me, does Avast blocks that URL while surfing in Chrome and if possible, paste here URLs which are currently opened in browser when you get Avast message.

[REDACTED]

• Open Notepad (click Start button -> type notepad.exe -> press Enter)
• Copy text from code block below and paste it into Notepad

Code: [Select]

GroupPolicy: Beschränkung - Chrome <==== ACHTUNG
GroupPolicyScripts: Beschränkung <==== ACHTUNG
CHR HKLM\SOFTWARE\Policies\Google: Beschränkung <==== ACHTUNG
OPR Extension: (Video Downloader Prime) - C:\Users\rw\AppData\Roaming\Opera Software\Opera Stable\Extensions\diefijfleiebcgdkmaefbjehgcokpdjl [2016-12-16]


• Go to File -> Save As
• Make sure that  UTF-8 is selected as Encoding (left side of Save button)
• Save it as fixlist.txt on Desktop
• Open again FRST and click on button Fix
• Wait until FRST finishes
• fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

Tell me, does Avast blocks that URL while surfing in Chrome and if possible, paste here URLs which are currently opened in browser when you get Avast message.

fixlog.txt attached

Okay, I´ll try Chrome for some time today.

[REDACTED]

Using Chrome some minutes (surfing on ebay) Avast blocked again

URL:  http://www.ebay.de/itm/372052893067?ssPageName=STRK:MESELX:IT&_trksid=p3984.m1558.l2649

UPDATE
It also happened using Opera browser
URL:  http://www.ebay.de/itm/372052867035?ssPageName=STRK:MESELX:IT&_trksid=p3984.m1558.l2649

[polonus]

Zulu Zcalers also comes up with two suspicious links: https://zulu.zscaler.com/submission/e274211d-416b-4a3f-bcb6-13bd4637a621
External Elements

URL   RISK
-http://pages.ebay.de/ebaybuyerprotection/inde   Suspicious
-http://cgi1.ebay.de/ws/eBayISAPI.dll?ReportTh   Benign
-http://contact.ebay.de/ws/eBayISAPI.dll?ShowC   Benign
-http://www.ebay.de/itm/RAC-Rallye-1980-Triump   Suspicious
-http://my.ebay.de/ws/eBayISAPI.dll?MyEbay&gbh   Benign

iFrames detected...

Found mail servers without 'AAAA' record
-lore.ebay.com: ?
-data.ebay.com: ?
-gort.ebay.com: ?
Found differences in TXT records returned by your name servers. No connection on connection check for nameservers.

verisign dynect abuse? possibly PHISHING

blacklisted link -https://srv.de.ebayrtm.com/clk?rtmclk&%3Bu%3D1h4siaaaaaaaaag1rxy%2baqbr9n%2fe%2fkdtyvp0zpgzmsdpg6mrxioafuyfpgbmuakihfnhf3%2fghferjzc3jybnn5uz%2bce5mivelhewjwllizagutn4giqdxemtv1rvt63a%2bmzw8n1i2zxe08lacjlu5s4r8m9ewtphl99ccr2qzjv%2bg7b573dnahlfjufh01wzrbhjmh

and blacklisted host: -srv.de.ebayrtm.com

polonus (volunteer website security analyst and website error-hunter)

[savcin]

Very strange obfuscation is used. 

[Eddy]

Just checked both links in reply #11 and no warnings with Opera 47.0.2631.71 (PGO) on W10 (fully up to date) and latest avast free.

Just a guess, but perhaps because the ads are "targeted".

Searching for adtr in the source code gives 0 results.