Got forwarded to eitoodomain.org with an attempted download

[Erik Mouse]

Forum URL: mythicawoodland.freeforums.net

I'm not sure if this was from an ad or something else as I had started by reporting the latest one I could find in Ad Reporting, but what happened is that I was taking a look at another forum on Proboards and was suddenly forwarded to a eitoodomain.org URL that showed Urgent Firefox update on it and tried to download something, but got an "Opening firefox-patch.exe C:\Users\Owner\AppData\Local\Temp\dU7XpNTC.exe.part could not be saved, because the source file could not be read." error message pop up on it with Avast triggering on it saying it is "7/8/2016 2:08:13 PM eitoodomain.org/506417711245/506417711245/1468001285798585/firefox-patch.exe [L] Win32:Evo-gen [Susp] (0)"

I hope whatever it is, ad or something else, is found and removed.

[Ulises]

Thanks for reporting. We are investigating.

[Erik Mouse]

Jul 8, 2016 10:49:31 GMT -8 Ulises said:

Thanks for reporting. We are investigating.

Thanks, Ulises. All I know is that it happened while I was viewing posts on occultknowledge.boards.net that I'm a member of and was suddenly forwarded to eitoodomain.org/506417711245/711011a5b55bc9ab9691c9452be0394b.html which tried to download the infected file that was blocked by Avast, my antivirus. I don't know if it was from an ad or something else on the forum that the forum owner may need to know about, but took the steps for reporting it as an ad just in case.

[Ulises]

I can confirm that it wasn't the ads you reported. When this happens it is usually specific to the user (malware, javascript injections from a shady browser extension, and such) so I would recommend running a program such as malwarebytes and see if the redirects continue and/or disabling any extensions you don't recognize or remember installing.

[Erik Mouse]

Jul 8, 2016 11:23:33 GMT -8 Ulises said:

I can confirm that it wasn't the ads you reported. When this happens it is usually specific to the user (malware, javascript injections from a shady browser extension, and such) so I would recommend running a program such as malwarebytes and see if the redirects continue and/or disabling any extensions you don't recognize or remember installing.

Well, I have just got done running a scan with my Malwarebytes Anti-Malware and it didn't find any infections, also looked at the Firefox Extensions that I have and don't see any unrecognizable ones. I guess I'll have to wait to see if it happens again to check again.

[Ulises]

Keep reporting 'em and we'll keep investigating 'em.

[Erik Mouse]

Even though I didn't get forwarded to anywhere, it looked like it might have recently happened with something as Avast triggered on something while viewing a forum here, and gave the following message.

7/9/2016 2:27:58 PM A script started by C:\Program Files (x86)\Mozilla Firefox\firefox.exe [L] HTML:Script-inf (0)

[Ulises]

That is pointing to something on your computer rather than on a particular web page which is why I had you run malwarebytes.

[Erik Mouse]

Jul 9, 2016 12:11:49 GMT -8 Ulises said:

That is pointing to something on your computer rather than on a particular web page which is why I had you run malwarebytes.

Even though that resulted in malwarebytes finding nothing when I ran a scan of it.

[Ulises]

Hm, can you PM a list of the add ons you have on firefox?

[Erik Mouse]

Jul 9, 2016 12:48:48 GMT -8 Ulises said:

Hm, can you PM a list of the add ons you have on firefox?

I just did that as you have requested, and see if you see anything that shouldn't be there and might be causing the issues that I seem to have.

[Ulises]

I'll double check with other people in the office today and tomorrow as well. Thanks!

[Ulises]

Can you do a clean install of FireFox? Here's a thread which contains instructions from their support page: support.mozilla.org/en-US/questions/988824

[Erik Mouse]

Jul 10, 2016 8:03:18 GMT -8 Ulises said:

Can you do a clean install of FireFox? Here's a thread which contains instructions from their support page: support.mozilla.org/en-US/questions/988824

Hi, I have done a clean install of FireFox by following the instructions in that link, and sometime later, I had an unresponsive script message pop up while viewing a forum on here that was this:

I went to the ad reporting in, but only found the latest entry to report being nine hours ago for some reason.

[Ulises]

Hi, can you follow the steps here? support.proboards.com/post/6740379