yamaci17 Posted February 11, 2021 ID:1438134 Share Posted February 11, 2021 I'm suspecting of an adware in my system. Malwarebytes and Adwcleaner results are completely clean. Today, when accesing to https://www.amazon.fr/, I was directed to prj11.com/afr2 And the, this short link directed me to; https://www.euroascend.com/ Couple of questions 1) Is this euroascend.com website safe and secure? Does it contain any virus? 2) Why I am being redirected to this short link and to this website, am I in some kind of risk? 3) My guess is, this recent add-on I used might be the problem; https://chrome.google.com/webstore/detail/super-simple-auto-refresh/ohoicclioikehjddmoohhahbkmbohlch?hl=en Can any experienced person analyze this add-on and tell me if it is the reason for this redirection? The problem does not persist, but it was also inconsistend, it did not always happen, but from time to time. Thanks for help. 1 Link to post Share on other sites More sharing options...
InVenomd Posted February 11, 2021 ID:1438203 Share Posted February 11, 2021 The same thing has just happened to me when trying to access amazon.com / amazon.de. I had the Same Chrome Plugin Installed so i think its safe to assume thats the cause. I used the Plugin for a while without any issues on multiple devices until today but i doubt its a coincedence we both had that Plugin Installed. I am now running Virus Scans of my own just in case. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 12, 2021 Root Admin ID:1438220 Share Posted February 12, 2021 Please try removing it and see if that corrects the issue or not. I use this one and so far has been okay. https://chrome.google.com/webstore/detail/tab-reloader-page-auto-re/dejobinhdiimklegodgbmbifijpppopn?hl=en Link to post Share on other sites More sharing options...
Mckenzie Posted February 12, 2021 ID:1438300 Share Posted February 12, 2021 Hey! I experienced the same issue and was not really sure about the cause using the same extension at that time. In the end, I stumbled over this thread. I have had a look at the source code of the extension and what I found is that it seems to hide a string to prj11.com in a series of partially base64 encoded substrings. My guess would be that it is a (hidden) referral function that should lead you back to amazon without noticing. Since some of the code looks unnecessarily complex for the function the extension offers, I decided to remove it. Hopefully this extension did not more unextended behaviours. I am happy for any information someone else might offer about this issue. Link to post Share on other sites More sharing options...
alexgibson Posted February 13, 2021 ID:1438528 Share Posted February 13, 2021 I am very grateful for the information in this thread. Thank you to everyone above. Can confirm seeing exactly the same behaviour after installing Super Simple Auto Refresh. I am frustrated by what I perceive to be underhand behaviour by the plugin makers. Actually, this is quite a clever way for them to make money from a plugin that I find VERY useful - and if they had been upfront about it I would have consented. However it is not explained during installation, and caused me firstly to think that my computer had malware, and now to distrust this plugin. Also I was not aware of this happening in the previous version, Super Auto Refresh, and it looks like this was done to monetise after the fact a plugin that was popular and free. I had already been concerned by the permissions 'Let extensions read and change site data' and thought I had limited it to the one site I need to keep refreshed - so that makes their intercepting my Amazon traffic particularly non-consensual. I'm going to uninstall and look for an alternative, but it is a shame - with proper communication by the plugin makers I could have consented to them taking Amazon affiliate link traffic as fair exchange for a useful service. Link to post Share on other sites More sharing options...
AlexMartin Posted February 14, 2021 ID:1438696 Share Posted February 14, 2021 I have this problem too. I did more checks and I fond that the problem is in this extension: https://chrome.google.com/webstore/detail/easy-auto-refresh/aabcgdmkeabbnleenpncegpcngjpnjkc Easy Auto Refresh and not the one you mentioned. I guess you need to remove a lot of extensions you installed and then test with just ONE extension installed to avoid misunderstanding. Link to post Share on other sites More sharing options...
ChrisPerkin Posted February 14, 2021 ID:1438705 Share Posted February 14, 2021 Thanks you AlexMartin I deleted Easy Auto Refresh and now I don't see any redirects!! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 16, 2021 Root Admin ID:1438986 Share Posted February 16, 2021 Our Team verified this extension does redirect and we have added a block in our program. Thank you for the report Link to post Share on other sites More sharing options...
AlexMartin Posted February 16, 2021 ID:1438988 Share Posted February 16, 2021 Easy Auto refresh was quickly updated today and fixed the problem: https://chrome.google.com/webstore/detail/easy-auto-refresh/aabcgdmkeabbnleenpncegpcngjpnjkc Updated15 February 2021 Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 16, 2021 Root Admin ID:1438992 Share Posted February 16, 2021 Thank you for the update @AlexMartin Link to post Share on other sites More sharing options...
Staff screen317 Posted February 16, 2021 Staff ID:1438993 Share Posted February 16, 2021 (edited) 32 minutes ago, AlexMartin said: Easy Auto refresh was quickly updated today and fixed the problem: https://chrome.google.com/webstore/detail/easy-auto-refresh/aabcgdmkeabbnleenpncegpcngjpnjkc Updated15 February 2021 @AlexMartin Are you the creator of this extension? If so, please get in contact with our PUP Department as soon as possible to discuss delisting the extension; see here for how to do so: https://www.malwarebytes.com/pup/ Edited February 16, 2021 by screen317 Link to post Share on other sites More sharing options...
AlexMartin Posted February 16, 2021 ID:1438994 Share Posted February 16, 2021 (edited) Of course no. I just found the problem and reported it here. Today I didn't notice redirects so checked the extension and it was updated. I don't know how long it will be good. cause if you check reviews here: https://chrome.google.com/webstore/detail/easy-auto-refresh/aabcgdmkeabbnleenpncegpcngjpnjkc William RyanDec 14, 2020 THIS IS SPYWARE. DO NOT INSTALL IT AshDec 14, 2020 Installs malware/tracking services. Avoid at all costs. Since December people were reporting it Edited February 16, 2021 by screen317 Link to post Share on other sites More sharing options...
alexgibson Posted February 16, 2021 ID:1438995 Share Posted February 16, 2021 Just to confirm I did not have Easy Auto Refresh - I had Super Simple Auto Refresh - and I had the Amazon redirect bad behaviour. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 16, 2021 Root Admin ID:1438996 Share Posted February 16, 2021 Thanks @alexgibsonwe'll be sure to review that one as well Link to post Share on other sites More sharing options...
ddn2003 Posted February 17, 2021 ID:1439311 Share Posted February 17, 2021 On 2/15/2021 at 8:12 PM, alexgibson said: Just to confirm I did not have Easy Auto Refresh - I had Super Simple Auto Refresh - and I had the Amazon redirect bad behaviour. I have that extension too. Malwarebytes did flag it, but since I have not had any issues with it and I have tested amazon.com, amazon.ca and amazon.fr, I have kept it for now. We'll see if it gets updated soon. Link to post Share on other sites More sharing options...
ksoft Posted February 20, 2021 ID:1440041 Share Posted February 20, 2021 Hi all, sorry for the confusion in this thread. This thread has incorrectly labeled Easy Auto Refresh as redirecting links, which is absolutely incorrect and has never occurred. Easy Auto Refresh has never redirected links nor does it have any relationship to Amazon whatsoever. Further, this has absolutely no relation to the most recent update. Malware was absolutely not "added" nor "removed" in this update. The app has been reviewed and approved by Google in the Chrome App Store through a strict and extensive review of all policies and all code. I've created a separate post to correct the false positive on Easy Auto Refresh including a full scan by Malware Bytes and Virustotal, along with a sample zip file of the extension as proof of no malware. I appreciate your help. Thank you. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now