Sounds like a new variant of what was happening recently with what I BELIEVE were false positive detections by AVG and Avast due to eBay use of heavily obfuscated anti-bot signin scripts that trigger the false detects. This time it's rriframe.flat.min.js triggering the detect instead of rrbundle.flat.min.js (both are present and HEAVILY obfuscated which is something AV suites trigger on as suspicious behavior).
Read my posts in this thread: https://community.ebay.com/t5/Selling/Are-AVG-Users-getting-notice-of-REDIRECTOR-BKG-Trojan-Virus-Fr...
Did your Norton AV update virus definitions or program files overnight just before the problem started?
If so, that can indicate one of two things: Norton discovered something in the wild and is flagging on it, or Norton changed something in the heuristics/definitions that causes the false detect of non-specific threats.
I believe the latter is more likely. It happens all the time.
Here is the text of another post of mine from the PS forum:
in reply to xxxxxxxxx 06-06-2018 03:55:12 PM
berserkerplanet
Observation: in all the threads on the boards recently about this issue where the poster
provides any details, it is only AVG and Avast doing this - and both have a long history
of false positives.
Haven't seen anything about any of the 100+ other virus/malware suites* detecting that
or anything on eBay.
*Windows Defender, McAfee, Symantec, Sophos, Kaspersky, ESET, Avira, BitDefender,
F-Secure, Comodo, F-Prot,... or in browser site blacklisting in Firefox and others
(via Google Safebrowsing?)
VirusTotal.com isn't what it used to be (many big names no longer there), and because of
possible login issues, difficult to say if results of URL scans are valid, but it shows 68
out of 68 "no detection" for the URL ( https://www.ebay.com/rdr/js/s/rrbundle.flat.min.js )
in the AVG screenshot in post 5 or any other URL I threw at it (signin.ebay.com,
https://www.ebay.com/sh/ovw, whatever)
If someone runs into a detection by AVG or Avast or whatever virus suite, try scanning
the URLS at VirusTotal (either the one the virus suite is specifically warning, or the
URL for the link clicked that causes the warning) and see if anything at VirusTotal agrees
with your AVG or Avast.
Can also try using Google Safebrowsing directly to see what Google thinks:
https://www.google.com/safebrowsing/diagnostic?site=WEBSITE_URL
where you replace WEBSITE_URL with your suspect URL
ie:
https://www.google.com/safebrowsing/diagnostic?
site=https://www.ebay.com/rdr/js/s/rrbundle.flat.min....
or
https://www.google.com/safebrowsing/diagnostic?site=https://signin.ebay.com
(note that Google scans may not be real-time or even close - I'm guessing they don't scan
assumed secure sites like eBay or Bank of America as often, and focus their efforts on
the other more risky sites - likely those that pop up in a lot current popular searches)
or check it directly here: https://transparencyreport.google.com/safe-browsing/search
Also:
https://www.urlvoid.com/
https://sitecheck.sucuri.net
Recap/Summary:
I believe these are all false detects of obfuscated JavaScript files eBay is using as part of an anti-bot login protection framework called "RoboRadar". The AV suites are freaking out over the obfuscated nature of the files (they score that as generally suspicious behavior), throw up their own variety of a generic trojan warning, and block access to it. Nothing else detects anything wrong with the JS files, which reinforces that belief.
It is possible to use Adblock, AdblockPlus, etc to block those JS files and prevent the AV warnings without any collateral damage (not being able to log in or any security issues) with a general rule of the form: ebay.com/rdr/*$domain=signin.ebay.com
