[Some ramblings from last night I didn't post that sheds a bit of light on what MAY be going on]
ebay.com/rdr/js/s/rrbundle.flat.min.js is a file on eBay servers, and unless there has been a breach and the servers are pwned, it is presumed to be a legitimate eBay file.
Found a few tidbits in that file (picking through human readable bits - no progress setting things up somehow to get the code to deobfuscate itself)
Noted a reference to "roboradar iframe" near the end of the file. Off to google to find out what roboradar is. It appears that it's a bot detection framework that eBay uses on the signin page that watches mouse movements, keystrokes, timings, etc (similar to newest google recaptchas) to transparently determine if a bot is poking at the signin form, a human fumbling around, or the human's password manager entering data.
Unless the the google result, the reference I found, and the filename is an elaborate ruse to deflect suspicion, the little clues sort of make sense.
The JavaScript filename in question is ebay.com/rdr/js/s/rrbundle.flat.min.js - rr for roboradar maybe and in the rdr (for radar?) directory. There are referenced to email, password, forms, there is a lastpass term (lpcurrpass) in there, and people have been reporting that it rears it's head on or around eBay signin events.
Here is the link to the only thing I found about roboradar:
https://www.powtoon.com/online-presentation/gm1KNWXtbHw/roboradarfinal1/?mode=Movie
(68 of 68 engines at Virustotal say that link is clean and I had no issue with it)
An interesting watch, and no clue who made the video or who developed and maintains roboradar.
(presentation poster/author appears to be a non-eBay coder/hacker in india?)
Assuming roboradar is a real thing (and I wouldn't doubt it), it looks like maybe that script might have been obfuscated by eBay (or whoever developed and maintains roboradar) to prevent easy reverse engineering by bot users. Makes some sense.
That brings us back to the simplest explanation that the AVG and Avast detections are a false positive.
Only two possibilities I see:
False positive on a legitimate (but horribly obfuscated) eBay script by AVG and Avast (very possible)
or
The script isn't eBay's, and possibly malicious, which would imply that either eBay servers are compromised to some degree to the point where malicious content can be uploaded/inserted, or if roboradar is maintained by a third party, that that third party, which may have access to eBay servers is compromised. (I'd guess a much lower)
At this point people seem to be saying the issue is resolved. Mentions of Firefox updates? and Avast updates? and nothing rigorous or clear that indicates what caused the problem, but lots of mentions of eBay logins being the place where it triggered which totally fits in with a hypothetical eBay login roboradar bot screening routine running, and that that obfuscated script triggered an AV heuristic false positive.
Too many unknowns. eBay will definitely never admit to a breach if there was one (which I doubt), will likely never admit to roboradar if it really is in place and as I suspect (because people don't like bots watching their behavior and that reveal opens a door to thinking about how much more of that type of thing is done here and elsewhere), and unless someone can post evidence that updating AVG or Avast virus definitions made the alert go away (or even better that someone who didn't update the AV is still seeing the alerts today), we may never know.
