3

I'm getting redirected to ezshoplist.me and alecyueee.us, when I try to access amazon.com. I'm actually redirected to these sites which redirects back to Amazon.com. I searched a lot regarding these domains and came across this link - ddecode.com.

Also came across this site alestat which also indicates connections between amazon, ezshoplist.me and alecyueee.us

  1. Can someone help me understand what this code does?
  2. Has my Amazon credentials/session been compromised?
  3. How do I figure out which extension is the culprit?

As of now, I'm using a Chrome extension - Block site, to block these two sites and it does a pretty good job in doing the same. But I would like to get this removed. Virus/Malware scan with ClamXav and AVG free did not help.

Browser : Chrome
OS: Mac OSX 10.7.5

Improve this question
8
  • 2
    In the worst case you have a malicious infection. In the best case you have a fake/adware extension installed. What have you done to clean your system? Have you simply deleted your Chrome profile? Once you resolve this problem you should change your Amazon credentials.
    – Ramhound
    Sep 11, 2013 at 15:56
  • As mentioned I've scanned system with antivirus/malware. I uninstalled chrome, cleared profile etc, reinstalled it and sync'd my extensions back from cloud. I still have the issue. I'll change my Amazon credentials only after making sure that issue is completely resolved. But I need help on that.
    – rajivvishwa
    Sep 11, 2013 at 16:00
  • Skip syncing the profile, and I glazed over the fact your on OS X, so a malcious infection is highly unlikely. Which leaves a malicious ( i.e. unwanted behavior ) extension installed by you. Does this happen with Safari or Firefox? I suspect its your DNS or ISP Provider introducing this behavior through javascript.
    – Ramhound
    Sep 11, 2013 at 16:18
  • Forgot to mention - I'm using Google DNS servers, my hosts file is clean too. This is happening only on Chrome (Not on incognito). Its clear that some extension is causing the issue. And someone has posted the code of extension in link mentioned in my post. But I'm not sure I could figure out what it does. If I could figure out I may be able to track the extension and remove it. And of course, report it to Google.
    – rajivvishwa
    Sep 11, 2013 at 16:49
  • Process of elimination is the best way to find this. Remove one extension at a time until the problem returns. Syncing your profile after the removal of the profile is likely the reason it returned. Try starting chrome with extensions to verify its actually an extension doing it.
    – Ramhound
    Sep 11, 2013 at 16:56

5 Answers 5

Reset to default
1

I have the same thing. I've got 3 computers all synced by Chrome and the problem comes back. Mac and PC both do it. It is basically an affiliate redirect so someone is getting paid every time, which I wouldn't mind if I knew who it was. eliminating now so will post results. I reckon it's Adblock Plus but can't be sure.

EDIT: Ironically it looks to be the DoNotTrackMe extension! ABP seems to be fine.

Improve this answer
2
  • Please be more precise with the answer - is it now the "DoNotTrackMe" extension? Was the problem solved after you deleted the extension?
    – FiveO
    Jun 26, 2014 at 10:15
  • i think i have found the culprit, there is code in the chrome extension "Fabulous for Facebook" that redirects the browser when visiting amazon, just like in the OP.
    – mack nordstrum
    Aug 29, 2014 at 16:08
1

In my case, this was a Youtube Ad Blocker that was taking me to http://alecyueee.us/ext

Improve this answer
1

Solution: Remove the extensions from your browsers and synced accounts.

Details:

Looks like these extensions take away video ads, but do provide methods which inject affiliate links.

Their terms for the Video Ad Blocking are not on the chrome webstore, but to provide the free service, the urls pointing to ezshoplist.me use affiliate linking: https://web.archive.org/web/20170626194757/http://ezshoplist.me

Related: https://web.archive.org/web/20150108065653/http://alecyueee.us:80/google-chrome-extensions

Found the IP here:

http://viewdns.info/reverseip/?host=162.243.254.224&t=1
Improve this answer
0

I think i have found the extension causing your issue. I was a bit suspicious of the extension so checked out its code, and found an obfuscated bit of javascript that seems to do what you are suggesting. The extension is called "Fabulous for Facebook". Do you have that installed? If so, uninstall it, and the problem should go away.

Improve this answer
0

In my case, the problem was a chrome plugin/extension called "Photo Zoom for Facebook". This plugin/extension used to open a new tab each time I opened Chrome in Incognito mode and automatically go to http://alecyueee.us/ext url which then redirected me to download a plugin/extension called "Fabulous for Facebook".

Please do not use this plugin (Photo Zoom for Facebook) and not only disable but remove it from your chrome, it maybe tracing your secret data. So better to be careful.

Google should check before adding these extensions to their store.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .