Welcome to the MacNN Forums.

jeff k · Aug 17, 2009, 07:53 PM

Lately, I've been getting a stupid file downloaded every time I'm on Safari.
I've deleted all my cookies, I don't know what more to do.
Is there a preference for not getting downloads unless you approve a download??
Safari,.4.0.3

AKcrab · Aug 17, 2009, 07:57 PM

What file is it? Could it be coming from your homepage?

jeff k · Aug 17, 2009, 10:55 PM

No, coming from elsewhere.

Cold Warrior · Aug 17, 2009, 11:17 PM

Originally Posted by jeff k

No, coming from elsewhere.

A specific page you're visiting then?

AKcrab · Aug 17, 2009, 11:21 PM

Originally Posted by AKcrab

What file is it?

jeff k · Aug 17, 2009, 11:23 PM

No specific page. just surfing around.

TheoCryst · Aug 18, 2009, 12:15 AM

... Is it from "special" surfing? You know, your "alone" time with the computer? *nudge nudge*

Off the top of my head, I don't know of any way to stop Safari from automatically downloading files. I wouldn't be surprised to find that something like Saft or Glims could do it for you (disclaimer: I don't use either, so I honestly don't know).

AKcrab · 12:44 AM

removed

jeff k · Aug 18, 2009, 01:13 AM

Theo, If don't know, it's better to get a life and let others respond.

ChrisF · Aug 18, 2009, 08:07 AM

Originally Posted by jeff k

Theo, If don't know, it's better to get a life and let others respond.

You haven't given enough information for anyone to provide a useful response.

Cold Warrior · Aug 18, 2009, 11:13 AM

Originally Posted by jeff k

Theo, If don't know, it's better to get a life and let others respond.

The Internet is downloading files. . That's not much to go on.

Use Firefox, see if it persists.
Use ad blocking in any browser.
Tweak your javascript settings in Safari and Firefox.
Slowly browse your pr0n pages to see what page gives you the file.

Chuckit · Aug 18, 2009, 11:25 AM

Given the vague info we have to go on here, TheoCryst's response is the most likely answer. That type of site is known for trying to download viruses and other such crap to your computer.

jeff k · Aug 18, 2009, 12:24 PM

How use ad blocking in Safari?
How tweak java? what downsides to this?

Did not understand this:
Slowly browse your pr0n pages to see what page gives you the file

What is this place doing? uploading files to my desktop. have my ip? how accomplish it?

Thorzdad · Aug 18, 2009, 12:50 PM

Jeff, you need to give us more information before anyone can help you.

What is the name of this file you say is being downloaded?
Are you on a specific website when it begins to download?
Does anything happen to your computer or browser after the file downloads?

Until you answer these questions, no one is going to be able to give you any specific help.
A simple guess is that you are going to a website that is built to automatically download a windows .exe file to cause trouble. But, until you answer the questions, all we can do is make guesses and confuse everyone.

Chuckit · Aug 18, 2009, 12:52 PM

A Web page can automatically trigger a download just by including a redirect meta tag that points to a downloadable file. There's no Javascript or anything necessary.

mduell · Aug 18, 2009, 03:09 PM

Safari has had a number of drive by download exploits, are you running the latest release?

hwojtek · Aug 18, 2009, 04:28 PM

What is your home page, to begin with...?

besson3c · Aug 18, 2009, 06:42 PM

tightsocks: whether a browser tries to download a file or browse it inline depends on the MIME types set on the web server, and the MIME types that your browser and plugins you have installed can handle. What is the file extension of the file being downloaded?

Chuckit: you don't even need a redirect metatag you to do that, you just need to start your file with headers corresponding to the MIME type you wish to serve.

Jeff: need input, Johnny 5 style.

Chuckit · Aug 18, 2009, 07:37 PM

Well, yes, but if you're serving an HTML page, you're not going to be able to trigger an additional download just through MIME type headers.

jeff k · Aug 18, 2009, 09:27 PM

Thordad:
The file name changes, but all look similar one is called: b-8.ashx
I am on no specific website. Have no idea the culprit site. But I will say this: it's was a definitely happening after I was on the site, days after perhaps. Chuckit, and others -- understand, I'm getting these downloads way after I'm off the site. How is that??
Nothing happens after the download. They just populate the desktop.
It has stopped in last 24 hours. Not sure if that's a permanant end.
Mduell, what is a drive by download exploits? I'm on 4.0.3
Tightsocks, thanks, I got that download instantly, What I've been dealing with though is stuff coming in days later. Still it's outrageious a site can download something like that. I shudder to think what someone can download to your desktop.
My homepage is Google.
thanks Guys!

Chuckit · Aug 18, 2009, 09:40 PM

I'm a little confused. If you don't know what site it is, how do you know you get the stuff days after you visit it? You mean Safari isn't even open at the file's creation date?

Cold Warrior · Aug 18, 2009, 09:41 PM

I'm going to remind everyone that links to adult sites are a no-go. Links to adult products are also a non-starter. I've pruned the problematic posts. Further posts need to be on topic and within forum rules.

Spheric Harlot · Aug 18, 2009, 09:46 PM

If the files are being downloaded (and not, say, being generated locally by some crap-programmed application), then you can Get Info on a file, and it will actually tell you the exact URL it's been downloaded from.

besson3c · Aug 18, 2009, 10:22 PM

Originally Posted by Chuckit

Well, yes, but if you're serving an HTML page, you're not going to be able to trigger an additional download just through MIME type headers.

Sure you could, with a rewritten URL. The .html file extension means nothing.

jeff k · Aug 18, 2009, 11:34 PM

Chuck,
I know because I went on lot of sites one day, and next day, I'm still getting these things, and yet I'm not surfing the web as much the next day. Safari is open while the downloads come in, but I'm not on the site that is torturing me.

Cold, that was useful that Mduell posted that, it showed what happens in live time. I'm experience something even beyond that. thanks Mduell. (although I see your point Cold)

LIda, the trade9shoes, did not produce a download. thanks

Shep, the get info reveals nothing.

Art Vandelay · Aug 18, 2009, 11:49 PM

Originally Posted by jeff k

Shep, the get info reveals nothing.

Then it's not coming from Safari unless you didn't look in the right spot in the Get Info window. It's in the More Info section.

CharlesS · Aug 18, 2009, 11:53 PM

Originally Posted by jeff k

LIda, the trade9shoes, did not produce a download. thanks

Lida is a spammer. It (not he nor she, since it's likely a bot) has posted that same link in almost every thread on this entire forum.

besson3c · Aug 19, 2009, 12:01 AM

Jeff, if I were you the first thing I would do is see if this problem persists in Firefox. The results of this test this will help all of us focus on what ought to be focused on. If it persists there too, create yourself a new OS X account to see if it persists there.

You can download Firefox here:

Mozilla | Firefox web browser & Thunderbird email client

jeff k · Aug 19, 2009, 12:52 AM

Art, thanks!
Ok open more info. From a myspace group I joined. Just joined a bunch, but with all goobly gook, can make it out, so screenshot it. what is url?
(my upload site not working - tiny pic, anyone know another good free one?

Still,
how do they send this when I'm not even at their site?
and why sending a worthless file? and why are they sending 20 of them in 10 minute span?
and how do they achieve this. Again, how does anyone achieve a forced download? the implications are scary no?

Spheric Harlot · Aug 19, 2009, 02:07 AM

Let me google that for you

jeff k · Aug 19, 2009, 10:45 AM

Ok, got the screenshot working:
Image - TinyPic - Free Image Hosting, Photo Sharing & Video Hosting

Art Vandelay · Aug 19, 2009, 12:09 PM

You could have just copied the text and pasted it here.

Another reason why I despise MySpace.

Cold Warrior · Aug 19, 2009, 12:13 PM

inline images also work fine

jeff k · Aug 19, 2009, 01:57 PM

I tried to copy but would not copy, cursor, simply would not grab it, no?
How do you get it inline Cold?

jeff k · Aug 19, 2009, 01:59 PM

What site is it?

Art Vandelay · Aug 19, 2009, 02:36 PM

Originally Posted by jeff k

What site is it?

Seriously?

jeff k · Aug 19, 2009, 06:07 PM

Yes, can you tell me from screeshot what specic group/ site?
Continued today while my assistant was doing a project on myspace, dozen on my desktop. So far only happens on g5/Tiger, not the laptop/Leopard

Art Vandelay · Aug 19, 2009, 06:40 PM

You just answered your own question.

jeff k · Aug 19, 2009, 10:14 PM

What did I awnser? still don't know the culprit.

Art Vandelay · Aug 19, 2009, 10:52 PM

Good grief.

Originally Posted by Art Vandelay

You could have just copied the text and pasted it here.

Another reason why I despise MySpace.

Originally Posted by jeff k

Yes, can you tell me from screeshot what specic group/ site?
Continued today while my assistant was doing a project on myspace, dozen on my desktop. So far only happens on g5/Tiger, not the laptop/Leopard

tightsocks · Aug 19, 2009, 11:10 PM

Actually, it seems to me that the relevant part of the url in the myspace file is the .ashx extension. Seems like something that should be happening on the server is instead being downloaded.

I am having the same issue with an .aspx file being downloaded. Everytime I visit a particular storefront to login Safari downloads a 0 K file called setcheckcookie.aspx It seems pretty obvious to me that these are scripts that are meant to be handled server-side, but for some reason are being downloaded mistakenly by Safari.

The issue seems to have surfaced with Safari 4.0.3

Art Vandelay · Aug 19, 2009, 11:44 PM

Originally Posted by tightsocks

Actually, it seems to me that the relevant part of the url in the myspace file is the .ashx extension. Seems like something that should be happening on the server is instead being downloaded.

Yes, for the source of the problem, that is the relevant part. But the OP was wanting to know what site the files were coming from. That's what I answered.

jeff k · Aug 20, 2009, 02:18 PM

ARt, I don't think you identified it. I joined dozens of groups recently. which one?

Tight socks, briliant. That all over my head, but I get gist of it. So it's not pernicious. It's accidental. that's great news. I assumed for sure it was intentional.

It's from new upgrade? Aren't the upgades supposed to solve problems????

Art Vandelay · Aug 20, 2009, 08:08 PM

Originally Posted by jeff k

ARt, I don't think you identified it. I joined dozens of groups recently. which one?

Are you this helpless in life?

AKcrab · Aug 20, 2009, 09:01 PM

Originally Posted by Art Vandelay

Are you this helpless in life?

I was sure we were getting played.

jeff k · Aug 20, 2009, 11:14 PM

Got it, but will they even know what I'm talking about if I complain. Did we determine this is fault of Safari??

besson3c · Aug 20, 2009, 11:17 PM

jeff: they might not know what you are talking about until you use the code word for Safari and the download problem you are having, which is "rusty clarinet"

jeff k · Aug 21, 2009, 02:01 AM

Where did you get rusty clarinet?
Exactly what is happening again? it's a bit arcane for me to get my head around. and it's the fault of Safari? thanks

besson3c · Aug 21, 2009, 02:13 AM

Don't ask me where I got rusty clarinet, I didn't make up that term, it's just an IT industry standard that has solidified over the course of several years sort of like Leopard and Tiger, except in the case of Leopard and Tiger those names were so popular that the general public adopted them, whereas only insiders call Safari by its actual name.

besson3c · Aug 21, 2009, 02:15 AM

Originally Posted by jeff k

Where did you get rusty clarinet?
Exactly what is happening again? it's a bit arcane for me to get my head around. and it's the fault of Safari? thanks

How are we supposed to know "what is happening again"?

Hint: make it seem like you are expending at least as much effort in asking your questions and making them clear and non-cryptic as people do in trying to answer them.