Level 1

0 points

Possible Safari 4.0.3 issue

I just downloaded safari 4.0.3. Everything seemed fine, until I went to check my yahoo mail. There were three e-mail, one from Apple, barnesand noble and Toysrus. When I opened the apple nothing strange happened. Yet, when I opened the barnesandnoble e-mail the downloads box popped up with an entry showing Desktop 1-1. Well I clicked show in finder and when you click it, it just shows an empty textedit page. I immediately sent it to the trash bin and secured emptied the trash. I know clicking on it was pretty stupid, but back to the e-mails when I clicked back on the barnesandnoble e-mail a Desktop 2-1 popped up. The same thing for the toysrus e-mail, a Desktop 3-1 and 4-1 popped up. When you look in Finder under there are empty folders with the same titles Desktop 1-1, 2-1, 3-1, 4-1.

What the heck is going on? Is this some bug with Safari or was there some sort of malicious content hidden in those e-mails?

<Edited by Host>

MacBook, Mac OS X (10.4.11)

Posted on Aug 11, 2009 11:36 PM

98 replies

Bob Mayo

Level 2

152 points

Aug 15, 2009 8:56 PM in response to Miser1

I just had this happen when I clicked on a google news link to an LA Times movie review. Folders named Desktop-1 an Desktop-2 were downloaded to my computer. Desktop-1 went to my Home Folder and Desktop-2 went to my desktop. I trashed Desktop-2 and used Spotlight to search for Desktop-1. I selected the file and used the Get Info command to examine it. More info says:

Where from:
http://ads.traffiq.com/adserver/Impression/tcount=1/pid=4510/oid=1720/sgn=001250 371433-1963209292/txn=defff17a-45c3-4fde-9534-6c82a623271f,http://goldderby.lati mes/com/awards_goldderby/2009/08/district-9-mtv-movie-awards-saturn-awards-enter tainment-news-1357908.html

The above now results in "a bad request".

the original link which seemed to generate the mystery folder download:

http://goldderby.latimes.com/awards_goldderby/2009/08/district-9-mtv-movie-award s-saturn-awards-entertainment-news-1357908.html

Message was edited by: Bob Mayo

Bob Mayo

Level 2

152 points

Aug 15, 2009 10:28 PM in response to Bob Mayo

I just had four more of these mystery folders appear -- this time in my Users folder. "Get Info" reveals nothing of their origin this time. They are Desktop-2-1 , Desktop-3-1 , and Desktop-4-1 .

Bob Mayo

Level 2

152 points

Aug 15, 2009 10:37 PM in response to Bob Mayo

Correction: The items mentioned in the previous posts are documents -- not folders -- deposited in my Users Folder. Three new folders with similar names were deposited in current Home Folder. So that's six unauthorized downloads in the space of a couple of hours. Using Get Info on these latest folders reveal they were created by ads.traffiq.com via web pages of the Pittsburgh Post-Gazette and the Pittsburgh Tribune-Review.

Aug 16, 2009 11:52 AM in response to Bob Mayo

The same thing has happened to us. One User got these 3 Desktop folders..and the other User got 3 Desktop Text Documents. We also noticed that, in "Safari- Preferences- Fraudulent Site Warning" is a yellow flag, with a warning that the Google fraudulent site warning service was not available for three days....We reset Safari, & this alert disappeared...So..is this a security breach of some kind..? We really need to know!

Aug 16, 2009 11:58 AM in response to Island-artz

We've been down this road many times before. Repeat after me and click your heels together three times: "There are no viruses for Mac OS X…" "There are no viruses for Mac OS X…" "There are no viruses for Mac OS X…"

Sweejak

Level 2

457 points

Aug 16, 2009 12:46 PM in response to Bob Mayo

I don't have much to add but to confirm that this is happening, the files go to my users file and they say they are zero k.

Aug 16, 2009 1:23 PM in response to Golden Shoes

Hi,

It seems it is an issue with Tiger and Safari 4.0.3. I have tested this on my iBook G4, my QS G4, both of which run Tiger, and on my Mac Pro when booted into Tiger. In every case it did not happen with Safari 3, and Tiger on each of the computers. Neither does it happen with Leopard on the Mac Pro. All computers were updated for every item presented by Software Update. I would submit your advice that it is not related to Safari may be inaccurate. If related to Javascript, it is limited to the implementation found in combination with Tiger and Safari 4.0.3.

With Get Info, the folders that are added to the User folder mention traffic.outbrain.com as somehow the source. The document style files do not have any info. All folders and file are zero in size.

This seems to be a widget to rate posts, and is discussed at:

http://www.blogfornoob.com/blogging-resources/blogger-widgets/outbrain-post-rati ng-widget-for-blogger/

among other places.

Ernie

Aug 16, 2009 1:28 PM in response to Ernie Stamper

Well, all I can say is that I'm running 4.0.3 and it doesn't happen to me at all, no matter the site.

Aug 16, 2009 1:37 PM in response to Golden Shoes

Please test with:

http://www.usatoday.com/tech/news/2009-08-12-microsoft-lawsuit_N.htm

Let this site sit open for several minutes.

Ernie

MrJPH

Level 1

1 points

Aug 16, 2009 1:42 PM in response to Ernie Stamper

Yeah Ernie, I have posted about this exact same issue, and found the same results in this thread I created Mysterious Downloads in 4.0.3 (I didn't know this vague titled thread was dealing with the same bug, otherwise I would have posted of my issue here).

Checking out Outbrain.com, I doubt the downloads are malicious, but just some bug/issue with their particular programing, or way their widget works, with the Safari update... or vice/versa.

But then again, I think this is not just limited to just Outbrain's widget thing, and that other users in this thread have found the issue being occurred by other sources... which again leads me back to my original post in my thread, that this just may be a small issue with Safari 4.0.3 dealing with certain javascript traffic/tracking cookie/widget things.

Sweejak

Level 2

457 points

Aug 16, 2009 1:42 PM in response to Ernie Stamper

That site pulls up 3 downloads; Desktop-1, 2 and 3 into my users folder. It does the same on my G4 laptop.

Aug 16, 2009 1:46 PM in response to Sweejak

Yes, and you will find similar items in the main folder listing all Users, as well as your own Users folder.

Ernie

Aug 16, 2009 1:49 PM in response to Ernie Stamper

Did that, and it's still open now, but I have absolutely no files or folders on my Desktop.

Aug 16, 2009 1:54 PM in response to MrJPH

Hi,

I was aware of your topic also. The site at the URL I posted is the only one I have encountered, but I have no doubt there are others. But if these folders are the same for other sites, I would guess it might the same widget at work. This may be doing its intended task with other OS, but only leaving tracks with Tiger, but I have not thought of a way to test that.

Ernie

Sweejak

Level 2

457 points

Aug 16, 2009 1:56 PM in response to Ernie Stamper

Ernie Stamper wrote:
Yes, and you will find similar items in the main folder listing all Users, as well as your own Users folder.

Ernie

That's right, and in the G4 too.

Message was edited by: Sweejak

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Possible Safari 4.0.3 issue