Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Automatically downloaded safari.jsp file. What is it?

I'm running 10.6.6 and have come upon a few websites that make the download window pop up and a file called "safari.jsp" is automatically downloaded. I've just immediately deleted the file when it happens and haven't been able to find a definite answer on Google so I thought I'd ask here. Thanks!

MacPro 2GHz, MacBook 2.4GHz, MacBook 1.8Ghz, Mac OS X (10.6.6)

Posted on Jan 19, 2011 6:42 PM

Reply
26 replies

Feb 22, 2011 9:41 PM in response to Steven Virata

Beginning about mid-January (following 10.6.6 update) I started seeing these files as well. Since the first few incidents appeared while visiting Google Mail and Google Reader, I assumed may be related to Google and commented on a similar thread in Google Groups.

It sounds logical that there are javascript errors with the offending site, but my question is why are we just starting to see this now? I have been unable to reproduce the experience in Firefox... Prior to 10.6.6, I visited many of the troubling sites and never had an issue.

Mar 24, 2011 9:42 PM in response to dwebb

Do you have some type of site quality monitoring program installed?

As far as the links you listed, I notice that they are all at us.intllitxt.com
http://en.wikipedia.org/wiki/IntelliTXT

I use FireFox (now version 4) and I use a plugin called WOT or Web Of Trust. Everyone of these links triggers a security alarm and says the site is not trustworthy. The ratings that WOT uses are built from user experiences and ratings from sites that track problem sites. WOT says that these sites are inheriting the reputation of their parent "us.intellitxt.com" site and all are rated poorly.
http://www.mywot.com/en/scorecard/chicago_cbslocal.us.intellitxt.com

I copied and pasted a link into Safari 5.0.4 and the page wouldn't load at all (lucky for me 🙂 .

I trimmed down the url to remove everything after intellitxt.com/ and Safari get's a redirect page to VibrantMedia.com with a referrer of intellitxt. It looks like the pages are heavily advertised and may be playing tricks with javascripts to track users or get other information. They are also suspected of "drive-by" hit downloads that affect many windows users.

A Google search: intellitxt security issues - shows that intellitxt is one of the companies that uses popups for different words on a site that have nothing to do with the actual page information. They sell advertising for different words and then find the words in different articles so that you will have to see the adds. This makes the web pages themselves difficult to read, but intellitxt gets paid if you just go to the page with their link.
Ref:
http://www.dslreports.com/forum/r18589205-Vibrant-Media-Intellitxt
http://www.msfn.org/board/topic/78807-helpget-rid-of-intellitxtcom-ads-in-ie/

I'm guessing that all of these links you provided are sub categories from a portal site (maybe a page provided by your ISP?), but don't have any idea what page has these links on them. As far as I can tell, your browser is not happy with security issues on these pages.

The good news is that if you change the URL to a different format, it will go to the original site in the link, without the intellitxt ads, ie:

http://chicago.cbslocal.com
http://www.theindychannel.com/index.html
http://www.music.co.uk/
http://www.slashphone.com/
http://www.nationalreview.com/
http://newyork.cbslocal.com/
I don't know where the foxtv2 link actually went so you'd have to figure that one out by Google search.

If your home page is providing you with links to all of these junk-linked sites then you need to get a new home page.

I've seen a couple of people mention that different programs are trying to launch when they download the .jsp files. I suppose the .jsp file extension could be mapped to any number of programs on different computers.

BTW, neither Safari 5 or FireFox 4 prompted my to download a .jsp file.

Mar 25, 2011 11:14 AM in response to KJK555

I am having the issues on my laptop running 10.5.8 I also was having this issue on my iMac running 10.6.7 but that machine crashed hard yesterday, first time ever and I now find myself on my macbook today. I am sure this is totally unrelated but I lost all my permssions yesterday and can no longer do a disc repair, lost permissions 3 times yesterday, so tonightis dedicated to the rebuild!

May 5, 2011 8:12 AM in response to Steven Virata

I found a solution that worked for me... months ago I had used Safari's Web Clipping feature to create a Dashboard widget of current weather radar from my local CBS affiliate. As it turns out, everytime Dashboard tried to query the site to update the widget is when the safari.jsp file was attempting to download and opening a blank browser page. Since Dashboard will update in the background this explains the seemingly unexplained download attempts of safari.jsp.


I've now removed the web clipping and have not had the blank browser page trying to download safari.jsp appear since then.


Hope this can help some of you out.

May 5, 2011 9:13 AM in response to Steven Virata

Install Firefox and the Add on's:


NoScript - View tool Bar > customize toolbar and drag the "Temp allow all" button to the toolbar


Ad Block Plus - subscribe to the easy list.


Public Fox - enable a password on downloads.



Safari is being heavily targeted due to Webkit issues, I highly advise not using a browser based upon Webkit, (Safari and Chrome)


Also iTunes uses Webkit as well, so if you have a account, use a low amount debit card with no overdraft protection to limit any losses.

May 5, 2011 9:33 AM in response to Steven Virata

More Advanced users can block a lot of malicious sites on the Internet utilizing a host file addition. Including Intellitext, which is difficult to block individually.


1: Download the free TextWrangler from BareBones Software (it can edit system files easily, or use your favorite command line, pico, vi, etc)


2: Copy the Hosts file addition from this page (Select all, copy)


http://winhelp2002.mvps.org/hosts.txt


3: Paste into Text Edit and remove line: 127.0.0.1 Localhost (very important!)


4: Use Text Edit "Find and Replace" to change all instances of 127.0.0.1 to 0.0.0.0


5: Save the file to the desktop for later trashing or retaining.


6: Launch Text Wrangler and Open File by Name: /etc/hosts


7: Leave what you see alone!, add returns to make space at the bottom and copy/paste the contents of the Text Edit file to the bottom of the /etc/hosts file.


8: Save the /etc/hosts file in Text Wrangler, it will need your admin password.


9: Bingo, you just blocked tons of malicious sites on the Internet.


10: Once in awhile you need to update just the portion you added to the /etc/hosts file as new stuff comes up all the time using the same exact proceedures oulined above.


11: If you want to block facebook for instance just add


0.0.0.0 www.facebook.com


and your computer blocks the site. It works because it consults the /etc/hosts file to resolve the IP before asking the DNS. 0.0.0.0 is nothing. (127.0.0.1 is "this computer" which causes some issues for OS X so 0.0.0.0 is used instead)


If you want the computer to ignore any linein the /etc/hosts file, just add a "#" (no quotes) in front of any line you want ignored.


Also this doesn't work for guest OS's in a virtual machine, as they resolve their hosts through their own file, which for Windows the rather complicated instructions are found here.


http://winhelp2002.mvps.org/hosts.htm



If you want to block IP's, search and install NoobProof, avoid the Wizzard and on the left is a blacklist button. follow the instructions in the help.


Much more advanced users can use WaterRoof or edit their ipfw via the command line.



If this is beyond you, then don't take the above action. Your responsible if your machine gets hosed.

Automatically downloaded safari.jsp file. What is it?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.