Safari automatically downloads "Unknown" file

Hi...

Open the Finder. From the Finder menu bar click Go > Go to Folder

Type this exactly as you see it here:

~/Library/Safari

Click Go

Move these files from the Safari folder to the Trash.

History.plist

LastSession.plist

Downloads.plist

Quit then relaunch Safari to test. Hopefully that fixed the automatic unknown file issue.

I have also updated my antivirus

That could be the glitch. Try disabling your security software, quit then relaunch Safari to test for speed. Firefox is much more user friendly with a/v software than Safari.

edited by: cs

I was able to load both those pages without any problems so that rules out the site.

I have deleted all the plist files in both the user account and the library folder in the system folder

Troubleshooting .plist files is for troubleshooting specific applications. It's not necessary to remove all .plist files.

Possibly an extension or third party plugin ..

From your Safari menu bar click Safari > Preferences > Extensions. If you have any extensions installed, turn that OFF, quit then relaunch Safari to test.

If it's not an extensions issue, back to the Preferences folder select the Security tab. Deselect: Enable plug-ins

Quit then relaunch Safari to test. If the sites load as they should, they you need to troubleshoot third party plugins > Safari: Unsupported third-party add-ons may cause Safari to unexpectedly quit or have performance issues

I found another Safari user with a similiar situation with the "unknown" file issue because it sounded familiar > https://discussions.apple.com/thread/3107341?start=0&tstart=0

Unfortunately, they havne't responded but I noticed their software is out of date. I noticed that your profile indicates you are running v10.6.7.

If that is the case, click your Apple menu icon top left in your screen. From the drop down menu click Software Update. That will take your Mac OS X to 10.6.8 and Safari to 5.1.7. That may make a difference.

edited by: cs

I am using Sophons V7.3.12C.

Uninstall Sophos according to the developer's instructions. Reboot and test.

When you booted in safe mode, did you have the same issues?

If you haven't already done so, please test Safari in the Guest account.

Enable guest logins* and log in as Guest. For instructions, launch the System Preferences application, select Help from the menu bar, and enter “Set up a guest account” (without the quotes) in the search box. Don't use the Safari-only Guest login created by "Find My Mac."

While logged in as Guest, you won’t have access to any of your personal files or settings. Applications will behave as if you were running them for the first time. Don’t be alarmed by this; it’s normal. If you need any passwords or other personal data in order to complete the test, memorize, print, or write them down before you begin.

Test while logged in as Guest. Same problem(s)?

After testing, log out of the guest account and, in your own account, disable it if you wish. Any files you created in the guest account will be deleted automatically when you log out of it.

*Note: If you’ve activated “Find My Mac” or FileVault in Mac OS X 10.7 or later, then you can’t enable the Guest account. Create a new account in which to test, and delete it, including its home folder, after testing.

Please read this whole message before doing anything.

This procedure is a diagnostic test. It won’t solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.

Third-party system modifications are a common cause of usability problems. By a “system modification,” I mean software that affects the operation of other software — potentially for the worse. The following procedure will help identify which such modifications you've installed. Don’t be alarmed by the complexity of these instructions — they’re easy to carry out and won’t change anything on your Mac.

These steps are to be taken while booted in “normal” mode, not in safe mode. If you’re now running in safe mode, reboot as usual before continuing.

Below are instructions to enter some UNIX shell commands. The commands are harmless, but they must be entered exactly as given in order to work. If you have doubts about the safety of the procedure suggested here, search this site for other discussions in which it’s been followed without any report of ill effects.

Some of the commands will line-wrap or scroll in your browser, but each one is really just a single line, all of which must be selected. You can accomplish this easily by triple-clicking anywhere in the line. The whole line will highlight, and you can then either copy or drag it. The headings “Step 1” and so on are not part of the commands.

Note: If you have more than one user account, Step 2 must be taken as an administrator. Ordinarily that would be the user created automatically when you booted the system for the first time. The other steps should be taken as the user who has the problem, if different. Most personal Macs have only one user, and in that case this paragraph doesn’t apply.

Launch the Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ If you’re running Mac OS X 10.7 or later, open LaunchPad. Click Utilities, then Terminal in the page that opens.

When you launch Terminal, a text window will open with a line already in it, ending either in a dollar sign (“$”) or a percent sign (“%”). If you get the percent sign, enter “sh” (without the quotes) and press return. You should then get a new line ending in a dollar sign.

Step 1

Copy or drag — do not type — the line below into the Terminal window, then press return:

kextstat -kl | awk '!/com\.apple/{printf "%s %s\n", $6, $7}'

Post the lines of output (if any) that appear below what you just entered (the text, please, not a screenshot.) You can omit the final line ending in “$”.

Step 2

Repeat with this line:

sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix)|edu\.mit|org\.(amavis|apache|cups|isc|ntp|postfix|x)/{print $3}'

This time, you'll be prompted for your login password, which won't be displayed when you type it. You may get a one-time warning not to screw up. You don't need to post the warning.

Note: If you don’t have a login password, you’ll need to set one before taking this step. If that’s not possible, skip to the next step.

Step 3

launchctl list | sed 1d | awk '!/0x|com\.apple|edu\.mit|org\.(x|openbsd)/{print $3}'

Step 4

ls -1A /e*/mach* {,/}L*/{Ad,Compon,Ex,Fram,In,Keyb,La,Mail/Bu,P*P,Priv,Qu,Scripti,Servi,Spo,Sta}* L*/Fonts 2> /dev/null

Important: If you synchronize with a MobileMe account, your me.com email address may appear in the output of the above command. If so, anonymize it before posting.

Step 5

osascript -e 'tell application "System Events" to get name of every login item' 2> /dev/null

Remember, steps 1-5 are all drag-and-drop or copy-and-paste, whichever you prefer — no typing, except your password. Also remember to post the output.

You can then quit Terminal.

Please read this whole message carefully, especially the warnings, before doing anything.

The changes to your configuration suggested here should be considered provisional; they may not solve your problem, or they may remove functionality that you find useful. If a third-party system modification that you want to keep is causing the problem, seek help from its developer.

WARNING: Back up all data now if you haven’t already done so. Before proceeding, you must be sure you can restore your system to its present state, even if it becomes unbootable. If you’re not sure you can do that, STOP — DON’T CHANGE ANYTHING. If you’re dissatisfied with the results of the procedure suggested below, restore from your backup. I will not be responsible for the consequences, and I will not be able to help, if you ignore this warning.

You should either remove or update the following system modification(s), if an update is available from the developer:

VirtualBox

and definitely remove at least the following:

ClickToFlash (obsolete version in ~/Library/Internet Plug-Ins)

† DivX

Drobo software

† MacFUSE

† MacKeeper

† NetBarrier

† RealPlayer

† SIMBL

† SpiceRack

† SyncMate

Whatever you remove must be removed completely, and (unless otherwise specified in this message) the only way to do that is to use the uninstallation tool, if any, provided by the third-party developer, or to follow his instructions. In some cases it may be necessary to re-download or even reinstall the software in order to get rid of it. I can't be more specific, because I don't install such things myself. Please do your own research.

Here are some general guidelines to get you started. Suppose you want to remove something called “BrickYourMac.” First, consult the product's Help menu, if there is one, for instructions. Finding none there, look on the developer's website, say www.brickyourmac.com. (That may not be the actual name of the site; if necessary, search the web for the product name.) If you don’t find anything on the website or in your search, email the developer. While you're waiting for a response, download BrickYourMac.dmg and open it. There may be an application in there such as “Uninstall BrickYourMac.” If not, open “BrickYourMac.pkg” and look for an Uninstall button.

Again, please don't ask me to do this research for you. You can do it better than I can, because I haven't installed the product and I may not even know what it is.

If you can’t remove software in any other way, you’ll have to erase your boot volume and perform a clean reinstallation of the Mac OS. Never install any third-party software unless you're sure you know how to uninstall it; otherwise you may create problems that are very hard to solve.

WARNING: Trying to remove complex system modifications by hunting for files by name often will not work and may make the problem worse.

I recommend that you never reinstall the modifications marked with a dagger (†) above, if any. If your problem is resolved after uninstalling all the above modifications and rebooting, but you still want to use some of those not marked with a dagger, you can experiment with putting them back, one at a time, testing carefully after each step. Keep in mind that system modifications may be incompatible with each other or with future Mac OS updates, so it may not be clear which one is at fault.

Uninstall SIMBL as follows.

Select Go ▹ Go to Folder… from the Finder menu bar, then enter the following text in the box that opens:

/Library

A folder will open. From that folder, delete the items listed below (some may be absent.) You may be prompted for your administrator login password.

Application Support/SIMBL

InputManagers/SIMBL.bundle

LaunchAgents/net.culater.SIMBL.Agent.plist

ScriptingAdditions/SIMBL.osax

Log out and log back in.

Make sure you never reinstall SIMBL. It’s likely to come bundled with another third-party system modfication that depends on it. If you want trouble-free computing, avoid software that makes miraculous changes to other software, especially built-in applications. The only real exception to that rule is Safari extensions, which are mostly safe, and are easy to get rid of when they don’t work. SIMBL and its dependents are not Safari extensions.

Remove MacKeeper by dragging the application to the Trash. It will pop up a dialog asking you why you want to uninstall it. You don't have to provide that information. Enter any text in the text box, then click the Uninstall button. Reboot.

IMPORTANT: MacKeeper has what the developer calls an “encryption” feature. If you used it to “encrypt” any of your files, “decrypt” them before you uninstall, or (preferably) restore the files from backups made before they were “encrypted.”

If you still have problems after making the suggested changes and rebooting, post again. Remember: if you don’t like the results of this procedure, you can undo it by restoring from the last backup you made before you started.