Why are mysterious dk.html files automatically downloading upon launch of newly updated Safari Version 5.1.7 (6534.57.2)?

It is not just Drudge. I left for 4-5 hours & had closed the Drudge tab after my last post. Also had emptied the trash & checked the D/L file & no dk.html. Just got home & checked now & had many copies of dk.html in the D/L folder again.

Web sites open on tabs on Safari while I was gone; USA Today, Fox News, Cox TV Listings & this Apple Support site.

Can anyone verify that if we trash the dk.html files from the D/L folder & do not click on them, that no harm to our Macs & no malware installed?

Edit: Looks like we found the culprit - simply opening the raw text of the file shows the company. As stated earlier, Casale Media and rubiconproject.com are to blame. Its some strange cookie. Check out the raw code below

Original Message:

I'd like to weigh in with my own details and specs.

I first noticed this after visiting two websites yesterday : diii.net (A fansite for a game called Diablo 3, hosted at diablo.incgamers.com) and the Drudge Report (drudgereport.com), just as others have claimed that site is causing this DK.html to appear.

I've seen it on two systems - an iMac running 10.6.8, and another iMac running 10.7.2.

I cannot get this to reoccur on my Joint Venture loaner laptop, running Lion, however. Also, my main laptop, a Retina MBP running the latest version of 10.8 Mountain Lion, has not had this issue, and frequents the aformentioned sites very regularly.

I'm assuming that it is, as others have stated, a problem with Java versions, and the manner in which the cookies are handled.

Can we begin to post our operating systems to better diagnose the dk.html file origin? I'm happy to upgrade all of my computers to Mountain Lion this afternoon to avoid a hacker.

Edit: Here are the contents of every dk.html file that I have access to (about 30 copies from one session on the internet).

<html>

<head>

<meta http-equiv="Pragma" content="no-cache">

<meta http-equiv="expires" content="0">

<style type="text/css"> body {margin:0px; padding:0px;} </style>

<script type="text/javascript">

rubicon_cb = Math.random(); rubicon_rurl = document.referrer; if(top.location==document.location){rubicon_rurl = document.location;} rubicon_rurl = escape(rubicon_rurl);

window.rubicon_ad = "3200902" + "." + "js";

window.rubicon_creative = "3301365" + "." + "js";

</script>

</head>

<body>

<!-- Casale Media: 300x250 (Rectangle) -->

<script type="text/javascript">

document.getElementById("1131607").style.width="300px";

</script>

<script type="text/javascript">

var CasaleArgs = new Object();

CasaleArgs.version = 2;

CasaleArgs.adUnits = "4";

CasaleArgs.casaleID = 124853;

</script>

<script type="text/javascript" src="http://js.casalemedia.com/casaleJTag.js"></script>

<!-- DO NOT MODIFY --><script>var _comscore = _comscore || []; _comscore.push({ c1: "8", c2: "6135404", c3: "15", c4: "12414", c10: "3301365" }); (function() { var s = document.createElement("script"), el = document.getElementsByTagName("script")[0]; s.async = true; s.src = (document.location.protocol == "https:" ? "https://sb" : "http://b") + ".scorecardresearch.com/beacon.js"; el.parentNode.insertBefore(s, el); })();</script><DIV STYLE="height:0px; width:0px; overflow:hidden"><IFRAME SRC="http://tap2-cdn.rubiconproject.com/partner/scripts/rubicon/emily.html?rtb_ext=1& pc=6005/12414&geo=na&co=us" FRAMEBORDER="0" MARGINWIDTH="0" MARGINHEIGHT="0" SCROLLING="NO" WIDTH="0" HEIGHT="0" style="height:0px; width:0px"></IFRAME></DIV>

</body>

</html>

Message was edited by: cdolan92

I found this in the MacIntouch forums (quote is down towards the bottom. Thread is on the same file:

http://www.macintouch.com/readerreports/security/index.html