Jump to content

Safeframe.googlesyndication.com Download Popup


Recommended Posts

Has anyone else been getting this popup recently, asking "Do you want to allow downloads on XXXXXX.safeframe.googlesyndication." 

I've encountered this type of popup on other sites before, but this one appears to be different, as those I've encountered before have specific information related to those sites, but this one is generic. Also, it seems to be following me around to other websites as well.

As with similar popups on my iPhones, I've immediately quit Safari before going any further. I ran Malwarebytes afterwards, and it indicates no issues, but I was curious as to just what this is and what potential problems it may pose.

Link to post
Share on other sites

That all sounds normal to me, but I don't really know your  setup.

What macOS are you running, what browser and version are you seeing this in? Are you running a third party firewall and what browser extensions / add-ons do you have installed? Do you have browser preferences set to alert you to fraudulent web sites?

Here's what Apple has to say: https://support.apple.com/HT203987

 

Link to post
Share on other sites

Just had it happen again, and this time it started downloading a f.txt.js.download file without my permission.

I ran Malwarebytes afterwards, and it said there were no issues, and there was nothing in my extensions. Meanwhile, I dumped the partially loaded file into trash and immediately dumped it.

Any suggestions? This has got me spooked, now that it is downloading files without my permission.

Link to post
Share on other sites

If you have JavaScript turned on in your preferences, it isn't surprising that a js (javascript) file would be allowed to download to your computer. If you disallow javascript, it is quite likely that many websites would not work properly as javascript is widely used for important functions.

Where did you find the f.txt.js file? Next time you get one please send it to me in a PM before deleting it.

You said something about the popup looks different. Please take a screenshot of it and include it with your next reply.

I still need to know more about your setup to comment further.

Edited by alvarnell
Link to post
Share on other sites

I've been spending some time looking into what safeframe.googlesyndiation is all about. I'll start by assuring you that it has no association whatsoever with malware, rather it's a mechanism that's used by google to provide websites with safe advertising via Adsense

That being said, I can't think of any reason for you to be using that service unless you have a website hosted on your computer.

Edited by alvarnell
Link to post
Share on other sites

The file you posted here, when unzipped is zero bytes. And please don't post suspected malware here again. Either send it by Private Message (click on member name and then use the "Message" button) or post it to the Research Center "Newest Mac Threats" forum.

I'm afraid we are unable to provide additional help without having at least some of the information requested earlier. 

- What browser (and version) are you using.

- What extensions or add-ons do you have installed in that browser?

Link to post
Share on other sites

My sincere apologies.

When this "outbreak" first occurred, I was using Safari 13.1.2. Had upgraded using 14.0 when the last of the popups occurred. As for extensions, none at the moment.

The latest word going around now is that this is a broken piece of Google code, and that they are aware of it. 

Link to post
Share on other sites

Broken code was my conclusion, as well.

I'm guessing that you probably accidentally approved a download at some point and Safari remembers that and allows them without asking now. To fix that open Safari Preferences->Websites and click on "Downloads" in the left hand "General" column. Now look for the "safeframe.googlesyndication.com" or perhaps just "googlesyndication.com" and click the "Remove" button.

Link to post
Share on other sites
  • Staff

This is not malware. It's a JavaScript file that an ad being delivered through Google's advertising system is trying to load, but it's downloading instead. As GuruGuy mentioned, use an ad blocker to block the offending ads and forget about it. This is merely an annoyance, not a threat.

  • Like 1
Link to post
Share on other sites
  • 4 months later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.