Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

msconvert

macrumors member
Original poster
Feb 27, 2004
58
0
I was browsing tonight (with many tabs open so I don't know which is the offending site) and the safari download window popped up and started downloading a file called 'alternate.incl'. In a command window, I ran 'strings alternate.incl' and this is what I got.

<snip>jiborish</snip>
;HTTP/1.1 200 OK
Date: Thu, 24 Feb 2005 02:46:09 GMT
Server: Apache/1.3.29
Last-Modified: Wed, 22 Dec 2004 07:44:22 GMT
ETag: "fbfdfa-ee-41c925d6"
Accept-Ranges: bytes
Content-Length: 238
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/plain
<p align="center">
<a href="http://www.jdoqocy.com/click-1354702-10375472" target="_blank">
<img src="http://www.awltovhc.com/image-1354702-10365047" width="468" height="60" alt="Two audiobooks for FREE from Audible" border="0"></a>
</p>

What bothers me is that the only thing that I did was to reload all of the open tabs and the download started. I just don't know if the file is malicious. Has anyone else experienced this? Is this just a poorly writting pop-up that failed?

I can post a full copy of the file if needed.

-Thanks
 
I think this might be the reason:
Content-Type: text/plain

The context is actually HTML, but in the header the web server is telling Safari it is a text file. Since it is not HTML, Safari downloads it instead of displaying it. Bascially the web server is mis-configured.

But don't worry about it being malicious, it is just downloading it, not opening it.
 
LimitedEdition said:
I think this might be the reason:
But don't worry about it being malicious, it is just downloading it, not opening it.

I worry that won't always be that way. Thanks though. Just trying to keep on top of things.
 
msconvert said:
I worry that won't always be that way. Thanks though. Just trying to keep on top of things.
MacOS X is not Windows. Not even executable files launch themselves following a download.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.