Recent Java Script prompts – what are they?

[David JuppParticipant @davidjupp51506]

In the last few days (could be since updating Win10 to so-called 'Creators update'  ) I've noticed a file download prompt appear when I open a thread for the first time. Is says;

What do you want to do with ac.js?

From: static-tagr.gd1.mookie1.com

Does anyone have any idea what this is?

 

Edited By David Jupp on 24/04/2017 08:20:49

Edited By David Jupp on 24/04/2017 08:21:16

[David JuppParticipant @davidjupp51506]

Download message when opening new thread

[Neil WyattModerator @neilwyatt]

I don't think it is part of our site, it seems you may have picked up some malware.

Neil

[David JuppParticipant @davidjupp51506]

Only on this site Neil. I also think that any serious malware wouldn't announce itself as a download – but I will check my system.

[JourneymanParticipant @journeyman]

Apparently the file is something required by Flash Player. So probably one of the ads has flash embeded. Whether it is safe or not is a different matter, which I am afraid I cannot assist with. Flash is generally not favoured any more, as it is very prone to malware, but plenty of websites still use it.

John

[David JuppParticipant @davidjupp51506]

Thanks John – certainly sounds plausible.

[SillyOldDufferModerator @sillyoldduffer]

Posted by David Jupp on 24/04/2017 08:40:42:

Only on this site Neil. I also think that any serious malware wouldn't announce itself as a download – but I will check my system.

It's a security feature in the browser that's warning you that a download is being requested. (Red light comes on!)

The message is a known problem, and it effects more than just this forum. (Red light starts flashing!!!)

You can find out who owns a domain name like "static-tagr.gd1.mookie1.com" by googling "dns whois".

For example, you get a 'proper' response querying "model-engineer.co.uk":

Domain name:
model-engineer.co.uk

Registrant:
MyHobbyStore Ltd

Registrant type:
UK Limited Company, (Company number: 5649018)

Registrant's address:
Hadlow House
9 High Street
Green Street Green
Orpington
Kent
BR6 6BG
United Kingdom

Data validation:
Nominet was able to match the registrant's name and address against a 3rd party data source on 10-Dec-2012

Registrar:
First-Web Network Services Ltd t/a First-Web & Jevvy Telecom [Tag = FIRST-WEB-NET]
URL: http://www.first-web.net

Relevant dates:
Registered on: 10-Mar-2006
Expiry date: 10-Mar-2018
Last updated: 17-Feb-2017

Registration status:
Registered until expiry date.

Name servers:
ns1.first-web.co.uk 92.63.128.66
ns2.first-web.co.uk 88.150.169.195

WHOIS lookup made at 09:50:26 24-Apr-2017

In comparison "static-tagr.gd1.mookie1.com" isn't allocated to anyone. Perhaps the original owner of the domain name, having been detected as a bad boy, has let the registration lapse? But don't rely on it being safe now.

As Neil suggests, your computer has been infected by something naughty. Here's a page describing what to do about it.

Dave

[Author]

Posts