f.txt downloading from forum

Zezti · September 23, 2020

This is a weird one, but twice now over the last couple days while browsing the foum a text file named "f.txt" has tried to download. Its full of web script I think, but I'm no coder so can't be sure. Deleted it just in case.

First time was in the transfer threat, and it just happened again while on the Everton forum page: https://www.grandoldteam.com/forum/forums/everton-forum.2/

adblocker is off, definitely only on this site - nowhere else so not my machine.

chrismpw · September 23, 2020

Transfer threat eh? Interesting take. :cheers:

Lelouch · September 23, 2020

Apparently it's to do with certain ads from google, Obviously for others don't download it and use MalwareBytes to check just in case.

Zezti · September 23, 2020

Happened again, definitely from googleads.

I can't even paste the contents on here. Comes up with an error.

chrismpw said:
Transfer threat eh? Interesting take.

That's what I get for browsing the forum while on a zoom call.. :blush:

Nymzee · September 23, 2020

I got that too before.

cronullasharks · September 23, 2020

Same, was wondering what it was.

dead_soft · September 23, 2020

Yep, and here

atrottel · September 23, 2020

Apparently it is a 'fix' from Google and others (thus why you see it with Google ads) to stop a particular method of injecting malicious code.

(More info: https://stackoverflow.com/questions/28535603/google-chrome-forcing-download-of-f-txt-file first answer)

Zezti · September 23, 2020

atrottel said:
Apparently it is a 'fix' from Google and others (thus why you see it with Google ads) to stop a particular method of injecting malicious code.

(More info: https://stackoverflow.com/questions/28535603/google-chrome-forcing-download-of-f-txt-file first answer)

That might be it, but I'm using Firefox which that answer says is likely unaffected.

GrandOldTeam · September 23, 2020

Thanks for letting us know - I'll flag it with our ad agency. Pretty sure it's a bug with Firefox's new release and nothing malicious, instead of running a script, it's trying to download.

Be careful with search engines searches on the issue, there's always opportunists.

Zezti said:
That might be it, but I'm using Firefox which that answer says is likely unaffected.

That discussion is 5 years old. More recent;

Lloydystark · September 24, 2020

Keep getting the message on my I pad

brieverton · September 24, 2020

I have gotten this several times today.

GrandOldTeam · September 25, 2020

Update;

Thanks for your email and for bringing this to our attention- I've looked further into this issue this morning and had the following response from our Ad partner.

"Earlier this week, reports of a dialog box that asked users if they wanted to download 'f.txt.js' began popping up. This download dialog is due to an issue on Google’s end and is happening throughout the ecosystem.

To provide a bit of context here—the file has to do with MIME type. Typically these files will automatically download for you, however in some special circumstances (like referencing the file via a script tag) it loads the file directly rather than downloading it."

Although understandably frustrating for some users to encounter, We can assure you that this is not something that should cause concern, and Google and their ad protection partners are looking into ways in which this is preventable from happening to their clients and users.

Once I have some more information on this issue I will get back to you with further updates.

Thanks again for bringing this to our attention,