adverts are auto-downloading something on my computer

[MapleSyrupWaffles]

Every few days (randomly) an advert will trigger an automatic file download onto my computer. The file appears in the downloads folder, although if I click on it, nothing actually happens (overtly, anyway). They are html files and take me to a blank page; they are named with a random mix of letters and numbers - there are more than five just in my very recent downloads. Nonetheless, it is very disconcerting to see them appear in my downloads folder, and the adverts should be vetted properly so that potentially damaging ones like this do not happen.

I am using Firefox on a desktop Mac which has inbuilt virus etc protection. I can't tell which ad is doing this as it has usually changed by the time I have seen it. I have never clicked on any of the ads to trigger this. too many of the ads on here are already very dodgy looking and I wouldn't ever trust them any way, but this is particularly bad as it could be malicious.

[HebeMumsnet]

Hi there @MapleSyrupWaffles . Thanks for letting us know about this. We'll look into it now.

Would you be able to send us screenshots of what's happening and the url of the Mumsnet page you are on when it happens? If you could also send us a picture of the html files in your downloads that would be helpful.

We'll have a chat to our ads people in the meantime and find out if there's anything else that might help us work out what's going on here.

[MapleSyrupWaffles]

I will see if I can get a screen shot while it's happening, but it's hard to catch.

I happens on any pages on mumsnet.

Here is an example of the file that gets downloaded: s_LFyUNr.html

It opens an overtly blank webpage, but I am scared to think of what it might have done in the background.

People should be warned if your ad service is going to do this, as it could be potentially very malicious and a security risk.

[HebeMumsnet]

Hi again @MapleSyrupWaffles. We've made a change our end that should block all dowloading file ads now, so that should stop it but please do get in touch if you see this again.

[MapleSyrupWaffles]

Ok thank you, I'll let you know if it happens again

[MapleSyrupWaffles]

It has happened again;

the download this time is VGk_z3ED.html

The ads were nothing unusual - a sweaty betty and a lululemon one, which I've had before. I tried to get a screen shot but it disappeared before I could. It doesn't seem related to the ads I see. The download box just comes up showing that something has auto-downloaded. It only ever happens on MN. I was on the active topics page, and it happens as soon as I click back to that page from whatever thread I was reading.

[HebeMumsnet]

Hi again @MapleSyrupWaffles . Thanks for letting us know. We'll look into this now.

[MapleSyrupWaffles]

This still happens, and it's quite concerning that you are letting a potential security breach continue without warning people that they may have downloaded poentially dodgy stuff without realising it. How can you allow your ad system to download things automatically on to people's computers when there could be malware in it?

I have finally got a screenshot of an example.

[MapleSyrupWaffles]

I've had no replies from you about this, and it continues to happen. Here is another screenshot from today.

Can you guarantee that your ads are not downloading anything malicious when they do this?

[LilyMumsnet]

Hi OP

Can we ask if your browser is up to date?

Can you also let us know if you're clicking anything when the download starts - is it triggered by an action? Or do you land on a page without clicking anything and it happens?

[LilyMumsnet]

Hi OP

We think your Firefox may be set to 'always download without asking'.

Disabling automatic downloading is likely to stop this happening - could you please give it a go?

[MapleSyrupWaffles]

My broswer is up to date - it updates very regularly. I don't click on anything or do anything - it just happens when the ads load.

I can't find any specific setting in firefox that has 'download without asking', but nothing else downloads automatically without me clicking on it specifically; firefox is set to block pop-up windows and to warn me if websites try to install add-ons or anything else like that. It is set to entirely block deceptive and dangerous downloads, to warn me if anything is insecure or out of date, and to not auto-play videos or audio.

It is only on this site that I have ever had this problem.

[LilyMumsnet]

Hi OP

We understand and we are investigating where they are coming from, but at the moment we don't have more information to give you.

This happens on quite a few websites - especially since Firefox released an update where they switched automatic downloads on for all.

If you go to:

Settings > General > Downloads
and click
'Always ask where to save files'

Can you see if it helps?

[LilyMumsnet]

Sorry OP, these instructions might be more up to date so best to try them instead:

[MapleSyrupWaffles]

I will try the instructions and see what is set/what happens.

i still don't think the ad service should be even trying to download files, though!

[LilyMumsnet]

Thank you - please let us know.

We agree! That's why we want to be clear that we are investigating the downloads, regardless of any potential workaround. It's just that at the moment, it's isolated to an individual user and the more isolated an issue is, the harder it is to replicate.

[MapleSyrupWaffles]

it is happening again (or still). I have checked my settings and I do not have auto-downloads of anything one - it is now prompting me where/if to save the file, so I am able to say 'no' and cancel it. But i still do not think that your adverts should be trying to access people's computers this way and install things on them.

The most recent file was called 'wYOhUYMN'

[MapleSyrupWaffles]

Still happening, and there seems to be very little interest in stopping this!

I wonder if users realise that your adverts are automatically trying to download material onto their computers? It might be harmful, it might not, but it's dodgy as anything to just be doing this automatically .

[MapleSyrupWaffles]

First click on a post this morning, and three downloads were attempted!

The ad that came up on the side was for Freederm skin cream; the one lower down was also for Freederm cream but via Amazon link (I am not sure if the one above was also via amazon or not as it was slightly different).

[LilyMumsnet]

Hi OP,

We think we know where this issue is coming from. We are working on it but in the meantime, the below actions should put a stop to it:

• A browser cache update
• Empty caches
• Delete cached images
• Change Safari preferences and try not to leave Safari open
• Check the applications folder for anything unusual
• Clear history on web browsers (such as Google Chrome, Firefox, or Safari)

[MapleSyrupWaffles]

I'm on Firefox and everything is cleared and updated regularly, but I have done it again now.

[MapleSyrupWaffles]

Happened again, despite all that. There were two different ads showing - a mobility showroom in sudbury, and the freederm cream from amazon again.

[HebeMumsnet]

Morning @MapleSyrupWaffles. Thanks for letting us know. We're still looking into this with our third-party company that monitors ads for us and hopeful we'll get it sorted soon but all this information is really helpful in getting to the bottom of it. If you or anyone else spots this, just to clarify, this is the information that is most helpful.

1. A screenshot of the ad that triggered the download.
2. The landing page URL associated with the ad.
3. Any other information you can give about the file that was downloaded.

It doesn't look like anything you need to worry about but we do understand that it's very annoying and we're working to get it fixed as soon as possible.

[MapleSyrupWaffles]

I couldn't get a screen shot in time tonight, as the ad changed as I scrolled up. I didn't want to click on the ad to get the landing page of it, and hovering over didn't seem to show a URL, but again, the ad changed as I scrolled so it was hard to tell.

The file that it tried to download is called M-y1ORkj

[JoMumsnet]

Thanks for providing the file name, MapleSyrupWaffles - we're still investigating this issue. Can you remember which thread you were on when it happened this time? Thanks in advance - any extra information is helpful.

[MapleSyrupWaffles]

I think it was one in education, but I can't be 100% sure. I can check that easily enough next time.