SillyDog701

[powerwalk]

Recently, I receive a constant popup when starting Firefox 3.6.18, or browsing anywhere on the internet. The Title Bar states: Opening s, and below that, "You have chosen to open" "s" which is a: application/json from http://www.google.com

It gives me the option to Open or Save. I always click Cancel.

I did a google search but still don't completely understand what application/json is. And why from google when I'm not even on their site. My browser opens with a blank page.

Attempted to contact both google and Mozilla about this but couldn't find a place to email them...all forums.

Anyone else experiencing this popup. Thanks for any help.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18 (.NET CLR 3.5.30729)

[Antony]

Are you able to take a screenshot?

UserAgent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.19) Gecko/20110707 AlexaToolbar/alxf-2.13 Firefox/3.6.19

[Fulvio]

You should be able to reject popup. This would be in Tools|Options|Contents|Block popups (you can,always, make exceptions for sites which you want to deliver a popup.
In any event, it appears that there is something in your computer, which wants you install something (i.e. application). Do a scan with a program like Malwarebytes AntiMalware.

UserAgent: Mozilla/5.0 (Windows NT 5.1; rv:5.0) Gecko/20110706 Firefox/5.0 SeaMonkey/2.2

[powerwalk]

Antony. I did but then deleted it after I posted here. Cable connection was down for 14 hours yesterday so I didn't have have an opportunity to take another. Will do the next time it pops up.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18 (.NET CLR 3.5.30729)

[powerwalk]

You should be able to reject popup. This would be in Tools|Options|Contents|Block popups (you can,always, make exceptions for sites which you want to deliver a popup.
In any event, it appears that there is something in your computer, which wants you install something (i.e. application). Do a scan with a program like Malwarebytes AntiMalware.

Fulvio, thanks for your input. Unfortunately, I am aware/have done everything you suggest.

As far as I know my computer is completely buttoned up. I run Malwarebytes, Avast, RootkitRevealer and have Win Patrol along with a software firewall for outgoing call home attempts, and my routers built in firewall handles incoming malicious items. The desktop that's receiving this popup is connected via ethernet. My laptop and tablets are the only tech toys that use wifi.

If you have any other thoughts, please let me know.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18 (.NET CLR 3.5.30729)

[powerwalk]

Here you go, Antony. Any ideas? It's really persistent today.

http://sanvicentevalleyclub.org/Popup.html

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18 (.NET CLR 3.5.30729)

[Fulvio]

http://sanvicentevalleyclub.org/

I don't want to create a link, if there is any problem, but I opened the parent website, and I was not prompted to download or save anything. It seems to be a harmless site.
But, if nothing was done to select a download, I would contact the site, which has an e-mail address listed in it.
tbgdesign@yahoo.com
I will report if anything happened, after opening the site.
The .json format is derived from javascript.

The JSON format is often used for serializing and transmitting structured data over a network connection. It is primarily used to transmit data between a server and web application, serving as an alternative to XML.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18

[powerwalk]

Fulvio, I didn't mean to confuse you with the jpeg. Since Antony asked to see a screen capture, and I couldn't find any way on Sillydog to post an image file, I put it on an external page. The site you navigation (and I assume to the home page) I create five years age for our local woman's club. The yahoo mail contact address you quoted was used instead of using my real address. This site has nothing to do with my problem...it was simply a vehicle to post the screencapture.

I truly appreciate your taking the time to investigate my problem. I didn't expect anyone would be that thorough in following up. Thanks again, and yes, my site is harmless.

Also, I did read all about the JSON format, but why am I getting this only on my one desktop and not my laptop or the other older desktop?

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18 (.NET CLR 3.5.30729)

[PaulD]

I haven't seen the 2nd response option before - DownThemAll!
A quick Google search shows that it is a Downloader addon.
1. Perchance is this downloader installed - and involved - only on this one computer?
2. Does the popup occur if Firefox is started in Safe mode?
One hit from a Google search for [ "s.js" google ] is this. Look at the first segment of code in paragraph "The HTML Code".
3. What added Toolbars are active?

UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1

[powerwalk]

I haven't seen the 2nd response option before - DownThemAll!
A quick Google search shows that it is a Downloader addon.

1. Perchance is this downloader installed - and involved - only on this one computer?
No it' also on my laptop which is not experiencing the problem

2. Does the popup occur if Firefox is started in Safe mode?
That I haven't tried. Thanks for suggestion

One hit from a Google search for [ "s.js" google ] is this. Look at the first segment of code in paragraph "The HTML Code".

Very interesting read. I just disabled the add-on and let's see what happens.

3. What added Toolbars are active?

No added Toolbars.

Will report back. Let's hope you found the culprit

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18 (.NET CLR 3.5.30729)

[Antony]

Here you go, Antony. Any ideas? It's really persistent today.

http://sanvicentevalleyclub.org/Popup.html

Thank you for the screenshot.

I haven't seem they myself, but for my own blog, sometimes, I got a dialogue similar to that (when posting a comment). General I click "Cancel", and everything goes well.

UserAgent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.19) Gecko/20110707 AlexaToolbar/alxf-2.13 Firefox/3.6.19

[powerwalk]

Problem solved. I uninstalled DownloadThemAll as PaulD suggested, and haven't had another popup in four days. Previously, I was averaging about ten popups a minute and it was more than annoying. But still don't understand why my laptop wasn't affected by this add-on, just the desktop.

Thanks to all of you who took the time to help me.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18 (.NET CLR 3.5.30729)

[PaulD]

Glad you focused the problem.

If you want to experiment a bit, and would like to have the downloader available --- things to examine and try -

Check if the problem reoccurs when ---
1. Re (fresh) install the Downloader.
2. Clear Cache; Cookies, in particular those for the Downloader.
3. Clear the other Histories - Browser, Form, etc.
4. Create a new (test) Firefox profile - results in a set of clean FF files.

Compare the three computers - the 'history' of the Firefoxes and their add-ons.

UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1

[powerwalk]

You have an analytical mind, PaulD, and obviously have been working with computers for a long time.

I thank you for your excellent suggestions, but have decided I can live without this particular Downloader. I've bookmarked the page though should I have a change of heart in the future.

Keep the good advice flowing on Sillydog

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18 (.NET CLR 3.5.30729)

[Edward]

I have occasionally seen something similar from other web sites, but not from Google. My first guess it that there is a problem with the web page the poster was on, at the time.

UserAgent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.16) Gecko/20110701 Iceweasel/3.5.16 (like Firefox/3.5.16)