Suspicious file? passback-1.js automatically downloaded without update request?

Search This thread

AndroidFreud

Senior Member
Jan 10, 2011
59
6
So, I got this notification today on my Xperia Z saying
Passback-1.js
Download complete

Now I got this with absolutely no update request at all from my end and I hadn't also recently installed any new app from the PlayStore

Just holding down on the notification to see the App Info says ' Download Manager 4.2.2. something

Google search shows absolutely nothing on this file and I was wondering if anyone else got this or know if it's a legit file?

C6602 running 4.2.2 Build number: 10.3.1.A.0.244

Any help is appreciated! Thanks!


Sent from my C6602 using xda app-developers app
 
Last edited:

mikaelkj

New member
Mar 3, 2013
2
0
Just got the same... Passback.js .. Very suspicious... Running CM10.1

So, I got this notification today on my Xperia Z saying
Passback-1.js
Download complete

Now I got this with absolutely no update request at all from my end and I hadn't also recently installed any new app from the PlayStore

Just holding down on the notification to see the App Info says ' Download Manager 4.2.2. something

Google search shows absolutely nothing on this file and I was wondering if anyone else got this or know if it's a legit file?

C6602 running 4.2.2 Build number: 10.3.1.A.0.244

Any help is appreciated! Thanks!


Sent from my C6602 using xda app-developers app
 

mikaelkj

New member
Mar 3, 2013
2
0
This is what it looks like - and the file.... It happened during the night so not using the phone...

Screenshot_2013-08-19-07-24-54.jpg
View attachment passback.js.zip
 

AndroidFreud

Senior Member
Jan 10, 2011
59
6
Yeah, figured by the.js extension.
Is there any way for any one to see what's inside this JavaScript and what it does.
So weird! And my antivirus isn't picking up anything on it either!

Edit: Just wanted to add, I think the file I got has a suffix -1 because the first time it downloaded I just disregarded the download without clicking on it. Which means it persistently downloaded the file again and renamed it to passback-1.js
If I remember correctly the first file that was downloaded is the same name as attached (passback.js)

Sent from my C6602 using xda app-developers app
 
Last edited:

Mazi1

New member
Aug 20, 2013
3
0
I also got this file on.my htc one, deleted it and got it also as passback-1.js.
Has anyone got information maybe also in other forums? Thanks
 

MagXDA

Member
Dec 15, 2006
27
3
The same behavior. Noticed today downloaded passback.js and passback-1.js.
Samsung Galaxy S4 (stock firmware).
I didn't install any new software recently.
And no information on Internet.
 

_creator_

New member
Apr 17, 2013
1
0
Two Websites here,

One points to an ad on a forum on bf-france

And the other is some project called powerpass on google code.

I'm on CM 10.2 and never got this.
 

Mazi1

New member
Aug 20, 2013
3
0
Pointing at passback-js shows the app download manager 1.3.602296. This is in the memory of the smartphone. How can I delete this app? Does anybody know? Behind passback is written pagead2.googlesyndication.com. This leads to a webpage that seems very strange and also information that had to do with virus but on computers. Does anybody know more about this?
 

lmbeeham

New member
Jun 5, 2012
1
0
Googlesyndication

Here is what I found:
"Google is a search engine designed to search for information on the World Wide Web. Information may consist of web pages, images and other types of files. Google achieves better results for many searches with an innovation called PageRank. This iterative algorithm ranks web pages based on the number and PageRank of other web sites and pages that link there, on the premise that good or desirable pages are linked to more than others.

GoogleSyndication.com is a very simple page. It's very easy to reach or answer our any query. You are in need of some image, news , book, article, scholar, any topic its just one click away."

I hope that helps.
 

ckyy

Senior Member
May 16, 2013
834
225
Code:
var c=this,d=function(a){var b=typeof a;if("object"==b)if(a){if(a instanceof Array)return"array";if(a instanceof Object)return b;var k=Object.prototype.toString.call(a);if("[object Window]"==k)return"object";if("[object Array]"==k||"number"==typeof a.length&&"undefined"!=typeof a.splice&&"undefined"!=typeof a.propertyIsEnumerable&&!a.propertyIsEnumerable("splice"))return"array";if("[object Function]"==k||"undefined"!=typeof a.call&&"undefined"!=typeof a.propertyIsEnumerable&&!a.propertyIsEnumerable("call"))return"function"}else return"null";
else if("function"==b&&"undefined"==typeof a.call)return"object";return b};var g,h,l,m,n=function(){return c.navigator?c.navigator.userAgent:null};m=l=h=g=!1;var p;if(p=n()){var q=c.navigator;g=0==p.indexOf("Opera");h=!g&&-1!=p.indexOf("MSIE");l=!g&&-1!=p.indexOf("WebKit");m=!g&&!l&&"Gecko"==q.product}var r=g,s=h,t=m,v=l,w=function(){var a=c.document;return a?a.documentMode:void 0},x;
a:{var y="",z;if(r&&c.opera)var A=c.opera.version,y="function"==typeof A?A():A;else if(t?z=/rv\:([^\);]+)(\)|;)/:s?z=/MSIE\s+([^\);]+)(\)|;)/:v&&(z=/WebKit\/(\S+)/),z)var B=z.exec(n()),y=B?B[1]:"";if(s){var C=w();if(C>parseFloat(y)){x=String(C);break a}}x=y}
var D=x,E={},F=function(a){var b;if(!(b=E[a])){b=0;for(var k=String(D).replace(/^[\s\xa0]+|[\s\xa0]+$/g,"").split("."),J=String(a).replace(/^[\s\xa0]+|[\s\xa0]+$/g,"").split("."),N=Math.max(k.length,J.length),u=0;0==b&&u<N;u++){var O=k[u]||"",P=J[u]||"",Q=RegExp("(\\d*)(\\D*)","g"),R=RegExp("(\\d*)(\\D*)","g");do{var e=Q.exec(O)||["","",""],f=R.exec(P)||["","",""];if(0==e[0].length&&0==f[0].length)break;b=((0==e[1].length?0:parseInt(e[1],10))<(0==f[1].length?0:parseInt(f[1],10))?-1:(0==e[1].length?
0:parseInt(e[1],10))>(0==f[1].length?0:parseInt(f[1],10))?1:0)||((0==e[2].length)<(0==f[2].length)?-1:(0==e[2].length)>(0==f[2].length)?1:0)||(e[2]<f[2]?-1:e[2]>f[2]?1:0)}while(0==b)}b=E[a]=0<=b}return b},G=c.document,H=!G||!s?void 0:w()||("CSS1Compat"==G.compatMode?parseInt(D,10):5);!t&&!s||s&&s&&9<=H||t&&F("1.9.1");s&&F("9");s&&F("9");!v||F("528");t&&F("1.9b")||s&&F("8")||r&&F("9.5")||v&&F("528");t&&!F("8")||s&&F("9");var I=function(){var a;for(a=window;a;){("function"==d(a.postMessage)||s&&a.postMessage)&&a.postMessage("goog_passback","*");if("goog_passback_brake"in a.frames)break;if(a==a.parent)break;a=a.parent}},K=["google_passback"],L=c;!(K[0]in L)&&L.execScript&&L.execScript("var "+K[0]);for(var M;K.length&&(M=K.shift());){var S;if(S=!K.length)S=void 0!==I;S?L[M]=I:L=L[M]?L[M]:L[M]={}};I();

This is the code. all i could read out of it was opera lol.
 

electricbullet9

New member
Sep 1, 2013
1
0
Got the same file on my mac last night... around midnight, central time. I remember being on pandora when it happened. I just redownloaded it, and it seems to be from an ad of some sort. not exactly sure what it contains though. It does not seem harmful to my mac, but it might be to a mobile device.
 

blackknigt

Member
Aug 25, 2013
33
4
Google Ads Maybe?

Pointing at passback-js shows the app download manager 1.3.602296. This is in the memory of the smartphone. How can I delete this app? Does anybody know? Behind passback is written pagead2.googlesyndication.com. This leads to a webpage that seems very strange and also information that had to do with virus but on computers. Does anybody know more about this?

Judging from this, i think it could be an update on google's ads service, as pagead2.googlesyndication.com is the google AdSense/AdWords Domain, wich uses JavaScripts for displaying ads.
 
  • Like
Reactions: Kriegar

OnlinePredator

Senior Member
Feb 6, 2009
641
87
The end result being delete?

Doesn't look like it does anything. Delete the file and all good. The fact it downloaded the file and did not execute means you are fine if it was anything bad. Prob just the website didn't code something right and passed back the wrong type like json instead of HTML etc.
 

ponl0002

New member
Mar 15, 2009
4
0
Doesn't look like it does anything. Delete the file and all good. The fact it downloaded the file and did not execute means you are fine if it was anything bad. Prob just the website didn't code something right and passed back the wrong type like json instead of HTML etc.
Got the file downloaded on my Note 2. hmm
 

blackknigt

Member
Aug 25, 2013
33
4
I dont think you need to delete the file, its a google script file so leave it there

Sent from my C6603 using xda app-developers app
 

PeterVroegindewey

New member
Apr 22, 2007
1
0
Leave it there?

I wonder if there someone could tell what the code does. (My daughter went to a lyrics site (m.metrolyrics.com) and it downloaded this js file on her Note2 which would support online predator's responce,)
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    Google Ads Maybe?

    Pointing at passback-js shows the app download manager 1.3.602296. This is in the memory of the smartphone. How can I delete this app? Does anybody know? Behind passback is written pagead2.googlesyndication.com. This leads to a webpage that seems very strange and also information that had to do with virus but on computers. Does anybody know more about this?

    Judging from this, i think it could be an update on google's ads service, as pagead2.googlesyndication.com is the google AdSense/AdWords Domain, wich uses JavaScripts for displaying ads.