Weird Javascript problems since XP updates

I did a google search for "Unsafe JavaScript attempt to access frame with URL Domains, protocols and ports must match" it seems this problem has been around for a while, mainly affecting Chrome users with sites like facebook, youtube, etc. however, one site poster says the problem was with chrome only but firefox and safari were ok I have firefox, chrome, and IE … they all have the same problem, and in the consoles the description is the same. One person claimed that an extension he had in chrome was the culprit, I disabled the few extensions in chrome I have, and the problem is still there.

Well, I get to http://www.telegraph.co.uk/ with no problems with IE9, and I note most IE problems are due to a conflict with an add-on. I just tried FF and Chrome and they worked too.

So that would suggest a security setting or the like on your machine. Any other computers on your network you can try?

Do you have a System Restore point from before those 3 updates?

Running CCleaner is why MSE keeps saying you need to do a Scan. You need to go into CCleaner's settings, Application tab, all the way to the bottom and uncheck

MS AntiMalware
MS Management Console
MS Security Client

One or more of those entries (I have all 3 unchecked) causes the MSE log file to be deleted which MSE uses to determine if a scan has been done or not. Crappy way to keep track of it but that's how it works. Anyway, once you do that MSE will remember scans and not prompt you every day.

Edit: Also, Javascript has nothing to do with Java. It is almost completely contained in the web browser you are using and is affected by security settings as Digerati mentioned.

I keep forgetting those CCleaner settings affect some people. They don't for me but I have seen MS AntiMalware affect others. Maybe they run CCleaner much more often than me. I might suggest you try de-selecting one at a time instead of all three.

well here I am with the same problem I surfed around various forums that mentioned this javascript problem for other sites and browsers, but nothing seems to help. I tried changing browser settings in IE, to no avail. I turned off MSE … still the same I discovered that Windows Firewall was back on, and shut it off (I have a different firewall) I'm at a complete loss here, I'm going to try restoring to a point before the problem and see what happens. I'm also going to see if my neighbor's computer has the same problem on the sites I am. will report back after the restore.

system restored back to Dec. 1st, long before problem began no effect a friend of mine in California has reported that she cannot access the link in question either

a friend of mine in California has reported that she cannot access the link in question either

That raises doubts, but no conclusion.

If you listed the urls in question, it might help.

Here's an example:
http://blogs.telegraph.co.uk/news/tomchive…mment-740777847

This comment has 2 recommends

As you can see, "2 recommends" is a link (that should produce a popup with the avatars of the people who logged the recommends)

Then there is "recommend" which still works for me, as well as "reply" and "report"

I just clicked on it, and here is what the console in Chrome produced:

Uncaught SyntaxError: Unexpected token ILLEGAL
secure-us.imrworldwide.com/cgi-bin/m?ci=att-
ca&at=view&rt=banner&st=image&pc=283806&ca=20382&cr=413878&ce=1546&pr=iag.sid,2500012227&pr=iag.tfid,2082&pr=iag.advid,20382&pr=iag.brn,ATTFlash&pr=iag.cmpid,20382&pr=iag.cte,413878&pr=iag.stid,1546&pr=iag.pageid,283806&r=[timestamp]?801048669:1

Uncaught SyntaxError: Unexpected token ILLEGAL tag.admeld.com/match?admeld_adprovider_id=99&expiration=1355841649&external_user_id=673851095384752919,1CAESEPEWaCcJ4gNTZkdLoX3FBM4:1

Unsafe JavaScript attempt to access frame with URL http://blogs.telegraph.co.uk/news/tomchiversscience/100194572/connecticut-school-shooting-we-need-to-treat-mass-killings-as-an-epidemiological-problem/#comment-740777847 from frame with URL
http://ad.doubleclick.net/adi/N5398.interc…ord=1355755249?.
Domains, protocols and ports must match.

Note: this happens on all the sites I go to, not just the Telegraph.
And the console shows basically the same thing regarding unsafe javascript and illegal tokens, etc.

Sorry, but I think someone else needs to step in here as I am not following. When I click on your link above, I see many more than "2 Recommends". And when I click on "Recommended by 1 person" or "Recommended by 2 people" I get nothing - no avatars or info about the person who recommended it. They do not appear to be links. And that's with IE9, FF and Chrome. If I click on Recommend, it turns to "Liked".

Correct. Up until about a week ago, it worked fine for me. Now if it only happened on the Telegraph, I'd write it off to something they did, but it happens on every site I comment in. I sent a copy of the Chrome console log that I posted here … to a friend who is more savvy than me with this stuff, and he said it sounds like some kind of security setting that's been changed on my computer. But I can't find anything that works. Does any of that javascript stuff I posted give you any hints? And thanks for taking all this time to look at this problem I'm having, not exactly the biggest problem in the world

Hi ebayvictim,

Like Digerati, I browsed around to see if I could reproduce your error alert status, using various browsers and conditions.
Couldn't produce the problem.

My initial suspicion was that you may have some separate security utility(s) installed which might be provoking the problem, or which doesn't function well after the recent MS Updates. (came to mind because you state that you use a different firewall) Could be. Are you aware of anything of that sort.

But then I also recognize that the error detail references the login identity with DISQUS

* - Uncaught ReferenceError: gettext is not defined telegraphblogs.disqus.com/show_user_votes.js?post_id=736909472&1355553209936:5

I am not a log-in registered member of DISQUS, and am not experiencing the problem.
Of course, I also do not receive any of the extra features (including ID of those who Recommend, etc.)

At this point, I would be most suspect of some coding change at DISQUS or the affect that a recent MS Update may have had upon DiSQUS which DISQUS has not yet become aware of, or has yet to update its own software with a fix.

The above comment doesn't "help", but may give you an avenue to explore with DISQUS.

Best Regards

Hey Doug,

Thanks for your input.

All I have on my computer is MSE and Sygate. I know Sygate isn't supported anymore, but it's still an excellent tool for someone like me because it allows me to easily block suspicious IPs and it tells me whenever something is trying to access my computer or if something is trying to connect to a remote address. I've been using it for some time now since it was recommended by someone here at WTT a while back, and I've never had a problem with it.

Now here's a strange thing I just discovered as I'm investigating this javascript quirk:

I decided to check my console on some other websites, like my email and even what the tech…and these javascript alerts are on all of them.
This one is from what the tech:

Unsafe JavaScript attempt to access frame with URL http://www.whatthetech.com/ from frame with URL http://www.facebook.com/plugins/recommenda…color=%23217abf. The frame requesting access set 'document.domain' to 'facebook.com', but the frame being accessed did not. Both must set 'document.domain' to the same value to allow access.
recommendations.php:417

This is one of about 2 dozen produced from my Yahoo page:

Unsafe JavaScript attempt to access frame with URL http://us.mg5.mail.yahoo.com/neo/launch?.rand=0vh9d1huos1g6 from frame with URL http://3cp9lcoq32dpn-c.c.yom.mail.yahoo.co…umb=HU.XSqOn/rW. Domains, protocols and ports must match.
chrome-extension://bhmmomiinigofkjcapegjjndpbikblnp/content/search.js:102

This is what I get when I go to YouTube:

Uncaught TypeError: Cannot read property 'length' of undefined www-home-vflVATumV.js:12
Failed to load resource: the server responded with a status of 404 (Not Found) http://i2.ytimg.com/i/AFPZsRI6LxxxxSOf3__Ynw/1.jpg
Failed to load resource: the server responded with a status of 400 (Bad Request) http://www.youtube.com/channel_details_ajax

Oddly enough, I get no alerts of any kind on Google or Gmail.

I'm starting to wonder if I should go to the infection forum and run some logs to see if I've got a bug of some kind.

I'm starting to wonder if I should go to the infection forum and run some logs to see if I've got a bug of some kind.

Not a bad idea at all.

I remain suspicious of the DISQUS, and risks related to its widget:

Some commentators have noted the privacy issues inherent in the use of services like Disqus, which serve their content through third party JavaScript widgets.[10][11][12]

As with other embedded web widgets such as like buttons, the Disqus widget acts as a web bug which tracks a users activities, even when they are not logged in, across different sites that use the Disqus commenting system. Information tracked by Disqus.com, which may be disclosed to 3rd parties, includes pseudonymous analytics data such as a users IP address, their web-browser's version and installed add-ons, and their referring pages and exit links.[13] Although this data is referred to by Disqus as "Non-Personally Identifiable Information", such data, when aggregated, has been shown to be usable for de-anonymizing users.[14]

Users wishing to avoid these issues may opt to install a privacy-enhancing web browser extension, such as Ghostery or DoNotTrackPlus, which identify widgets such as Disqus as web-bugs[15][16], and allows them to be blocked; this renders Disqus-powered commenting sections unviewable.

Disqus has also been criticized for publishing its registered users' entire commenting histories, along with a list of connected blogs and services, on the publicly viewable user profile pages.

Quote is from: http://en.wikipedia.org/wiki/Disqus

If the machine receives a clean bill of health after malware removal investigation, you can come back to this Thread, or start a new one here in this related Forum.


First item of business would likely be uninstallation of DISQUS software and testing to see if the errors cease at that point.

Best Regards

I'm starting to wonder if I should go to the infection forum and run some logs to see if I've got a bug of some kind.

I agree, it would not hurt.

I don't believe DISQUS is a malicious product, but that does not mean it is not a targeted product. I mentioned malware in my opening post you replied stating MBAM came out clean, but SAS found and supposedly cleaned wintools huntbar. I wonder if some collateral damage did not occur during the removal, or if it really is fully removed.

While I agree uninstalling DISQUS while troubleshooting this problems is a good idea, I would like to see a clean bill of health from the malware removal team.

Doug and Digerati, Disqus was the greatest thing that ever happened to a big mouth like me who loves to comment and debate in various news outlet forums I don't know what software or widgets Disqus offers, but I don't have anything downloaded on my computer from them, I simply use their website hosted dashboard which collates all my comments on the web into three handy pages, showing my comments, replies to my comments, and comments of people I'm following … all in chronological order with hot links directly to the comments. One thing I did notice early on was how many processes were taking place with each link I would select, there are all kinds of cookies and scripts running from both Disqus, partners, and from the hosting site where the comments are being made. So many in fact, I began looking at some of them and blocked a few to see if it would affect the site, it didn't. Now I've just installed "No Script" on my firefox browser, and it blocks about half of the scripts running on these sites, but they still work. I wish I knew more about Javascript … I'm just learning as I stumble along here, but I've got the "No Script" set as recommended by the pros in the forum which discussed it. I've also added SUPERanti-spyware to my system since Digerati mentioned it in this thread. —- oh, PS: yesterday I ran the free AVAST! scan and it picked up two threats it referred to as "probably variants of WIN32/Adware.iBryte.C application. which it removed. There's university group I discovered by accident while looking for answers to all these Javascript alerts, who specialize in Javascript, and I've sent them an email with some samples of my Javascript alerts, asking them if they have any ideas on what's going … perhaps I'll actually get an answer. I've been looking through quite a few forums where this same Javascript issue is being discussed, and it's all over the place, mostly in connection to Chrome and Firefox (more Chrome I think), and although much of the technical geek talk is Greek to me, I am able to gather that whatever it is, is ongoing and far from resolved. As soon as I get home tonight, I'll go over to the malware forum and see what's lurking in my antiquated machine. Thanks for all your time, I appreciate it as always.