Mac – gen_204

downloadmacmalwarevirus

What is gen_204?

I saw it downloading earlier today only to find another copy of it in my downloads and deleted both. It just downloaded again. It was a small file with no extension. I searched Google and find some stuff about a Chrome error but nothing really specific or current related to what this thing is.

It has downloaded at sporadic times while browsing the internet. The first time I saw it pop up I was on Facebook and the other time I was in my ETrade account. I saw it appear on the bottom of my browser window with no extension. I'm running OSX Sierra.

(If you know what it is and want to improve the tags please feel free or if I find out what it is I'll update them myself. Not really sure how to tag this question in a useful way)

Best Answer

When searching for "gen_204" I came across this post from Stackoverflow: javascript in google - what's it doing ? and is it trying to encrypt its work, where gen_204 is listed as part of a Google Javascript.

Troy Hunt on troyhunt.com (link) found out that it's foreign browsers with Javascript running, trying to find something that doesn't exist, quote:

That’s enough to draw some conclusions:

  1. The gen204 reference is coming from the Google Translate script
  2. It appears to be executing in the DOM context of the target site
  3. The script above is setting an image source of gen204 plus a query string
  4. I have no idea why this is happening (although best guess is a browser plugin)

On that last point, whilst I haven’t gone deep enough down the rabbit hole to explain why this is happening, I’ve seen enough to conclude it’s nothing that requires any effort on my part. It’s not a broken reference on my site nor is it a malicious attack, it’s simply some screwy JavaScript looking for something that doesn’t exist.

Perhaps a browser plugin of yours (a Google one) is doing something?

Related Question