How to identify virus infected file coming from sync

sharachchandra · July 18, 2013

I am a member of a group library. Recently, when I try to sync, half-way through I get a msg from my anti-virus software that file QSD99HAF.zip sitting in my ..\zotero\tmp folder is infected with HIDDENEXT/Word.gen virus. The anti-virus software deletes the file, but when i sync again, the file and warning reappear. It seems someone in the group has uploaded a reference along with a virus-infected file. How do I figure out which reference this file is associated with (since it is sitting in the tmp folder with a cryptic file name)? Or is something else going on?

dstillman · July 18, 2013

You can find the item in question by pasting QSD99HAF into the Zotero quick search bar. I believe it's actually in your own library, not a group library, and the error may very well be a false positive. But you can delete the attachment item, empty the trash, and then just go find the file again and reattach it to the parent item.

sharachchandra · July 18, 2013

Dan, you were right that the 'infected' file is in my own library--because even after i turned off sync for the group library, i got the error. But i could not find the item by pasting the name (even after setting search option to 'everything'). Luckily, I sort of knew what I had added recently, and I deleted that and purged, and then re-added the whole citation and pdf and it worked. Very likely this was a 'false-positive', because I think what I had wrongly attached the first time was the shortcut file leading to the pdf instead of the pdf itself, and it looks like the shortcut file was triggering this virus warning. Anyway, thanks!

adamsmith · July 18, 2013

(the virus is an e-mail worm, so it would indeed be rather unlikely to show up in a file synced by Zotero, though obviously better to be safe than sorry)