Avast thinks a snapshot saved to Zotero is dangerous

After switching from Norton to Avast antivirus, I'm getting repeated warnings from Avast about a "threat" from files on the server. The debug output results in "Invalid response from server" so I am submitting it separately.
  • it's certainly possible -- Zotero just saves snapshots of pages, it doesn't have any impact on their content and doesn't run its own checks.

    You can paste the folder at the end of the filepath that Avast gives you (the 8 letter/number string like WSXK3DFF) into the quick search bar of Zotero you should see the affected attachment and then can delete it in Zotero and, once you empty your Zotero trash, on the server.

    With respect to the "Invalid Response to server," it also sounds like Avast is breaking your https security:
    See https://www.zotero.org/support/kb/updates_not_detected for details (This is about updates, the most common way this becomes apparent, but very likely applies to your situation, too).
  • I checked this out...the Avast warnings are nonsense.
    It classified some standard medical articles from the Annals of Internal Medicine as a "threat." There's something goofy going on. Should I just delete Avast and try something else? Is there an antivirus you recommend? I hate Norton - slows my computer to a crawl, turns a 15 second boot into almost 4 minutes.
  • Never mind...I searched the Zotero site for "antivirus" and found a post about excluding the Zotero url's from the antivirus search.

    Then I went into Avast settings:
    Settings > Exclusions > URL exclusions
    and added https://s3.amazonaws.com/* and
    https://api.zotero.org/users/179652/*

    Now it syncs fine.
  • The post that tipped me off to the solution was at
    https://www.zotero.org/support/known_issues

    Thanks for your suggestions
  • ah cool, I didn't remember that, thanks for coming back with solution.

    I don't have a virus scanner I recommend, no. Everything I've used on Windows has been awful.
  • rmwolfe's original post, to help other people searching for a solution here:
    I recently started using Avast antivirus. When trying to sync my Zotero account I repeatedly get this message:
    "Avast Web Shield has blocked a harmful webpage or file.
    Object: https://zoterofilestorage.s3.amazonaws.com...[specific filename]
    Infection: JS:Redirector-BWW[Adw]
    Process: C:\Program Files(x86)\...\firefox.exe "

    This pops up at least 7 or 8 times for different files when I try to sync, and then Zotero indicates it is unable to complete the sync.

    Could this be an infection on the Zotero storage site? How should I proceed?
  • I'm looking for the 8-digit letter/number string but am not seeing it. Sorry to be technologically dense. I think I'd rather try to just delete the offending files (if I can) rather than route avast around zotero as I can certainly have virused items in Zotero. Thanks.

    URL:https://s3.amazonaws.com/zoterofilestorage/3b6f871da5d3f945411076b558cf52ba?response-content-type=text%2Fhtml%3B%20charset%3Dutf-8&X-Amz-Content-Sha256=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855&X-Amz-Security-Token=AQoDYXdzEO7%2F%2F%2F%|s
    Infection:JS:Redirector-BWW [Adw]
    Process:C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  • include the debug ID and we'll likely be able to tell you.
  • I should also add that this happened when syncing my zotero library with a new computer. Also, avast did not find the same problem on my new computer (where I have my backed-up zotero library) - only in syncing.
  • edited January 11, 2016
    KA86WVBI and K234RG8J, but could be more after those.

    You can search for those in Zotero by selecting All Fields & Tags in the search bar and pasting in those keys. See if there's a pattern (e.g., they came from the same website). You only need to delete the attachment items, not the parent items. Remember to empty the trash after deleting the attachment items.

    For people who want to debug this themselves, you can search for "Unexpected status code 0 for request" in the debug output to find the items in question.
  • I had to give up on deleting the attachment items as there were just to many. I agree with rmwolfe that it's an error with Avast so I took his advice (pasted in below, though I only excluded the first url):

    Then I went into Avast settings:
    Settings > Exclusions > URL exclusions
    and added https://s3.amazonaws.com/* and
    https://api.zotero.org/users/179652/*

    Sync is now working.
Sign In or Register to comment.