Zotero fails to sync - coinhive threat detected by antivirus

lfdagm

Report ID: 782769289

I was trying to sync Zotero in the standalone app in mac. However, my AVG antivirus immediately detected and secured multiple threats:
1) We've moved coinhive.min.js to your Quarantine because it was infected with BV:Miner-T [Tri].
2) We've moved alert.gif to your Quarantine because it was infected with JS:Miner-S [Tri].

Both files (coinhive.min.js and alert.gif are located in the storage folder (Zotero/storage/...)

I deleted the files using the antivirus and reinstalled Zotero; however, it keeps failing at sync.

What can I do? Thanks in advance!

adamsmith

While these files are actual malware (javascript files that mine bitcoins using your computer), the reason they're in Zotero/storage is that they were part of a webpage you saved to Zotero, so Zotero syncing just stops as a byproduct of your attempt to save an infected webpage..

If these files reappear, find their location in storage specifically (ie. the folder within Zotero storage, an eight character letter/number combination like ABCD1234 and paste those eight letters into Zotero's quick format bar in "all fields and tags" mode. That should show the attachment affected by this. Delete it in Zotero and empty the Zotero trash.

Note that this never cause a serious risk for your computer:
a) These scripts are fairly harmless apart from using up computing power/energy
b) they only run when the page in question is open, not when saved to your computer.

lfdagm

Thank you adamsmith for your quick answer. Unfortunately, I tried what you mentioned but it didn't work.
I pasted the eight letters in "all fields and tags" (in my case TD4MEKC3 and RM3EXBSR) and it didn't retrieve any result. I tried the same thing in the web interface and even in the url (eg. https://www.zotero.org/lfdagm/items/collectionKey/TD4MEKC3), but I couldn't find anything.
I think that I'm going to deactivate my antivirus while Zotero syncs.

Thanks again

dstillman

If you didn't find anything pasting that into the search bar, you aren't in the library root, the files are in a group library, or they're in the trash somewhere (in which case you can just empty the trash).

lfdagm

Finally, it worked! I located the files using finder and erased them... although, I couldn't do it in "all fields and tags". Now Zotero is synced. Thank you all.