Zotero generating virus?

I am using the free version of Avast Antivirus.
I have been using Zotero for a few years. Yesterday I did a complete reinstall of Firefox and I also reinstalled the Firefox addon. I then synced/updated my account. Everything looks good.
But... about once an hour now, I get an Avast popup telling that a virus has been blocked. It says:
Object: C:\Users\Mark\AppData\Roaming\Zotero\Zotero\Profiles\9y10gip6.default\zotero\storage\CAIZWHNK\blog.html
Infection: JS:HidelLink-A [Trj]
Process: C:\Program Files (x86)...\firefox.exe

I do not have that blog.html file in my Zotero subdirectory, but I'm guessing that's because it's been blocked by Avast. It is the same message that appears every hour.
A search on the HideLink-A trojan indicates that it is a significant problem.

I'm posting this here, because the problem seems to be lodged in Zotero, and I don't know enough to determine if this is an issue with the program or one of my Zotero entries, nor do I understand why it keeps recurring.

I'm guessing that it is an entry issue. If I open in notepad the .zotero-ft-cache file in the infected subdirectory, I was able to determine which entry was causing the problem. I deleted the entry, but Avast now pops up the warning when I try to sync Zotero, and the sync fails.

Any advice appreciated!
  • So, I tried deleting the offending subdirectory. (The CAIZWHNK subdirectory under the storage subdirectory.)
    Now when I try to sync Zotero, I can cause the Avast warning to appear, and the sync stops with the message:
    My Library
    Component returned failure code: 0x80520012
    (NS_ERROR_FILE_NOT_FOUND) [nsIFile.permissions]

    And the offending subdirectory gets recreated, but it is now empty.
  • That's just a web page you've saved in Zotero that Avast is flagging.

    Empty your Zotero trash and then sync again. If you get prompted about a conflict, choose the local deleted version.
  • edited January 26, 2015
    And to make sure you got the right item, paste "CAIZWHNK" into the Zotero search bar in All Fields & Tags mode to see if anything shows up. (If you're in any group libraries, try from the root of each.)

    But until you empty the trash the item isn't gone and will keep syncing, so that's most likely the issue.
  • That did it! Thank you very much!
Sign In or Register to comment.