Wall Street Journal Chrome translator downloads suspicious folders

troyquast
I'm using Zotero Connector in Chrome 48.
When I save a WSJ article 6-ish additional folders beyond the snapshot folder are saved to my storage folder. I then get virus warnings from Symantec that there are suspicious "servicelogin.html" files in these folders.

Does this sound familiar to anyone? This issue only started last week & I have no idea what is causing this.

Thanks,
Troy
  • adamsmith
    Generally these don't mean a thing and Symantec is just trigger happy on the generic detection algorithms (not entirely without reason -- something like this could hide malicious code).

    I'm a little confused by "6ish additional folders" though. These are all in the same subfolder of zotero/storage right? If so, that's fine.

    Do check that the snapshots actually work for you, btw.
  • troyquast
    Thanks for your reply.
    Yes, the new folders are saved to my zotero/storage folder.
    The first saved folder looks to contain all of the snapshot files (it's the folder that appears when I choose "show file").
    Then, about 3 seconds later, new folders start to appear in zotero/storage.
    Just now I saved another WSJ file & 2 "additional" folders were created.

    I just want to be sure that I'm not inadvertently also saving bad stuff to my computer.

    Thanks
  • adamsmith
    that's quite odd and shouldn't happen. I doubt it's malicious, but it may very well be a bug. What are the names of these additional folders?
  • troyquast
    I just noticed that there have been some repeating names:
    F4K4NJEN
    ZP4EQZRI
    32S5CHSC
    99J9PRT9

    Thanks again.
  • dstillman
    edited March 14, 2016
    These aren't new folders — these are attachment folders dating back several years. Zotero just accesses them to check for changes at sync time, and Symantec probably rescans them at that time (which likely also means that Symantec is slowing things down quite a lot, because Zotero is actually just checking the file modification times, but Symantec may be scanning the files themselves).
  • troyquast
    Dan, thanks for clarifying.
    Any suggestions as to how to avoid this issue or why has only now started?
    I have now turned off Symantec scanning the zotero/storage folder, but I would rather not if possible.
  • dstillman
    You can either exclude that folder or you can delete the attachments it doesn't like.

    If you want to delete them, you can paste the folder name into the Zotero search bar in All Fields & Tags mode, find the relevant attachments, delete them, and empty the trash.
  • dstillman
    edited March 14, 2016
    As for why it just started, it's due to a change in either Symantec's behavior or its virus signatures. Very good chance these are just false positives, which can come and go with AV software.
Sign In or Register to comment.