Zotero fails to sync - coinhive threat detected by antivirus

lfdagm
edited July 5, 2018
Report ID: 782769289

I was trying to sync Zotero in the standalone app in mac. However, my AVG antivirus immediately detected and secured multiple threats:
1) We've moved coinhive.min.js to your Quarantine because it was infected with BV:Miner-T [Tri].
2) We've moved alert.gif to your Quarantine because it was infected with JS:Miner-S [Tri].

Both files (coinhive.min.js and alert.gif are located in the storage folder (Zotero/storage/...)

I deleted the files using the antivirus and reinstalled Zotero; however, it keeps failing at sync.

What can I do? Thanks in advance!


  • adamsmith
    While these files are actual malware (javascript files that mine bitcoins using your computer), the reason they're in Zotero/storage is that they were part of a webpage you saved to Zotero, so Zotero syncing just stops as a byproduct of your attempt to save an infected webpage..

    If these files reappear, find their location in storage specifically (ie. the folder within Zotero storage, an eight character letter/number combination like ABCD1234 and paste those eight letters into Zotero's quick format bar in "all fields and tags" mode. That should show the attachment affected by this. Delete it in Zotero and empty the Zotero trash.

    Note that this never cause a serious risk for your computer:
    a) These scripts are fairly harmless apart from using up computing power/energy
    b) they only run when the page in question is open, not when saved to your computer.
  • lfdagm
    Thank you adamsmith for your quick answer. Unfortunately, I tried what you mentioned but it didn't work.
    I pasted the eight letters in "all fields and tags" (in my case TD4MEKC3 and RM3EXBSR) and it didn't retrieve any result. I tried the same thing in the web interface and even in the url (eg. https://www.zotero.org/lfdagm/items/collectionKey/TD4MEKC3), but I couldn't find anything.
    I think that I'm going to deactivate my antivirus while Zotero syncs.

    Thanks again


  • dstillman Zotero Team
    If you didn't find anything pasting that into the search bar, you aren't in the library root, the files are in a group library, or they're in the trash somewhere (in which case you can just empty the trash).
  • lfdagm
    Finally, it worked! I located the files using finder and erased them... although, I couldn't do it in "all fields and tags". Now Zotero is synced. Thank you all.

This is an old discussion that has not been active in a long time. Before commenting here, you should strongly consider starting a new discussion instead. If you think the content of this discussion is still relevant, you can link to it from your new discussion.

Sign In or Register to comment.