(Archived) Virus Issue

[DannyG3 0]

System: Mac 10.6.8

Sophos Anit-Virus keeps notifying me of two viruses but if I clean them they show up again whenever Evernote is started and syncs. I even deleted all Evernote files from the computer and reinstalled but apparently the virus is in my online datebase and keeps downloading.

The two viruses are;

Troj/Invo-Zip

Troj/Backdr-FP

They reside in LIbrary>Application Support>Evernote/Sync Downloads/primary/resource-9FC.........

I have attached a screen shot of the warning -

Any thoughts on how to clean this up? Doesn't Evernote scan the files on there system?

[BurgersNFries 2,407]

Of course Evernote confirms their app does not have viruses.

Please read this thread:

http://openforum.sop.../m-p/3939#M1953

If you need more help/info, you should probably followup with Sophos in the Mac Home Edition section.

[DannyG3 0]

Is this really a Sophos issue? I can clear the viruses but as soon as Evernote starts to sync again, they reappear. It only happens with Evernote. I also just realized that I'm getting a Sync failure message from Evernote;

Synchronization failed because of an unexpected data transfer error with the Evernote servers. If the problem persists, please contact Evernote technical support.

[DannyG3 0]

I have completely uninstalled Evernote from my computer. Did a virus scan, no problems. Reinstalled Evernote and sync'd data. Immediately I get the virus notice pointing the newly created Evernote data file on my computer. Somehow it must have attached itself to my Evernote online database. What else could it be?

[spg SCOTT 736]

Well, it will reappear. Look at the location.

LIbrary>Application Support>Evernote/Sync Downloads/primary/resource-9FC.........

I am guessing that this is a false positive, that you need to report to Sophos

I see that you have already tried, and they sent you to another forum:

http://community.sop...f-it/td-p/18063

Did you try there?

[BurgersNFries 2,407]

I agree with Scott that it appears to be a false positive. Did you read the link I posted? The OP is having the exact same problem you initially reported to Sophos in the link Scott posted. The reply by Agile (a Sophos employee) is basically stating that it is a false positive. Which is why I suggested you contact them. Agile's reply also indicates that Sophos is doing exactly what it's supposed to be doing by eliminating the file from the quarantine manager.

I'm sure if you downloaded the EN program from the EN website, that there is no virus or malware in it.

[DannyG3 0]

The Sophos log shows:

detected in /Users/dm/Library/Application Support/Evernote/Sync Downloads/primary/resource-9FC90ED2E3A6B4EA6DFDD97C350A0509-36738

The Evernote Activity log shows;

2011-10-22 12:50:45 0xc12c70 [ENSyncDownloadCache] INFO: error: Error Domain=NSCocoaErrorDomain Code=257 UserInfo=0x204fa90 "The file “resource-9FC90ED2E3A6B4EA6DFDD97C350A0509-36738” couldn’t be opened because you don’t have permission to view it." Underlying Error=(Error Domain=NSPOSIXErrorDomain Code=13 "The operation couldn’t be completed. Permission denied")

I try to located this file but it doesn't seem to exist on the computer yet both Sophos and Evernote seem to see it.

I'm way beyond my knowledge base but the file in both logs are the same. There has to be some connection. I also don't know if this has anything to do with my synch failures but I believe both problems started at the same time.

[spg SCOTT 736]

The Sophos log shows:

detected in /Users/dm/Library/Application Support/Evernote/Sync Downloads/primary/resource-9FC90ED2E3A6B4EA6DFDD97C350A0509-36738

Sophos sees the file, and quarentines it (or whatever it doesn with the file - at minimum, restricts access)

The Evernote Activity log shows;

2011-10-22 12:50:45 0xc12c70 [ENSyncDownloadCache] INFO: error: Error Domain=NSCocoaErrorDomain Code=257 UserInfo=0x204fa90 "The file “resource-9FC90ED2E3A6B4EA6DFDD97C350A0509-36738” couldn’t be opened because you don’t have permission to view it." Underlying Error=(Error Domain=NSPOSIXErrorDomain Code=13 "The operation couldn’t be completed. Permission denied")

The above action causes evernote to be confused, as the note it wants is unavailable, hence the error.

I try to located this file but it doesn't seem to exist on the computer yet both Sophos and Evernote seem to see it.

Probably because sophos has already done something with it or it is deleted (going by the thread linked to above, it could be it is cleared from the cache)

I'm way beyond my knowledge base but the file in both logs are the same. There has to be some connection. I also don't know if this has anything to do with my synch failures but I believe both problems started at the same time.

There is a connection. Sophos is detecting (wrongly) a file and deleting/locking the file, meaning that EN can't use it, thus the sync failures.

[DannyG3 0]

I turned off Sophos and then restarted Evernote to see if that file showed up. There were no sync issues and there were NO files in the Evernote download file. I then restated Sophos and restarted Evernote. No Sophos warnings and no Evernote sync issues. I restarted the computer and started Evernote, still no Sophos issues and no Evernote issues. So I guess the issue is resolved. I don't know why but I appear to be back in business.

Thank you both for taking the time to reply.