Should I be concerned about this? AV found and quarantined.

dea_har
dea_har
Community Member


1Password Version: Not Provided
Extension Version: Not Provided
OS Version: macOS Sierra 10.12.3
Sync Type: Not Provided

Comments

  • Drew_AG
    Drew_AG
    1Password Alumni

    Hi @dea_har,

    Can you please elaborate on your question? The title of your post mentions something about anti-virus software, and there's a screenshot of a file path in your post, but that tells me very little about what's happening on your end. Please give us some more details - for example, are you getting an error message from an anti-virus app about 1Password? If so, what exactly does the message say? Did you only see that message once? What anti-virus software are you using? Are there specific steps you're taking to trigger the message in the anti-virus software? Also, what version of 1Password do you have installed? Is the 1Password app working? If not, what happens when you try to open it?

    The more details you can give us about what's happening on your end, the better. Thanks in advance! :)

  • dea_har
    dea_har
    Community Member

    Thanks Drew_AG

    I realize now I didn't share enough info.

    I'm not getting an error message from my anti-virus app.

    I use Eset Cyber Security Pro 6.4.128.0

    There aren't any specific steps to trigger any message in the anti-virus software. It's just sitting in quarantine along with other trojans that were blocked.

    I found this in the quarantine folder with several others. All of the others showed a file path coming from emails (phishing and spam). This was the only one that concerned me as it seemed to be found inside my 1Password (or so it appeared to me) but I'm not sure.

    At the time I found this I was using 1Password 6 version 6.6.3. But I upgraded to 1Password 6 version 6.6.4 (664001).

    My 1Password app works fine.

    I don't think my system is infected, it just concerns me that it was found in a piece of software that I have put a ton of faith into to keep my passwords private. That's what concerns me the most. I thought if I didn't bring it up, then you may not be aware of it and others might otherwise unknowingly become infected.

    Additional screenshot attached!

  • dea_har
    dea_har
    Community Member

  • vplewis
    vplewis
    Community Member

    @dea_har Looks like you're being tripped up by an alias. In your first screenshot, all the information past the second occurrence of ".../Library/" is in the Mail subdirectory, not in 1Password. The same is true of the first line of the screenshot above. That's how Unix/OS X/macOS is intended to work. HTH

  • dea_har
    dea_har
    Community Member

    @vplewis So does that mean its normal? I mean, is this really nothing to worry about?

  • vplewis
    vplewis
    Community Member

    @dea_har Yes, the OS and 1Password appear to be working as designed. I'm not familiar with your security software, however. HTH

  • dea_har
    dea_har
    Community Member

    @vplewis Thank you!

  • Drew_AG
    Drew_AG
    1Password Alumni

    Good catch, @vplewis! Thanks for the assist! :)

    @dea_har, I'm glad vplewis was able to help you with that! Indeed, that file path starts with a location within your 1Password data folder: ~/Library/Containers/2BUA8C4S2C.com.agilebits.onepassword-osx-helper/Data/Library/

    That folder contains aliases to various other system directories, like the /Mail/ folder, which is actually located here: ~/Library/Mail/

    In other words, the quarantined file doesn't have anything to do with 1Password, but your anti-virus software found it through the 'Mail' alias there. It's definitely a bit confusing to see that path listed like that, though! ;)

    We're here for you if you need anything else! :)

  • dea_har
    dea_har
    Community Member

    Thank you Drew_AG

  • sjk
    sjk
    1Password Alumni

    You're welcome, @dea_har, on Drew's behalf. :)

    In case you're curious, Sophos has/had a similar issue:

    Sophos AntiVirus for Mac detection in ~/Library/Containers/2BUA8C4S2C.com.agilebits.onepassword-osx

This discussion has been closed.