Dropbox desktop app causes an "Event 3033" at every startup on my Windows computer

Thanks for bringing this to our attention, td47.

This is a pretty strange issue you seem to be having.

Do you have any security apps like an antivirus, firewall or VPN for example? Can you ensure they're configured to allow Dropbox processes (Dropbox, Dropbox.exe, DropboxUpdate.exe)?

Also, what is the Dropbox app's sync status? You can see that by hovering over the Dropbox icon in your system tray.

Let me know and we'll go from there.

This is NOTHING to do with anti-virus options, it is the INBUILT Windows Code Integrity checking of executables, done by the in-built security mechanisms of the operating system.

These can be seen in the Event Log at:

Applications and Services Logs -> Microsoft -> Windows -> Code Integrity ->Operational Log

Vulkan is the cross-platform API library used by Electron, the user interface framework that Dropbox uses for their desktop client.

I installed Dropbox 224.4.4811 and could confirm that the digital signature is there for the vulkan-1.dll file.

What version of Windows are you running? I will try to use that to reproduce what you're seeing.

Update: managed to reproduce this on Windows 11. I will look into it and follow-up here.

Hope this helps,
Andrew (DBoxTips)

P.S. I am a volunteer on the Dropbox forums, freely and happily sharing know-how with other users, not affiliated with Dropbox in any way.

Hello DBoxTips​ thanks for your useful input.I have got this on Windows 11 24H2, and Windows 10 22H2 (Build 29045.5854).

I have been looking at the Certificate side of things, and it might be because the PP & PPL (Protected Processes) checking within the Code Integrity checks in the Windows OS process Loader.

Check out:

Forums.Malwarebytes.com topic 325667 (sorry cannot seem to publish the actual link)!

It looks like most stuff needs Authenticode and WQHL signing if they request low level (i.e. Kernel) access to other drivers.

Hello DBoxTips​ thanks for your useful input about Certificates. There are about 9 different versions of the Vulcan DLL across 5 different products. They ALL show a valid certificate, but only the ONE item (the Dropbox one) is flagged by Windows OS Code Integrity. It is possible that either the others do NOT need to call a Kernel Mode driver, or they have embedded Authenticode or WHQL certificates.   See the MalwareBytes Forum topic 325667 for info on PP and PPL protected Processes. The Vulkan list is here (Created by Agent Ransack, great bit of software), from my Windows 10 system (22H2 build 19045.5854, but Windows 11 is 24H2):

I found out this is triggered by the Smart App Control feature of Windows 11. I am digging into the details of the event to see if I can find the reason why that file triggers this. What is weird is that all files in the Dropbox setup are signed with the same code signing (Authenticode) certificate, so if the certificate were the issue it would have triggered similar events with other files in the installation as well. I also double checked the signature of the vulkan_1.dll (using signtool) and it is correct, looks correctly signed. 

I will follow-up here as my analysis continues.

Thanks,
Andrew (DBoxTips)

DBoxTips​ Interesting. I just checked on my Windows 11 Desktop, it is set to OFF, and can ONLY be turned on during a full re-install!! WTH! So in MY case here, it looks like SAC has always been OFF.

Nancy​ Thanks for the rather surprising information on the different products.

First, if you look at the graphic posted by DBoxTips​ you will see that the vulkan-1.dll IS signed by Dropbox Inc. Therefore it is STILL Dropbox's responsibility to get it fixed, wherever you farmed out the development and customization to.

Secondly, this Event 3033 seems to have occurred recently, so I think a product update, that has altered the vulkan-1.dll has caused this, or it has been a recent addition.

Thirdly, I was never made aware when first downloading this in 2021, that there were "different" types of Dropbox (UWP style and normal executable). 

NOTE: If you look at the Graphic on comment 6, you will see that there is a Windows 10 built-in "system" version of this DLL, both for 64-bit AND for 32-bit architectures, and they BOTH have their own LOADER extensions if needed by any app/program. This is the SAME on Windows 11.

So, if the Windows Store UWP version of Dropbox can work with the Windows Supplied vulkan-1.dll quite happily, why is a customized version required for the standard desktop version, that is seen to be causing unwanted security related system error Events? In any event, they will ALL be interfacing with the SAME graphics driver!

Sorry to complain about a "free" product, but this is NOT a good user experience, and now I am asked to uninstall what I have been using since 2021, and install the UWP version. This a bit of a mess really! 

Hi again, td47.

We really appreciate you taking the time to post your feedback on this.

I've personally passed your comments along to our team.

If you need assistance with anything else, please let us know.