Antivirus detected malware in the Dropbox cache folder

[dreemsnake]

I don't know if this is the right category.  Also, I tried searching here for a solution first, but the posts were all locked.

I just started using Dropbox.  I don't have many files in it.  Since May 10, my virus software has found Gen:Variant.Kazy 512414 in my \.dropbox.cache.  The file is ~834b6cda.tmp.  The only thing I added on 5/10 is a pdf file from a trusted source.  Could this be the problem?  This has happened on 5/10, 5/15, 5/21 and 3 times today.  

I read that the cache is automatically deleted every three days so it wouldn't be something that's staying in the cache.  How should I deal with this because this has been a very easy and convenient way to share files between my i-things and my pc.  Thanks.

(also, i tried using the malware and cache as tags, but it would not allow it)

[Sanchez]

Hey @dreemsnake, welcome to our community! 

When you run a full and thorough system scan, does this malware show up anyplace else? 

Did you know that you don’t have to wait for the cache to be cleaned automatically… you can manually clear the cache folder anytime 

What I would do is to Exit Dropbox (click on system tray icon, gear icon, Exit Dropbox), clear the cache, and run a full scan. Find and remove the offending file, and then start our desktop app up. If the malware comes back, then it may be that the infected file has synced to your online Dropbox.

Have a look, and let me know. Keep in mind that our team can assist with rolling back your entire account up to 30 days (for most account types). 

Out of curiosity, what antivirus program are you using? 

Cheers

[Loni H.]

If you don't fix this problem of my work computer keep finding malware in dropbox, I should stop using dropbox. 

---

@Sanchez

[Walter · Accepted solution]

Hey there @Loni H. - sorry to jump in on this, my colleague @Sanchez is out of office currently on a vacation leave. However, I'll be happy to help in the meantime. 

In regards to what you mentioned now, kindly note that the Dropbox desktop client uses the ".dropbox.cache" folder as a staging area to download your files in small chunks during the syncing process. 

Sometimes antivirus programs will pick up some of these partial files as false positives and continuously quarantine them. The problem here is that Dropbox keeps downloading the file in an attempt to sync the file down to your computer. To tackle this behavior you can either add the Dropbox cache folder to an ignore list so that Dropbox can correctly sync that file or/and as Sanchez has mentioned before me, temporarily disable your antivirus. Once synced and "Up to date", you should no longer see these warnings or quarantine messages. 

Hopefully this will get you going Loni. Let me know if you need anything else in the meantime. Thank you!

[VladoCedov]

Hello Sanchez

I can't deleta cache on my MacBookPro 2018, as following instructions "Go to Folder" doesn't bring me to cache folder

Can you help me with this matter ?

Thank you

Vlado

[Walter]

Hey there @VladoCedov - sorry to hear that!

Can you confirm that you're following these instructions on a computer that has had our desktop app installed and linked to an account at some point? 

If so and you happen to be on a Business account, take a look here first:

If you have two accounts linked to the same desktop, the name of your Dropbox folder will be appended with your team name in parentheses or "(Personal)," depending on the type of account. For example, if you were clearing your cache on a Dropbox Business account called "Company" you'd see:

~/Dropbox (Company)/.dropbox.cache (this a mere example - you should replace the "Company" with your own Company's (or Team's for that matter) name. 

I hope this helps Vlado and keep me posted on your progress.

[VladoCedov]

Hello Walter, thank you for getting back to me.

At the end I managed to delete those files with my Kaspersky antivirus, but just after I quit Dropbox. Haven't had issues today, will see on next scan. I was following instructions for cache, they are really not that hard to follow, but they don't bring me to cache folder, as it looks like one doesn't exist ?

Did you have similar issue ? Is it because of Mojave OS ?

Best regards,

Vlado

[Walter]

Thanks for the swift response and additional info Vlado - much appreciated.

I don't think that this has to do with your OS yet we'd need much more information about your current setup to be sure and also, I'm not sure is if this is related to a recent issue there was on Kaspersky's end (as per this thread) yet I'd also suggest contacting them to make sure about it. 

Having said that, have you tried disabling Kaspersky and try looking for the cache folder afterwards? (I guess that's the exact opposite of what you did )

Just note that our client (i.e. the desktop app) uses the ".dropbox.cache" folder as a staging area to download your files in small chunks. Sometimes antivirus programs will pick up these partial files as false positives and continuously quarantine them. The problem is that Dropbox keeps downloading the file in an attempt to sync the file down to your device. I would recommend adding the Dropbox cache folder to an ignore list so that Dropbox can correctly sync that file and/or temporarily disabling your antivirus. Once synced, you should no longer see these warnings or quarantine messages.

Let me know what you find Vlado! 

[pchidley627]

Had the same problem.  Popping up on all my machines.
Finally an answer that makes sense.
THANKS Walter!!!!

[HiroMarketing]

Hello, I'm having the same issue. My windows defender keeps marking a file as extremely dangerous virus.  which is coming from the cache folder. 

One of your solutions is to tell the Anti-Virus to ignore the dropbox folder; I would do this.. HOWEVER; does Dropbox have their own anti-virus solution on their servers.. because potentially this will allow any potential viruses to freely enter our computer without being detected.