Does dbxsvc.exe in Windows System32 folder actually belong to Dropbox program?

[Taffelzips]

Hi, I'm running Dropbox on Windows 10 and everything is basically working fine. Some time ago I noticed a new service called "Dbxsvc" running on my computer. It runs from a file named dbxsvc.exe in my Windows System32 folder.

Is this some kind of malware or some new part of the Dropbox program?

I know there are two other dbxsvc.exe files on my computer. They are in:

C:\Program Files (x86)\Dropbox\Client\driver_amd64\dbxsvc.exe

C:\Program Files (x86)\Dropbox\Client\driver_x86\dbxsvc.exe

They seems legitimate. But this third one in System32 is the one running the "Dbxsvc" service.

I've managed to shut down and delete the service and then delete the file itself. Dropbox still works just fine.

The thing is, this file reappears randomly.

So should I leave it or be worried about it?

No other strange behavior on my pc and Windows Defender doesn't seem to have a problem with this file.

If anyone can help, thanks!

[MaxAmbition]

I too noticed the same thing.

Dropbox, I believe you owe the world an explanation as what this .exe is doing on our systems if it is not related to syncing.

[Josh L.20]

WHAT does the "intended part of the application" do, which Dropbox.exe doesn't do?

Now I have three services related to Dropbox:

- Dbxsvc.exe = SYSTEM account - Started
- Dropbox Update Service (dbupdate) - Automatic (Delayed)
- Dropbox Update Service (dbupdatem) - Manual

Someone please chime in...

[Roger P.16]

As Dropbox will not specify what these services do, I have completely disabled dbupdate and dbupdatem using Autoruns, and set dbxsvc.exe to start manually through Control Panel/Administrative Tools/Services, all without any adverse effect on the program's functionality as far as I can detect.

[SChalice]

Roger, are you suggesting that DropBox still functions properly even without dbxsvc? If so, then that is pretty much proof that it is spyware. 

Does DropBox really want this kind of scrutiny? How many millions in dollars in revenue, if not the life of the company itself, are they risking?

[Josh L.20]

It's funny - the file hash is now showing "oldf917.tmp" rather than "DbxSvc.exe"

[JustinT]

---

It has no description at all.

So, what is it, exactly?  I'd check the comprehensive release notes, but those also don't exist.

---

Right.

These are astonishingly shady service characteristics (e.g., spyware-ish name, spyware-ish executable file location). Frankly, I'd be more inclined to believe "Dropboxer" Dorothy Jane completely mispoke, and the fake Dropbox service just happened to come from an unrelated spyware infection... but, even bigger companies have made similarly stunning mistakes in the recent past. So anything is possible.

We need an official explanation.

[SChalice]

I think we got our answer by their silence on this thread. I suggest that is simply a backdoor trojan and NSA spyware.

[Rich]

---

@SChalice wrote:

I think we got our answer by their silence on this thread. I suggest that is simply a backdoor trojan and NSA spyware.

---

Thank you! I needed a good laugh today.

[JustinT]

---

@SChalice wrote:

I think we got our answer by their silence on this thread. I suggest that is simply a backdoor trojan and NSA spyware.

---

Is that legal, these days? Normally, I'd expect ramifications, but... not in the nightmarish, anti-privacy dystopia we live in now.

[JustinT]

---

@Rich wrote:

---

Thank you! I needed a good laugh today.

---

Did you have a good LOL when Sony slapped a rootkit on your PC?