cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Update: Find information on Dropbox support during COVID-19 here
Close
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

QtWebEngineWidgets.cp36-win32.pyd reported as virus

Explorer | Level 4

Hi. F-Pprot anti-virus (realtime monitoring) is reporting that C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineWidgets.cp36-win32.pyd is a Eldorado virus. Is this a false positive? Looks like Dropbox got updated this morning to 64.4.141. Thanks, Alan

F-Prot reported Dropbox Client virus.jpg

1 Accepted Solution

Accepted Solutions
Highlighted

Re: QtWebEngineWidgets.cp36-win32.pyd reported as virus

Helpful | Level 5

Hi Jane - CYREN F-Prot have now confirmed a fix by amendments to the heuristic rules which was impacting on several QT5 dll's - I have removed my temporary exclusion rule and checked - Dropbox is now working ok.

View solution in original post

29 Replies 29
Highlighted

Re: QtWebEngineWidgets.cp36-win32.pyd reported as virus

Dropboxer
Dropboxer
Hi there, @Alan_uk
 
Since the desktop app uses the ".dropbox.cache" folder as a staging area to download your files in small chunks, sometimes antivirus programs may pick up these partial files as false positives and continuously quarantine them. 
 
Having said that, I’d recommend adding the Dropbox cache folder to an ignore list so that Dropbox can correctly sync that file and/or temporarily disabling your antivirus. Once synced, you should no longer see these warnings.
 
If you’re still having trouble with this though, let me know and I’ll make sure to get back to you as soon as possible. Thanks! 

Lusil
Community Moderator @ Dropbox
https://dropbox.com/support


Heart Did this post help you? If so, please give it a Like below.
Still stuck? Ask me a question!
Tips & Tricks Find new ways to stay in flow or share your tips on how you work smarter with Dropbox.

Highlighted

Trojan virus in my Dropbox

New member | Level 2
New member | Level 2

I cannot open my Dropbox  folder on desktop (but I can open it online) since my antivirus program found a Trojan called: W32/S-47b30993!Eldorado. The program fails to quarantine the file. The file is called: C:\Program Files (x86)\Dropbox\Update\Download\{CC46080E-4C33-4981-859A-BBA2F780F31E}\64.4.141\DropboxClient_64.4.141.exe

I have not been downloading or clicking on anything suspicious. Can someone give me info on how to fix this or remove the virus? Thank you

Highlighted

Re: Trojan virus in my Dropbox

Dropboxer
Dropboxer

Hey there @rannveig - I just moved your post under this thread as it's related to the same issue. Please take a look at my colleague @Lusil's suggestions above and let us know if you have any more questions!

Cheers!



Walter
Community Moderator @ Dropbox
https://dropbox.com/support


Heart Did this post help you? If so, please give it a Like below.
Still stuck? Ask me a question!
Tips & Tricks Find new ways to stay in flow or share your tips on how you work smarter with Dropbox.

Highlighted

Re: QtWebEngineWidgets.cp36-win32.pyd reported as virus

New member | Level 2
New member | Level 2

Hi. I just got a message from my antivirus rea-time protection that i has blocked a malware. Dropbox stopped working a couple of hours ago, and I tried to download and reinstall. Each time I try that, my antivirus blockes a malware program that i in this file: 

PYQT5.QTWEBENGINEWIDGETS-WIN32.PYD.  The name of the trojan is W32/S-47b30993!Eldorado . Are your files infected by this trojan? Do you have a Trojan in your midst?

Highlighted

Re: Trojan virus in my Dropbox

New member | Level 2
New member | Level 2

Thank you Lusil and Walter, I have followed your instructions and no longer get the error messages. But I cannot open my desktop Dropbox. I have tried rebooting, shutting off the virus protection (F-Prot) and nothing works. Should I re-install the app?

Highlighted

QtWebEngineWidgets.cp36-win32.pyd reported as virus

Explorer | Level 4

f-prot.png

Highlighted

Re: Trojan virus in my Dropbox

New member | Level 2
New member | Level 2

I also followed these instructions, and rebooted. I can't open my desktop Dropbox either. I use Dropbox PRO for business purposes, and this issue really delays our work. I suspect that Rannveig i located in Norway, and so am I. Is that a factor to be considered?

I use Iolo System Mechanic as a part of Phonix 360 for PC protection by the way.

Highlighted

Re: QtWebEngineWidgets.cp36-win32.pyd reported as virus

Explorer | Level 4

Thanks Lusil for a quick reply. I'm on Windows 7 Professional 64bit and I don't have a ".dropbox.cache" (I've searched with show hidden system files). Anti-virus picked up the file in C:\Program Files (x86)\Dropbox\ClientDropbox\Client  not .dropbox.cache. 

I'm confused, cache to me is a staging folder when downloading large user files, not small executable files.

Highlighted

Re: QtWebEngineWidgets.cp36-win32.pyd reported as virus

New member | Level 2
New member | Level 2

I just got the same popup on my computer turning it on this morning with F-Prot. Dropbox didn't load because of this.

Mine was located in: C:\Users\t\AppData\Roaming\Dropbox\bin\PyQt5.QtWebEngineWidgets.cp36-win32.pyd

After "Restoring" the file back to the proper place and updating F-Prot definitions, it seems okay now. I run a manual scan of the BIN directory and comes up clean. Definitions 1/16/19 @ 8:18am.

I'm able to load DropBox now and everything seems to run okay. No strange processes looking at Process Hacker. Maybe a false positive? I know this has happened in past numerous times with F-Prot.

EDIT: Also extracting all files in "DropboxClient_64.4.141.exe" and scanning the folder comes up clean now too.

Work Smarter with Dropbox

The way we work is changing. Share and discover new ways to work smarter with Dropbox in our community.

Sound good? Let's get started.
Who's talking

Top contributors to this post

What do Dropbox user levels mean?
Need more support?