QtWebEngineWidgets.cp36-win32.pyd reported as virus

[Alan_uk]

Hi. F-Pprot anti-virus (realtime monitoring) is reporting that C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineWidgets.cp36-win32.pyd is a Eldorado virus. Is this a false positive? Looks like Dropbox got updated this morning to 64.4.141. Thanks, Alan

[Lusil]

Hi there, @Alan_uk. 

Since the desktop app uses the ".dropbox.cache" folder as a staging area to download your files in small chunks, sometimes antivirus programs may pick up these partial files as false positives and continuously quarantine them. 

Having said that, I’d recommend adding the Dropbox cache folder to an ignore list so that Dropbox can correctly sync that file and/or temporarily disabling your antivirus. Once synced, you should no longer see these warnings.

If you’re still having trouble with this though, let me know and I’ll make sure to get back to you as soon as possible. Thanks! 

[rannveig]

I cannot open my Dropbox  folder on desktop (but I can open it online) since my antivirus program found a Trojan called: W32/S-47b30993!Eldorado. The program fails to quarantine the file. The file is called: C:\Program Files (x86)\Dropbox\Update\Download\{CC46080E-4C33-4981-859A-BBA2F780F31E}\64.4.141\DropboxClient_64.4.141.exe

I have not been downloading or clicking on anything suspicious. Can someone give me info on how to fix this or remove the virus? Thank you

[Walter]

Hey there @rannveig - I just moved your post under this thread as it's related to the same issue. Please take a look at my colleague @Lusil's suggestions above and let us know if you have any more questions!

Cheers!

[Robert24]

Hi. I just got a message from my antivirus rea-time protection that i has blocked a malware. Dropbox stopped working a couple of hours ago, and I tried to download and reinstall. Each time I try that, my antivirus blockes a malware program that i in this file: 

PYQT5.QTWEBENGINEWIDGETS-WIN32.PYD.  The name of the trojan is W32/S-47b30993!Eldorado . Are your files infected by this trojan? Do you have a Trojan in your midst?

[rannveig]

Thank you Lusil and Walter, I have followed your instructions and no longer get the error messages. But I cannot open my desktop Dropbox. I have tried rebooting, shutting off the virus protection (F-Prot) and nothing works. Should I re-install the app?

[sunwaltstl]

[Robert24]

I also followed these instructions, and rebooted. I can't open my desktop Dropbox either. I use Dropbox PRO for business purposes, and this issue really delays our work. I suspect that Rannveig i located in Norway, and so am I. Is that a factor to be considered?

I use Iolo System Mechanic as a part of Phonix 360 for PC protection by the way.

[Alan_uk]

Thanks Lusil for a quick reply. I'm on Windows 7 Professional 64bit and I don't have a ".dropbox.cache" (I've searched with show hidden system files). Anti-virus picked up the file in C:\Program Files (x86)\Dropbox\ClientDropbox\Client  not .dropbox.cache. 

I'm confused, cache to me is a staging folder when downloading large user files, not small executable files.

[MrTom]

I just got the same popup on my computer turning it on this morning with F-Prot. Dropbox didn't load because of this.

Mine was located in: C:\Users\t\AppData\Roaming\Dropbox\bin\PyQt5.QtWebEngineWidgets.cp36-win32.pyd

After "Restoring" the file back to the proper place and updating F-Prot definitions, it seems okay now. I run a manual scan of the BIN directory and comes up clean. Definitions 1/16/19 @ 8:18am.

I'm able to load DropBox now and everything seems to run okay. No strange processes looking at Process Hacker. Maybe a false positive? I know this has happened in past numerous times with F-Prot.

EDIT: Also extracting all files in "DropboxClient_64.4.141.exe" and scanning the folder comes up clean now too.