I was infected by a Trojan it's synced in Dropbox, too. What should I do?

[bertonstott]

When I try to open or install DropBox on my Windows laptop, I get an "Infection Blocked" error from Iolo System Mechaninc (My anti-virus program). 

The infected object is reported to be C:\PROGRAM FILES (X86)\DROPBOX\CLIENT_45.4.92\PSUTIL_PSUTIL_WINDOWS.PYD. 

The infection name is W32/s-462f1630!Eldorado. 

The infection type is Trojan.  

The Antivirus blocked and quarantined this object, preventing DropBox from opening.\ 

Am I safe to add an exception for this?  Is it a false alarm? 

I should add that when I try to reinstall DropBox I get that error, followed shortly by a popup box reporting Error 2. It doesn't install.

[Walter]

Hey there @samarik - nice screenshot 

As per your inquiry now, could you please shed some light on what exactly is your concern about this? Are you having a problem setting an exclusion on your Windows Defender? 

Any clarification would be highly appreciated. Thanks!

[samarik]

Hi every one, 

---

 wrote:

Hey there  - nice screenshot 

As per your inquiry now, could you please shed some light on what exactly is your concern about this? Are you having a problem setting an exclusion on your Windows Defender? 

Any clarification would be highly appreciated. Thanks!

---

thanks, Walter for Reply,  Okay for about one week my widows' defender start to flag Trojan when Dropbox app syncing during bootup, the details show that this folder is (.dropbox.cache) with temp extension file in it. Every time starts windows, I delete this folder until I did the Exclusion as it a false indication, then its synced fully in LOL. it was a Real trojan>>> immediately deleted from shared folder online and did some test by https://www.virustotal.com/en/ on it locally all site Flagged it, so, I kept the file for more analyzing
actually DropBox app was doing a great Job Declaring this file to windows security,

now I have cleaned my System. it was

[Walter]

Thanks for the clarifications @samarik - glad to hear you managed to resolve your concerns.

For more context now,  note that our desktop application uses the ".dropbox.cache" folder as a staging area to download your files in small chunks - this is part of the syncing process.

Sometimes antivirus programs will pick up these partial files as false positives and continue to quarantine them. The problem in this case is that Dropbox keeps downloading the file in an attempt to sync the file down to your device.

You should be able to tackle this by adding the Dropbox cache folder to an ignore list so that Dropbox can correctly sync that file and/or temporarily disabling your antivirus. Once synced, you should no longer see these warnings or quarantine messages. 

Hope this clears this up a bit and do let me know if there's anything else I can help with. 

[Flow9]

Dropbox is not a virus.

[samarik]

@Flow9  100% correct

---

 wrote:

Dropbox is not a virus.

---

it was a real virus,  I was not able to locate the file, so when I add the DropBox temporary folder in the ignore list, it synced all to my hard drive.

then I cleaned the source file that infected online, by deleting 

[samarik]

thanks, @Walter for taking care of this issue, actually it was a real infected file,  windows defender pointing to the dropbox temp file and there is nothing when I check the folders even when I did restore,  it was confusing.

so when I add the folder ".dropbox.cache"  to the ignore list the infected file synced fully to my hard drive then windows defender points to the location with the clear link and file name,  make me able to track it and deleted.

I still have a copy in my external drive for analyzing.

cheers

[Walter]

Glad you managed to tackle this and should you need anything else, just let me know @samarik! 

[MikeMoyer]

How do I add the dropbox cache folder to the ignore list for Windows Defender/Win 10

[Walter]

That's a question for another forum I guess @MikeMoyer but still I'd like to help so please give these steps a try and let me know if they did the trick for you:

1. Go to Start > Settings > Update & Security > Windows Security > Virus & thread protection.
2. Under Virus & threat protection settings, select Manage settings, and then under Exclusions, select Add or remove exclusions.
3. Select Add an exclusion, and then select from files, folders, file types, or process.

Hope this helps!