dlvphoto Posted April 22, 2017 ID:1119095 Share Posted April 22, 2017 (edited) During a scan today, Malwarebytes tagged dropbox.exe as ransomware and, though it claimed to quarantine the dropbox.exe file, I do not see anything in the quarantine list in the MWB interface. Attached is my mbamservice.log. MBAMSERVICE.zip Edited April 22, 2017 by dlvphoto spelling. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 22, 2017 Staff ID:1119096 Share Posted April 22, 2017 Hi, This has been fixed already. As you've noticed, this file wasn't quarantined, so I will report this behavior of the development team. Thanks for reporting this! Link to post Share on other sites More sharing options...
dlvphoto Posted April 22, 2017 Author ID:1119097 Share Posted April 22, 2017 It wasn't quarantined, but it was deleted from my system. I am going to have to reinstall Dropbox to get it functional again. Is there any indication why dropbox was tagged with a false positive? Link to post Share on other sites More sharing options...
Staff miekiemoes Posted April 22, 2017 Staff ID:1119100 Share Posted April 22, 2017 Hi, This detection was a generic detection based upon behavior. So the file was really deleted and not just ended in processes? Can you please verify if this file is still present? C:\Program Files (x86)\Dropbox\Client\Dropbox.exe Thanks! Link to post Share on other sites More sharing options...
JMac001 Posted April 27, 2017 ID:1120235 Share Posted April 27, 2017 Really deleted, not just ended. Dropbox was just removed completely from my computer here a half hour ago. Nothing in quarantine, nothing in the Reports section, though it does show in the MBAMService Log. I also posted to the other Dropbox thread and attached my log there. Jim Link to post Share on other sites More sharing options...
stocksohio Posted April 27, 2017 ID:1120352 Share Posted April 27, 2017 (edited) I am having this same issue - quarantined dropbox the other day. I took it out of quarantine, now it's done the same thing and requiring a reboot before I can unquarantine it. Should I just add dropbox as an exclusion from Malwarebytes? I've been using them together for years and never had an issue before this. Edited April 27, 2017 by stocksohio Link to post Share on other sites More sharing options...
stocksohio Posted April 27, 2017 ID:1120354 Share Posted April 27, 2017 Oops, forgot to turn on notify me of replies. Posting this to make sure I'm alerted to response. Link to post Share on other sites More sharing options...
JMac001 Posted April 27, 2017 ID:1120366 Share Posted April 27, 2017 Miekiemoes, Well I can confirm that Dropbox was completely wiped from my computer. I was surprised that it hasn't happened to more users, but then again I only got the short pop-up on my screen. Nothing in quarantine and nothing in reports. If I hadn't been at the computer and seen the pop-up I wouldn't have known that MB was even involved. I wonder how many people are missing their Dropbox and not realizing that MB deleted it. Thank you. Jim Link to post Share on other sites More sharing options...
dlvphoto Posted April 27, 2017 Author ID:1120384 Share Posted April 27, 2017 I confirmed that the dropbox.exe was deleted from my system before reinstalling Dropbox. The re-installation required me to disable malwarebytes completely before it would allow me to do so. Since then, I have had no further issues and the current updated signature database seems to be interpreting dropbox properly. I appreciate the nature of the task MWB has to perform and the line between something like dropbox and a malware dropper is a very fine one as far as automatic detection goes. However, closer coordination with the companies that publish the legitimate applications to ensure your signature databases have a good "friend / foe" recognition table would help prevent this kind of thing. (on a side note: It always amuses and pleases me to see MWB block outbound attempts for itunes to contact apple's me.com servers every time it launches. No free data for Apple!) Link to post Share on other sites More sharing options...
rrauenza Posted April 27, 2017 ID:1120391 Share Posted April 27, 2017 Dropbox is also being labelled as quarantine on my system as of this morning (4/27/2017, 8am PDT). My malwarebytes definitions are up to date... Link to post Share on other sites More sharing options...
nikhils Posted April 28, 2017 ID:1120654 Share Posted April 28, 2017 Hello , Is there a specific action to trigger this detection or was just Dropbox just running the background? Any specific/detailed information would help us out. Thank you Link to post Share on other sites More sharing options...
rrauenza Posted April 28, 2017 ID:1120657 Share Posted April 28, 2017 No, I had just logged into it and found the message from malwarebytes. I went ahead and allowed it to quarantine, rebooted, unquarantined, and rebooted again. It didn't quarantine it again.. yet. Link to post Share on other sites More sharing options...
dlvphoto Posted April 29, 2017 Author ID:1120892 Share Posted April 29, 2017 There were no specific actions. I had no files being synced and nothing new had been synced to my dropbox folders in several days. Other than the normal process running in the background watching my shared folders, there was no other action going on. MWB has had no alerts or warmings of any of the content in my dropbox folders either, which is what I would have expected rather than the dropbox executable itself. Link to post Share on other sites More sharing options...
GorG Posted May 2, 2017 ID:1121449 Share Posted May 2, 2017 I'm having the same issue today. Dropbox Issue.txt Link to post Share on other sites More sharing options...
jessejayjones Posted May 2, 2017 ID:1121594 Share Posted May 2, 2017 Writing to confirm this just happened to me too. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted May 2, 2017 Staff ID:1121606 Share Posted May 2, 2017 Hi, As an update, we have fixed some issues around this in our new beta - so please feel free to test our new beta that is being posted here: Just be aware, this is a beta- version and might still have bugs. So for any bugs you encounter with this, I suggest you post in this forum: https://forums.malwarebytes.com/forum/41-malwarebytes-30/ and say that you are using this beta - build. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts