Child Item

Does dbxsvc.exe in Windows System32 folder actually belong to Dropbox program?

Hi, I'm running Dropbox on Windows 10 and everything is basically working fine. Some time ago I noticed a new service called "Dbxsvc" running on my computer. It runs from a file named dbxsvc.exe in my Windows System32 folder.

Is this some kind of malware or some new part of the Dropbox program?

I know there are two other dbxsvc.exe files on my computer. They are in:

C:\Program Files (x86)\Dropbox\Client\driver_amd64\dbxsvc.exe

C:\Program Files (x86)\Dropbox\Client\driver_x86\dbxsvc.exe

They seems legitimate. But this third one in System32 is the one running the "Dbxsvc" service.

I've managed to shut down and delete the service and then delete the file itself. Dropbox still works just fine.

The thing is, this file reappears randomly.

So should I leave it or be worried about it?

No other strange behavior on my pc and Windows Defender doesn't seem to have a problem with this file.

If anyone can help, thanks!

Find more posts tagged with

Setting Up the Apps

Desktop

Windows

Spam

Insightful

Delivered

Accepted answers

Dorothy_Jane

Hey Taffel,

The new service you're seeing is an intended part of the application, I'd advise leaving it as is.

You noted sync still appears to work correctly without this service however should you encounter any sync issues with the service removed it will limit our ability to resolve the issue.

All comments

Dorothy_Jane

Taffelzips

Thanks for the info! This is actually quite a relief, since I was getting a bit paranoid, maybe because the service name "Dbxsvc" is a bit "shady"

(I know it does have a good description though in the Services window.)

But thanks!

Dorothy_Jane

Sure thing!

Brian1

@Taffelzips wrote:
I know it does have a good description though in the Services window.

Typo. You meant "doesn't."

It has no description at all.

So, what is it, exactly? I'd check the comprehensive release notes, but those also don't exist.

Brian1

I have the same question, Brian. We think alike.

What is the exact purpose of that service?

DM77

I've got the same question/problem. I've uninstalled Dropbox completely and this service is still running. One would think if Dropbox installed it it should be removed when uninstalled.

It doesn't APPEAR to be malware at this time..

https://www.virustotal.com/en/file/38f64f215755e410f69f5bd88fce6011093665f4c29dee60a70632221d0c2bb3/analysis/1482710851/

DM77

If Dropbox is removed, why isn't this service uninstalled/removed?

SChalice

Because DropBox appears to be a really shady company. I am going to try my best to never ever use DropBox even though I have clients that do.

DropBox cannot be trusted!!!!

MarcusJT

I keep seeing errors in the Windows Application log relating to DbxSvc, which all look like this:

Failed to connect to the driver: (-2147024894) The system cannot find the file specified.

Why is this happening? What driver?

MaxAmbition

I too noticed the same thing.

Dropbox, I believe you owe the world an explanation as what this .exe is doing on our systems if it is not related to syncing.

Josh L.20

WHAT does the "intended part of the application" do, which Dropbox.exe doesn't do?

Now I have three services related to Dropbox:

- Dbxsvc.exe = SYSTEM account - Started
- Dropbox Update Service (dbupdate) - Automatic (Delayed)
- Dropbox Update Service (dbupdatem) - Manual

Someone please chime in...

Roger P.16

As Dropbox will not specify what these services do, I have completely disabled dbupdate and dbupdatem using Autoruns, and set dbxsvc.exe to start manually through Control Panel/Administrative Tools/Services, all without any adverse effect on the program's functionality as far as I can detect.

SChalice

Roger, are you suggesting that DropBox still functions properly even without dbxsvc? If so, then that is pretty much proof that it is spyware.

Does DropBox really want this kind of scrutiny? How many millions in dollars in revenue, if not the life of the company itself, are they risking?

Josh L.20

It's funny - the file hash is now showing "oldf917.tmp" rather than "DbxSvc.exe"

JustinT

It has no description at all.

So, what is it, exactly? I'd check the comprehensive release notes, but those also don't exist.

Right.

These are astonishingly shady service characteristics (e.g., spyware-ish name, spyware-ish executable file location). Frankly, I'd be more inclined to believe "Dropboxer" Dorothy Jane completely mispoke, and the fake Dropbox service just happened to come from an unrelated spyware infection... but, even bigger companies have made similarly stunning mistakes in the recent past. So anything is possible.

We need an official explanation.

SChalice

I think we got our answer by their silence on this thread. I suggest that is simply a backdoor trojan and NSA spyware.

Rich

@SChalice wrote:
I think we got our answer by their silence on this thread. I suggest that is simply a backdoor trojan and NSA spyware.

Thank you! I needed a good laugh today.

JustinT

@SChalice wrote:
I think we got our answer by their silence on this thread. I suggest that is simply a backdoor trojan and NSA spyware.

Is that legal, these days? Normally, I'd expect ramifications, but... not in the nightmarish, anti-privacy dystopia we live in now.

JustinT

@Rich wrote:
Thank you! I needed a good laugh today.

Did you have a good LOL when Sony slapped a rootkit on your PC?

SChalice

Edward Snowden has warned against the cloud storage service Dropbox which he says is "hostile to privacy".

Snowden pointed out that Dropbox had appointed former Secretary of State Condoleezza Rice to its board in April 2014.

"Dropbox is a targeted you know wannabe PRISM partner," he told the Guardian.

https://www.theguardian.com/technology/2014/jul/17/edward-snowden-dropbox-privacy-spideroak

According to Edward Snowden, people who care about their privacy should stay away from popular consumer Internet services like Dropbox.

Condoleezza Rice advocates illegal NSA surveillance

http://www.drop-dropbox.com/surveillance.html

Dropbox may be reading your stored documents. This revelation arrives by way of WNC InfoSec who claim that several ".doc" files had been opened on the Dropbox end in a recent test using HoneyDocs. Dropbox reportedly states that this is normal behavior for the storage company.

http://www.tomsguide.com/us/dropbox-libreoffice-honeydocs-amazon-ec2-amazon-s3,news-17549.html

SChalice

Is that legal, these days?

It is not illegal. Good luck suing Dropbox for invasion of privacy when you were the one installing it.

https://en.wikipedia.org/wiki/Privacy_laws_of_the_United_States

Roger P.16

@SChalice wrote:
Roger, are you suggesting that DropBox still functions properly even without dbxsvc?

Yes, exactly that - although the desktop app may start the dbxcvc service, it doesn't need to be running otherwise.

Ilrizzo

I'm seeing the same issue with DBXSRV service. Its leaving a log every second in the event viewer.

tsunomurxps13

My Windows 10(1703) PC is happening same problem.

Following log is recorded to "Application" log each 1 second:

Failed to connect to the driver: -2147024894, retrying in 1000 milliseconds

I have reinstall latest DropBox but didn't resolved.

So I have uninstalled from my PC.

Garrett

How many of those who posted on this issue have encrypted drives? I do. Just curious. This problem is getting near a year old. The recent uptick of errors in the event viewer is severe, but it's not new for sure.

Encrypted? Not Encrypted?

maxius2

maybe do system32\regsvr32 c:/windows/system32/DbxSvc.exe to assign this as the dropbox file to use again