10

I was just using SysInternals ProcMon.exe to track down a problem and found Dropbox.exe accesing files outside of the Dropbox folder I have configured.

My Dropbox location is at C:\users\pats\Dropbox

I see the following in a ProcMon log I was studying:

QueryOpen \\host\share\users\pats\somedir\myfile.7z

Does anyone have an idea why Dropbox.exe is accessing files outside of the configured Dropbox directroy? Other than the obvious bad reasons (like its copying all of your files, its a Trojan, etc)?

Does anyone else see this behavior when running Dropbox and SysInternals ProcMon.exe?

NOTE: I didn't see Dropbox.exe reading the data (at least from the ProcMon log I looked at) so perhaps it's a "feature" not a bug.

NOTE 2: This post on the Dropbox forums discusses a concern of Dropbox having a Trojan in it, but it basically says that there is no Trojan in Dropbox.

Duijf
  • 689
PatS
  • 301
  • Is \host\share\users\pats\somedir\myfile.7z the actual file path? It would help to know the actual file in question. – iglvzx Dec 19 '11 at 07:39
  • I didn't save the log, and I don't remember the name. Sorry about that. I didn't think the exact name would matter. I thought the observation that DropBox.exe was accessing a remote share was interesting enough. – PatS Dec 20 '11 at 17:55

1 Answers1

5

I have encountered the same problem. Here is the answer by Dropbox support:

we use an Explorer dll (%APPDATA%\Dropbox\bin\DropboxExt.xx.dll and %APPDATA%\Dropbox\bin\DropboxExt64.xx.dll) to draw syncing icons on files and present context menus when you right click. When you open an Explorer window, we need to check if those files are in the Dropbox folder so we can render the icons. In order to do this, the dll lists files in the open Explorer windows and asks Dropbox if there's anything to draw on those files. That way we can decide if files that are in Libraries, or possibly symlinked from the Dropbox folder, need syncing icons.

unor
  • 3,096
Arhangelsky
  • 51
  • 1
    What a nice explanation for covering access violations this would be. Note: I am using the conjunctive form. To the original poster: Thanks for sharing your observations! – porg Feb 10 '14 at 15:56