Microsoft Technical Takeoff: Windows and Microsoft Intune
Oct 24 2022 07:00 AM - Oct 27 2022 12:00 PM (PDT)

When Dropbox starts, Windows Defender pops up an alert

Occasional Contributor

In Windows 10 Pro v1809.

When I start the Dropbox application that integrates Dropbox in File explorer, Windows Defender immediately pops up with an high level alert: HackTool:Win32/Mailpassview

The status is the: in quarantine.

I contacted the Dropbox serviceline. They tell me it is probably a false positive and that I should white list the Dropbox application. I refused that because they did not explain this unusual behavior.

When asked for more explanation the replied as follows.


The Dropbox desktop client uses the ".dropbox.cache" folder as a staging area to download your files in small chunks. Sometimes antivirus programs will pick up these partial files as false positives and continuously quarantine them. The problem is that Dropbox keeps downloading the file in an attempt to sync the file down to your device. I would recommend adding the Dropbox cache folder to an ignore list so that Dropbox can correctly sync that file and/or temporarily disabling your antivirus.

Once synced, you should no longer see these warnings or quarantine messages.


But my problem with that is, that I do not use the Controlled Folder Access in Windows Defender. And where do I find this so called ignore list? Besides that I also ask myself is this a wise thing to do?


Can anyone help me out here? Is this problem known to the Defender team?







0 Replies