This window is opening up uninvited.

https://www.dropbox.com/scl/fi/p916rstqzcrfrmqrek6qw/DropboxNativeMessaging.jpg?rlkey=a79rv553ejk5e169ayqvpft43&raw=1

Such as shortly after opening Chrome. Apparently something to do with a
Chrome extension. But no such extension.

This arose at some stage of trouble shooting a more serious Dropbox
issue: the context menu entries for Dropbox have disappeared. Tried all
the obvious restarts in vain. Most articles/posts I read about NativeHostMessaging or DropboxNativeHostMessaging are over my head.

Don't know how I started it, but now eager to just get rid of it.

Terry

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Mon, 10/28/2024 1:22 PM, Terry Pinnell wrote:

This window is opening up uninvited.

https://www.dropbox.com/scl/fi/p916rstqzcrfrmqrek6qw/DropboxNativeMessaging.jpg?rlkey=a79rv553ejk5e169ayqvpft43&raw=1

Such as shortly after opening Chrome. Apparently something to do with a Chrome extension. But no such extension.

This arose at some stage of trouble shooting a more serious Dropbox
issue: the context menu entries for Dropbox have disappeared. Tried all
the obvious restarts in vain. Most articles/posts I read about NativeHostMessaging or DropboxNativeHostMessaging are over my head.

Don't know how I started it, but now eager to just get rid of it.

Terry

My guess, is when it isn't malware, it is part of the Dropbox installation. These could be win32 executables for example. Dropbox is also available
as a Metro.App, in which case the folder of residence is different (and
harder to find and impossible to access and protected by a manifest).
You can list anything, with nfi.exe for example.

C:\Program Files (x86)\Dropbox\Client\171.4.6182\DropboxNativeMessagingHost.exe

https://www.advanceduninstaller.com/Dropbox-577cd3abbfe79ac34d5840776af79ad8-application.htm

"The following executables are incorporated in Dropbox.
They occupy 11.73 MB (12302824 bytes) on disk.

Dropbox.exe (10.80 MB)
DropboxUninstaller.exe (222.35 KB)
DropboxNativeMessagingHost.exe (361.73 KB)
DropboxThumbnailGenerator.exe (36.23 KB)
DropboxUpdateProxy32.exe (286.73 KB)
dbxsvc.exe (45.73 KB)
"

With the disk drive offline, you could try scanning files like that on Virustotal.com
(owned by Google).

Paul

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Terry Pinnell <me@somewhere.invalid> wrote:

This window is opening up uninvited.

https://www.dropbox.com/scl/fi/p916rstqzcrfrmqrek6qw/DropboxNativeMessaging.jpg?rlkey=a79rv553ejk5e169ayqvpft43&raw=1

Such as shortly after opening Chrome. Apparently something to do with a Chrome extension. But no such extension.

This arose at some stage of trouble shooting a more serious Dropbox
issue: the context menu entries for Dropbox have disappeared. Tried all
the obvious restarts in vain. Most articles/posts I read about NativeHostMessaging or DropboxNativeHostMessaging are over my head.

Don't know how I started it, but now eager to just get rid of it.

Been a long time, but, as I recall, you could configure Chrome to send messages/data to a client-side application (aka handlers). See if you previously okayed a handler by going to:

chrome://settings/handlers

Or go into Chrome's settings to look at what permissions you granted per
site, or on allowing protocol handlers.

In Edge-C, a Chromium variant after Microsoft dropped their EdgeHTML
renderer and Javascript script interpreter to use Blink and J8, you go
to edge://settings/content, and scroll down to Site Permissions where
you find an option to enable/disable protocol handlers. I have it
disabled in Edge-C.

For Chrome, might be Menu > Settings > Privacy and security > Site
settings > Additional permissions > Handlers.

I certainly don't want some site that I visit making itself a default
protocol handler for some URL scheme. I disable that "feature".

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Paul <nospam@needed.invalid> wrote:

On Mon, 10/28/2024 1:22 PM, Terry Pinnell wrote:

This window is opening up uninvited.

https://www.dropbox.com/scl/fi/p916rstqzcrfrmqrek6qw/DropboxNativeMessaging.jpg?rlkey=a79rv553ejk5e169ayqvpft43&raw=1

Such as shortly after opening Chrome. Apparently something to do with a
Chrome extension. But no such extension.

This arose at some stage of trouble shooting a more serious Dropbox
issue: the context menu entries for Dropbox have disappeared. Tried all
the obvious restarts in vain. Most articles/posts I read about
NativeHostMessaging or DropboxNativeHostMessaging are over my head.

Don't know how I started it, but now eager to just get rid of it.

Terry

My guess, is when it isn't malware, it is part of the Dropbox installation. >These could be win32 executables for example. Dropbox is also available
as a Metro.App, in which case the folder of residence is different (and >harder to find and impossible to access and protected by a manifest).
You can list anything, with nfi.exe for example.

C:\Program Files (x86)\Dropbox\Client\171.4.6182\DropboxNativeMessagingHost.exe

https://www.advanceduninstaller.com/Dropbox-577cd3abbfe79ac34d5840776af79ad8-application.htm

"The following executables are incorporated in Dropbox.
They occupy 11.73 MB (12302824 bytes) on disk.

Dropbox.exe (10.80 MB)
DropboxUninstaller.exe (222.35 KB)
DropboxNativeMessagingHost.exe (361.73 KB)
DropboxThumbnailGenerator.exe (36.23 KB)
DropboxUpdateProxy32.exe (286.73 KB)
dbxsvc.exe (45.73 KB)
"

With the disk drive offline, you could try scanning files like that on Virustotal.com
(owned by Google).

Paul

Thanks Paul. I'll do some virus/malware scanning but am I right that you suggest the best step would be to re-install Dropbox?

Terry

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

VanguardLH <V@nguard.LH> wrote:

Terry Pinnell <me@somewhere.invalid> wrote:

This window is opening up uninvited.

https://www.dropbox.com/scl/fi/p916rstqzcrfrmqrek6qw/DropboxNativeMessaging.jpg?rlkey=a79rv553ejk5e169ayqvpft43&raw=1

Such as shortly after opening Chrome. Apparently something to do with a
Chrome extension. But no such extension.

This arose at some stage of trouble shooting a more serious Dropbox
issue: the context menu entries for Dropbox have disappeared. Tried all
the obvious restarts in vain. Most articles/posts I read about
NativeHostMessaging or DropboxNativeHostMessaging are over my head.

Don't know how I started it, but now eager to just get rid of it.

Been a long time, but, as I recall, you could configure Chrome to send >messages/data to a client-side application (aka handlers). See if you >previously okayed a handler by going to:

chrome://settings/handlers

Or go into Chrome's settings to look at what permissions you granted per >site, or on allowing protocol handlers.

In Edge-C, a Chromium variant after Microsoft dropped their EdgeHTML
renderer and Javascript script interpreter to use Blink and J8, you go
to edge://settings/content, and scroll down to Site Permissions where
you find an option to enable/disable protocol handlers. I have it
disabled in Edge-C.

For Chrome, might be Menu > Settings > Privacy and security > Site
settings > Additional permissions > Handlers.

I certainly don't want some site that I visit making itself a default >protocol handler for some URL scheme. I disable that "feature".

Thanks, glad to have you and Paul on the case. Much of both replies is
sadly heavy going for me. I've started with your suggestions. Here are a
few screenshots. https://www.dropbox.com/scl/fi/0a1vausdclwx0ufi0ivu5/PrivacySiteSettings-1.jpg?rlkey=gqs5afl8ecolb8b3dlm52un67&raw=1
https://www.dropbox.com/scl/fi/ev0kozcewa6hotd1xn3d7/PrivacySiteSettings-2.jpg?rlkey=51ldsvlm71pvid9xf8pejwezy&raw=1
https://www.dropbox.com/scl/fi/ev0kozcewa6hotd1xn3d7/PrivacySiteSettings-2.jpg?rlkey=51ldsvlm71pvid9xf8pejwezy&raw=1
https://www.dropbox.com/scl/fi/ev0kozcewa6hotd1xn3d7/PrivacySiteSettings-2.jpg?rlkey=51ldsvlm71pvid9xf8pejwezy&raw=1

Bottom line: I'm floundering!
Let me know what info might help diagnosis.

Should I desist deleting any of those options?

Perhaps reinstall Chrome?

Terry

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Mon, 10/28/2024 5:22 PM, Terry Pinnell wrote:

Paul <nospam@needed.invalid> wrote:

On Mon, 10/28/2024 1:22 PM, Terry Pinnell wrote:

This window is opening up uninvited.

https://www.dropbox.com/scl/fi/p916rstqzcrfrmqrek6qw/DropboxNativeMessaging.jpg?rlkey=a79rv553ejk5e169ayqvpft43&raw=1

Such as shortly after opening Chrome. Apparently something to do with a
Chrome extension. But no such extension.

This arose at some stage of trouble shooting a more serious Dropbox
issue: the context menu entries for Dropbox have disappeared. Tried all
the obvious restarts in vain. Most articles/posts I read about
NativeHostMessaging or DropboxNativeHostMessaging are over my head.

Don't know how I started it, but now eager to just get rid of it.

Terry

My guess, is when it isn't malware, it is part of the Dropbox installation. >> These could be win32 executables for example. Dropbox is also available
as a Metro.App, in which case the folder of residence is different (and
harder to find and impossible to access and protected by a manifest).
You can list anything, with nfi.exe for example.

C:\Program Files (x86)\Dropbox\Client\171.4.6182\DropboxNativeMessagingHost.exe

https://www.advanceduninstaller.com/Dropbox-577cd3abbfe79ac34d5840776af79ad8-application.htm

"The following executables are incorporated in Dropbox.
They occupy 11.73 MB (12302824 bytes) on disk.

Dropbox.exe (10.80 MB)
DropboxUninstaller.exe (222.35 KB)
DropboxNativeMessagingHost.exe (361.73 KB)
DropboxThumbnailGenerator.exe (36.23 KB)
DropboxUpdateProxy32.exe (286.73 KB)
dbxsvc.exe (45.73 KB)
"

With the disk drive offline, you could try scanning files like that on Virustotal.com
(owned by Google).

Paul

Thanks Paul. I'll do some virus/malware scanning but am I right that you suggest the best step would be to re-install Dropbox?

Terry

At this point, I'm in the dark as much as you are, as to
what is going on, and what sequence is involved. I entered the
details of the pattern in Google, and nothing is showing up.

If you use Process Explorer from Sysinternals, while that
command prompt window is open, you can hold the mouse over the
line on the screen, and look for the arguments passed to the executable,
to get further evidence of where that command is being crafted.
The Task Manager doesn't give as much info.

https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer

Paul

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Paul <nospam@needed.invalid> wrote:

On Mon, 10/28/2024 5:22 PM, Terry Pinnell wrote:

Paul <nospam@needed.invalid> wrote:

On Mon, 10/28/2024 1:22 PM, Terry Pinnell wrote:

This window is opening up uninvited.

https://www.dropbox.com/scl/fi/p916rstqzcrfrmqrek6qw/DropboxNativeMessaging.jpg?rlkey=a79rv553ejk5e169ayqvpft43&raw=1

Such as shortly after opening Chrome. Apparently something to do with a >>>> Chrome extension. But no such extension.

This arose at some stage of trouble shooting a more serious Dropbox
issue: the context menu entries for Dropbox have disappeared. Tried all >>>> the obvious restarts in vain. Most articles/posts I read about
NativeHostMessaging or DropboxNativeHostMessaging are over my head.

Don't know how I started it, but now eager to just get rid of it.

Terry

My guess, is when it isn't malware, it is part of the Dropbox installation. >>> These could be win32 executables for example. Dropbox is also available
as a Metro.App, in which case the folder of residence is different (and
harder to find and impossible to access and protected by a manifest).
You can list anything, with nfi.exe for example.

C:\Program Files (x86)\Dropbox\Client\171.4.6182\DropboxNativeMessagingHost.exe

https://www.advanceduninstaller.com/Dropbox-577cd3abbfe79ac34d5840776af79ad8-application.htm

"The following executables are incorporated in Dropbox.
They occupy 11.73 MB (12302824 bytes) on disk.

Dropbox.exe (10.80 MB)
DropboxUninstaller.exe (222.35 KB)
DropboxNativeMessagingHost.exe (361.73 KB)
DropboxThumbnailGenerator.exe (36.23 KB)
DropboxUpdateProxy32.exe (286.73 KB)
dbxsvc.exe (45.73 KB)
"

With the disk drive offline, you could try scanning files like that on Virustotal.com
(owned by Google).

Paul

Thanks Paul. I'll do some virus/malware scanning but am I right that you
suggest the best step would be to re-install Dropbox?

Terry

At this point, I'm in the dark as much as you are, as to
what is going on, and what sequence is involved. I entered the
details of the pattern in Google, and nothing is showing up.

If you use Process Explorer from Sysinternals, while that
command prompt window is open, you can hold the mouse over the
line on the screen, and look for the arguments passed to the executable,
to get further evidence of where that command is being crafted.
The Task Manager doesn't give as much info.

https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer

Paul

This from digging around in the registry: https://www.dropbox.com/scl/fi/ogcoehbvqwhrflvd6txao/RegistryPossibleClue.jpg?rlkey=46i0vmsunf8b31iu8ajrylfzk&raw=1

This is the JSON file, (edited for security) :

{
"name": "com.dropbox.nmh",
"description": "Native Messaging Host for interacting with Dropbox Passwords browser extensions.",
"path": "../../../DropboxNativeMessagingHost.exe",
"type": "stdio",
"allowed_origins": [
"chrome-extension://ekldlkji----------- bknj/",
"chrome-extension://dfcjmolhh-----------foipgdekjien/",
"chrome-extension://bmhejbnm------------------kcfabg/"
]
}

I do get passwords frequently into Chrome from Dropbox Passwords, for
fastger logon, so wouldn't want to lose that. Those 'allowed origins'
are obviously not meant to be understood by humans? So deciding what to
do next is obscure!

Reckon I'm going to abandon it for tonight before I do something stupid.
Terry, UK Mon 28 Oct 2024 22:07

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Terry Pinnell <me@somewhere.invalid> wrote:

Paul <nospam@needed.invalid> wrote:

On Mon, 10/28/2024 5:22 PM, Terry Pinnell wrote:

Paul <nospam@needed.invalid> wrote:

On Mon, 10/28/2024 1:22 PM, Terry Pinnell wrote:

This window is opening up uninvited.

https://www.dropbox.com/scl/fi/p916rstqzcrfrmqrek6qw/DropboxNativeMessaging.jpg?rlkey=a79rv553ejk5e169ayqvpft43&raw=1

Such as shortly after opening Chrome. Apparently something to do with a >>>>> Chrome extension. But no such extension.

This arose at some stage of trouble shooting a more serious Dropbox
issue: the context menu entries for Dropbox have disappeared. Tried all >>>>> the obvious restarts in vain. Most articles/posts I read about
NativeHostMessaging or DropboxNativeHostMessaging are over my head.

Don't know how I started it, but now eager to just get rid of it.

Terry

My guess, is when it isn't malware, it is part of the Dropbox installation.
These could be win32 executables for example. Dropbox is also available >>>> as a Metro.App, in which case the folder of residence is different (and >>>> harder to find and impossible to access and protected by a manifest).
You can list anything, with nfi.exe for example.

C:\Program Files (x86)\Dropbox\Client\171.4.6182\DropboxNativeMessagingHost.exe

https://www.advanceduninstaller.com/Dropbox-577cd3abbfe79ac34d5840776af79ad8-application.htm

"The following executables are incorporated in Dropbox.
They occupy 11.73 MB (12302824 bytes) on disk.

Dropbox.exe (10.80 MB)
DropboxUninstaller.exe (222.35 KB)
DropboxNativeMessagingHost.exe (361.73 KB)
DropboxThumbnailGenerator.exe (36.23 KB)
DropboxUpdateProxy32.exe (286.73 KB)
dbxsvc.exe (45.73 KB)
"

With the disk drive offline, you could try scanning files like that on Virustotal.com
(owned by Google).

Paul

Thanks Paul. I'll do some virus/malware scanning but am I right that you >>> suggest the best step would be to re-install Dropbox?

Terry

At this point, I'm in the dark as much as you are, as to
what is going on, and what sequence is involved. I entered the
details of the pattern in Google, and nothing is showing up.

If you use Process Explorer from Sysinternals, while that
command prompt window is open, you can hold the mouse over the
line on the screen, and look for the arguments passed to the executable,
to get further evidence of where that command is being crafted.
The Task Manager doesn't give as much info.

https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer

Paul

This from digging around in the registry: https://www.dropbox.com/scl/fi/ogcoehbvqwhrflvd6txao/RegistryPossibleClue.jpg?rlkey=46i0vmsunf8b31iu8ajrylfzk&raw=1

This is the JSON file, (edited for security) :

{
"name": "com.dropbox.nmh",
"description": "Native Messaging Host for interacting with Dropbox Passwords browser extensions.",
"path": "../../../DropboxNativeMessagingHost.exe",
"type": "stdio",
"allowed_origins": [
"chrome-extension://ekldlkji----------- bknj/",
"chrome-extension://dfcjmolhh-----------foipgdekjien/",
"chrome-extension://bmhejbnm------------------kcfabg/"
]
}

I do get passwords frequently into Chrome from Dropbox Passwords, for
fastger logon, so wouldn't want to lose that. Those 'allowed origins'
are obviously not meant to be understood by humans? So deciding what to
do next is obscure!

Reckon I'm going to abandon it for tonight before I do something stupid. Terry, UK Mon 28 Oct 2024 22:07

My guess is those strings are to identify which extension the Dropbox integration is allowed. You said "no such extension" thinking it should
be named Dropbox-something. Do you have ANY extensions installed?

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Terry Pinnell <me@somewhere.invalid> wrote:

VanguardLH <V@nguard.LH> wrote:

Terry Pinnell <me@somewhere.invalid> wrote:

This window is opening up uninvited.

https://www.dropbox.com/scl/fi/p916rstqzcrfrmqrek6qw/DropboxNativeMessaging.jpg?rlkey=a79rv553ejk5e169ayqvpft43&raw=1

Such as shortly after opening Chrome. Apparently something to do with a
Chrome extension. But no such extension.

This arose at some stage of trouble shooting a more serious Dropbox
issue: the context menu entries for Dropbox have disappeared. Tried all
the obvious restarts in vain. Most articles/posts I read about
NativeHostMessaging or DropboxNativeHostMessaging are over my head.

Don't know how I started it, but now eager to just get rid of it.

Been a long time, but, as I recall, you could configure Chrome to send >>messages/data to a client-side application (aka handlers). See if you >>previously okayed a handler by going to:

chrome://settings/handlers

Or go into Chrome's settings to look at what permissions you granted per >>site, or on allowing protocol handlers.

In Edge-C, a Chromium variant after Microsoft dropped their EdgeHTML >>renderer and Javascript script interpreter to use Blink and J8, you go
to edge://settings/content, and scroll down to Site Permissions where
you find an option to enable/disable protocol handlers. I have it
disabled in Edge-C.

For Chrome, might be Menu > Settings > Privacy and security > Site
settings > Additional permissions > Handlers.

I certainly don't want some site that I visit making itself a default >>protocol handler for some URL scheme. I disable that "feature".

Thanks, glad to have you and Paul on the case. Much of both replies is
sadly heavy going for me. I've started with your suggestions. Here are a
few screenshots. https://www.dropbox.com/scl/fi/0a1vausdclwx0ufi0ivu5/PrivacySiteSettings-1.jpg?rlkey=gqs5afl8ecolb8b3dlm52un67&raw=1
https://www.dropbox.com/scl/fi/ev0kozcewa6hotd1xn3d7/PrivacySiteSettings-2.jpg?rlkey=51ldsvlm71pvid9xf8pejwezy&raw=1
https://www.dropbox.com/scl/fi/ev0kozcewa6hotd1xn3d7/PrivacySiteSettings-2.jpg?rlkey=51ldsvlm71pvid9xf8pejwezy&raw=1
https://www.dropbox.com/scl/fi/ev0kozcewa6hotd1xn3d7/PrivacySiteSettings-2.jpg?rlkey=51ldsvlm71pvid9xf8pejwezy&raw=1

Bottom line: I'm floundering!
Let me know what info might help diagnosis.

Should I desist deleting any of those options?

Perhaps reinstall Chrome?

Terry

Your screen pics show cookie storage. You need to find out what sites
are allowed to define protocol handlers in Chrome.

https://www.youtube.com/watch?v=shcX5fIRhDY

That shows how to find Protocol Handlers, and to enable/disable the
feature. However, even if you select "Don't allow", likely any sites
you already granted the permission will continue having the permission.
I suspect this setting only deals with sites you visit later that want
to add their protocol handler definition to Chrome.

https://www.youtube.com/watch?v=3lRviuv4alM

That looks to take you to the same navpath in Chrome settings where you
took screen pics; however, when you expanded the dropboxforum.com group,
there were no handlers listed there. Is it only when you visit that
particular domain when you see the problematic window appear?

https://workspacetips.io/tips/chrome/configure-chrome-with-service-handlers/

In that dialog showing how to enable/disable sites from prompting to add
a handler, were any handlers listed? Did chrome://settings/handlers
list anything?

You said "no such extension". That does not state "no extensions". Are
there ANY extensions installed into your Chrome? Have you tried
disabling all extensions, reload Chrome, and retest?

You said the window appears shortly after you load Chrome. What is your
home page in Chrome? Tried using about:blank instead? Configure Chrome
to open about:blank (and no other web pages) as your Home page, exit,
and reload Chrome. "Shortly" after Chrome loads, do you still get the problematic window appearing?

When you visit a web page for which a handler was defined, I believe a double-diamond icon appears at the right end of the omnibar (address
bar).

https://workspacetips.io/tips/chrome/configure-chrome-with-service-handlers/

That has a pic showing the double-diamond icon (where the red arrow
points) at the right end of the omnibar.

I have Dropbox installed. I found no settings within it that has it self-designate itself as a handler for any web browser. Under its Notifications settings, those are popups created by Dropbox itself.

https://www.dropbox.com/account/notifications?role=personal

Those are additional server-side notifications. I have all of them
disabled except "running out of space". Under the Apps tab, there was a
client that I had uninstalled, so any integration with it was worthless,
so I expanded the entry to click on Disconnect.

You sure the problematic window was generated by Chrome? Maybe it was
opened by Dropbox. You can use SysInternals' Process Explorer (PE) to
find out. When the problematic window appears, click on the sniper icon
in PE's toolbar to drag it over the problematic window. PE will show
which process owns that window.

You said "Apparently something to do with a Chrome extension". How did
you come to that conclusion?

https://www.dropbox.com/app-integrations

They list some programs where Dropbox is integrated within them, but no
web browsers were listed.

https://zapier.com/apps/dropbox/integrations
https://www.dropbox.com/apps

That lists some more DropBox integrations. Seems lots of apps integrate
with Dropbox. I would login to your Dropbox account, and look at your
account settings to see which apps are linked to your Dropbox account.

Something else to try is go into the Dropbox app, and logout. Then load
Chrome to see if the problematic window appears, or not.

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Mon, 10/28/2024 7:23 PM, VanguardLH wrote:

Terry Pinnell <me@somewhere.invalid> wrote:

Paul <nospam@needed.invalid> wrote:

On Mon, 10/28/2024 5:22 PM, Terry Pinnell wrote:

Paul <nospam@needed.invalid> wrote:

On Mon, 10/28/2024 1:22 PM, Terry Pinnell wrote:

This window is opening up uninvited.

https://www.dropbox.com/scl/fi/p916rstqzcrfrmqrek6qw/DropboxNativeMessaging.jpg?rlkey=a79rv553ejk5e169ayqvpft43&raw=1

Such as shortly after opening Chrome. Apparently something to do with a >>>>>> Chrome extension. But no such extension.

This arose at some stage of trouble shooting a more serious Dropbox >>>>>> issue: the context menu entries for Dropbox have disappeared. Tried all >>>>>> the obvious restarts in vain. Most articles/posts I read about
NativeHostMessaging or DropboxNativeHostMessaging are over my head. >>>>>>
Don't know how I started it, but now eager to just get rid of it.

Terry

My guess, is when it isn't malware, it is part of the Dropbox installation.
These could be win32 executables for example. Dropbox is also available >>>>> as a Metro.App, in which case the folder of residence is different (and >>>>> harder to find and impossible to access and protected by a manifest). >>>>> You can list anything, with nfi.exe for example.

C:\Program Files (x86)\Dropbox\Client\171.4.6182\DropboxNativeMessagingHost.exe

https://www.advanceduninstaller.com/Dropbox-577cd3abbfe79ac34d5840776af79ad8-application.htm

"The following executables are incorporated in Dropbox.
They occupy 11.73 MB (12302824 bytes) on disk.

Dropbox.exe (10.80 MB)
DropboxUninstaller.exe (222.35 KB)
DropboxNativeMessagingHost.exe (361.73 KB)
DropboxThumbnailGenerator.exe (36.23 KB)
DropboxUpdateProxy32.exe (286.73 KB)
dbxsvc.exe (45.73 KB)
"

With the disk drive offline, you could try scanning files like that on Virustotal.com
(owned by Google).

Paul

Thanks Paul. I'll do some virus/malware scanning but am I right that you >>>> suggest the best step would be to re-install Dropbox?

Terry

At this point, I'm in the dark as much as you are, as to
what is going on, and what sequence is involved. I entered the
details of the pattern in Google, and nothing is showing up.

If you use Process Explorer from Sysinternals, while that
command prompt window is open, you can hold the mouse over the
line on the screen, and look for the arguments passed to the executable, >>> to get further evidence of where that command is being crafted.
The Task Manager doesn't give as much info.

https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer >>>
Paul

This from digging around in the registry:
https://www.dropbox.com/scl/fi/ogcoehbvqwhrflvd6txao/RegistryPossibleClue.jpg?rlkey=46i0vmsunf8b31iu8ajrylfzk&raw=1

This is the JSON file, (edited for security) :

{
"name": "com.dropbox.nmh",
"description": "Native Messaging Host for interacting with Dropbox
Passwords browser extensions.",
"path": "../../../DropboxNativeMessagingHost.exe",
"type": "stdio",
"allowed_origins": [
"chrome-extension://ekldlkji----------- bknj/",
"chrome-extension://dfcjmolhh-----------foipgdekjien/",
"chrome-extension://bmhejbnm------------------kcfabg/"
]
}

I do get passwords frequently into Chrome from Dropbox Passwords, for
fastger logon, so wouldn't want to lose that. Those 'allowed origins'
are obviously not meant to be understood by humans? So deciding what to
do next is obscure!

Reckon I'm going to abandon it for tonight before I do something stupid.
Terry, UK Mon 28 Oct 2024 22:07

My guess is those strings are to identify which extension the Dropbox integration is allowed. You said "no such extension" thinking it should
be named Dropbox-something. Do you have ANY extensions installed?

You could enter the "ekldlkji----------- bknj" string in
a google search, and get the English name of the extension.
It should show up on some sort of "store" web page, with details
of what the extension does.

Any time a problem gives you breadcrumbs, you Google it :-)

Paul

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 28/10/2024 17:22, Terry Pinnell wrote:

Don't know how I started it, but now eager to just get rid of it.

just uninstall Dropbox and see if it made any difference. you might need
to use revouninstaller (portable) to remove everything related to Dropbox.

<https://download.revouninstaller.com/download/RevoUninstaller_Portable.zip>

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Jack <noreply@mandrill.com> wrote:

On 28/10/2024 17:22, Terry Pinnell wrote:

Don't know how I started it, but now eager to just get rid of it.

just uninstall Dropbox and see if it made any difference. you might need
to use revouninstaller (portable) to remove everything related to Dropbox.

<https://download.revouninstaller.com/download/RevoUninstaller_Portable.zip>

That's on the list Jack, but reluctant because of the hassle, and
possible risk to my account settings and data. Any Dropbox user here
done it, with encouraging words?

There's also my discomfort with unsolved puzzles ;-)

See too my imminent post with more info.

Terry

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

VanguardLH <V@nguard.LH> wrote:

Terry Pinnell <me@somewhere.invalid> wrote:

Paul <nospam@needed.invalid> wrote:

On Mon, 10/28/2024 5:22 PM, Terry Pinnell wrote:

Paul <nospam@needed.invalid> wrote:

On Mon, 10/28/2024 1:22 PM, Terry Pinnell wrote:

This window is opening up uninvited.

https://www.dropbox.com/scl/fi/p916rstqzcrfrmqrek6qw/DropboxNativeMessaging.jpg?rlkey=a79rv553ejk5e169ayqvpft43&raw=1

Such as shortly after opening Chrome. Apparently something to do with a >>>>>> Chrome extension. But no such extension.

This arose at some stage of trouble shooting a more serious Dropbox >>>>>> issue: the context menu entries for Dropbox have disappeared. Tried all >>>>>> the obvious restarts in vain. Most articles/posts I read about
NativeHostMessaging or DropboxNativeHostMessaging are over my head. >>>>>>
Don't know how I started it, but now eager to just get rid of it.

Terry

My guess, is when it isn't malware, it is part of the Dropbox installation.
These could be win32 executables for example. Dropbox is also available >>>>> as a Metro.App, in which case the folder of residence is different (and >>>>> harder to find and impossible to access and protected by a manifest). >>>>> You can list anything, with nfi.exe for example.

C:\Program Files (x86)\Dropbox\Client\171.4.6182\DropboxNativeMessagingHost.exe

https://www.advanceduninstaller.com/Dropbox-577cd3abbfe79ac34d5840776af79ad8-application.htm

"The following executables are incorporated in Dropbox.
They occupy 11.73 MB (12302824 bytes) on disk.

Dropbox.exe (10.80 MB)
DropboxUninstaller.exe (222.35 KB)
DropboxNativeMessagingHost.exe (361.73 KB)
DropboxThumbnailGenerator.exe (36.23 KB)
DropboxUpdateProxy32.exe (286.73 KB)
dbxsvc.exe (45.73 KB)
"

With the disk drive offline, you could try scanning files like that on Virustotal.com
(owned by Google).

Paul

Thanks Paul. I'll do some virus/malware scanning but am I right that you >>>> suggest the best step would be to re-install Dropbox?

Terry

At this point, I'm in the dark as much as you are, as to
what is going on, and what sequence is involved. I entered the
details of the pattern in Google, and nothing is showing up.

If you use Process Explorer from Sysinternals, while that
command prompt window is open, you can hold the mouse over the
line on the screen, and look for the arguments passed to the executable, >>>to get further evidence of where that command is being crafted.
The Task Manager doesn't give as much info.

https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer >>>

Paul

This from digging around in the registry:
https://www.dropbox.com/scl/fi/ogcoehbvqwhrflvd6txao/RegistryPossibleClue.jpg?rlkey=46i0vmsunf8b31iu8ajrylfzk&raw=1

This is the JSON file, (edited for security) :

{
"name": "com.dropbox.nmh",
"description": "Native Messaging Host for interacting with Dropbox
Passwords browser extensions.",
"path": "../../../DropboxNativeMessagingHost.exe",
"type": "stdio",
"allowed_origins": [
"chrome-extension://ekldlkji----------- bknj/",
"chrome-extension://dfcjmolhh-----------foipgdekjien/",
"chrome-extension://bmhejbnm------------------kcfabg/"
]
}

I do get passwords frequently into Chrome from Dropbox Passwords, for
fastger logon, so wouldn't want to lose that. Those 'allowed origins'
are obviously not meant to be understood by humans? So deciding what to
do next is obscure!

Reckon I'm going to abandon it for tonight before I do something stupid.
Terry, UK Mon 28 Oct 2024 22:07

My guess is those strings are to identify which extension the Dropbox >integration is allowed. You said "no such extension" thinking it should
be named Dropbox-something. Do you have ANY extensions installed?

Thanks. The fuller, clearer picture following my work this morning
clearly supports your guess above.

Presented as screenshots from the registry and File Explorer.

These two show the same .json https://www.dropbox.com/scl/fi/706f53e6d13n3ifbdm8ce/PossibleRegistryClueSecurity.jpg?rlkey=9cdyrc05h7mo8x8vrhp2eei8h&raw=1
https://www.dropbox.com/scl/fi/pwwz5lxpahchtw2bf5nrp/PossibleRegistryClueManifestJson.jpg?rlkey=5z5qzaub6vl8ibu8a2cfpxpsu&raw=1

This seems to explicitly implicate the Dropbox Passwords Chrome
extension. https://www.dropbox.com/scl/fi/w1mapsnia5tw1ye1ctiph/RegistryPossibleClueDropboxJson.jpg?rlkey=4224f31y54kndws42kl0n5i1y&raw=1

Here is the extension status now. I'm experimenting and will be back. https://www.dropbox.com/scl/fi/s0g5wrjjsgggwamarn3m3/ChromeExtensions-01.jpg?rlkey=lhu18emulr25nyepn0l9kzxhv&raw=1

Will study your longer post again and reply re Protocol Handlers.


Terry

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

VanguardLH <V@nguard.LH> wrote:

Terry Pinnell <me@somewhere.invalid> wrote:

Paul <nospam@needed.invalid> wrote:

On Mon, 10/28/2024 5:22 PM, Terry Pinnell wrote:

Paul <nospam@needed.invalid> wrote:

On Mon, 10/28/2024 1:22 PM, Terry Pinnell wrote:

This window is opening up uninvited.

https://www.dropbox.com/scl/fi/p916rstqzcrfrmqrek6qw/DropboxNativeMessaging.jpg?rlkey=a79rv553ejk5e169ayqvpft43&raw=1

Such as shortly after opening Chrome. Apparently something to do with a >>>>>> Chrome extension. But no such extension.

This arose at some stage of trouble shooting a more serious Dropbox >>>>>> issue: the context menu entries for Dropbox have disappeared. Tried all >>>>>> the obvious restarts in vain. Most articles/posts I read about
NativeHostMessaging or DropboxNativeHostMessaging are over my head. >>>>>>
Don't know how I started it, but now eager to just get rid of it.

Terry

My guess, is when it isn't malware, it is part of the Dropbox installation.
These could be win32 executables for example. Dropbox is also available >>>>> as a Metro.App, in which case the folder of residence is different (and >>>>> harder to find and impossible to access and protected by a manifest). >>>>> You can list anything, with nfi.exe for example.

C:\Program Files (x86)\Dropbox\Client\171.4.6182\DropboxNativeMessagingHost.exe

https://www.advanceduninstaller.com/Dropbox-577cd3abbfe79ac34d5840776af79ad8-application.htm

"The following executables are incorporated in Dropbox.
They occupy 11.73 MB (12302824 bytes) on disk.

Dropbox.exe (10.80 MB)
DropboxUninstaller.exe (222.35 KB)
DropboxNativeMessagingHost.exe (361.73 KB)
DropboxThumbnailGenerator.exe (36.23 KB)
DropboxUpdateProxy32.exe (286.73 KB)
dbxsvc.exe (45.73 KB)
"

With the disk drive offline, you could try scanning files like that on Virustotal.com
(owned by Google).

Paul

Thanks Paul. I'll do some virus/malware scanning but am I right that you >>>> suggest the best step would be to re-install Dropbox?

Terry

At this point, I'm in the dark as much as you are, as to
what is going on, and what sequence is involved. I entered the
details of the pattern in Google, and nothing is showing up.

If you use Process Explorer from Sysinternals, while that
command prompt window is open, you can hold the mouse over the
line on the screen, and look for the arguments passed to the executable, >>>to get further evidence of where that command is being crafted.
The Task Manager doesn't give as much info.

https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer >>>

Paul

This from digging around in the registry:
https://www.dropbox.com/scl/fi/ogcoehbvqwhrflvd6txao/RegistryPossibleClue.jpg?rlkey=46i0vmsunf8b31iu8ajrylfzk&raw=1

This is the JSON file, (edited for security) :

{
"name": "com.dropbox.nmh",
"description": "Native Messaging Host for interacting with Dropbox
Passwords browser extensions.",
"path": "../../../DropboxNativeMessagingHost.exe",
"type": "stdio",
"allowed_origins": [
"chrome-extension://ekldlkji----------- bknj/",
"chrome-extension://dfcjmolhh-----------foipgdekjien/",
"chrome-extension://bmhejbnm------------------kcfabg/"
]
}

I do get passwords frequently into Chrome from Dropbox Passwords, for
fastger logon, so wouldn't want to lose that. Those 'allowed origins'
are obviously not meant to be understood by humans? So deciding what to
do next is obscure!

Reckon I'm going to abandon it for tonight before I do something stupid.
Terry, UK Mon 28 Oct 2024 22:07

My guess is those strings are to identify which extension the Dropbox >integration is allowed. You said "no such extension" thinking it should
be named Dropbox-something. Do you have ANY extensions installed?

Currently only two extensions enabled: Dropbox Passwords and iCloud
Bookmarks, with two others disabled. (I'll soon re-enable Adblock.) https://www.dropbox.com/scl/fi/gvfq5bdkyn1qx78husa5w/ChromeExtensions-02.jpg?rlkey=sv9a9fm9n28xrx0fvvbron9rn&raw=1

--------------------
Here are a few more related updates, as they may help further diagnosis
and a reliable solution. Might be some repetition of what I've already
posted.

I have these two reg files backed up, in case I want to try deleting
them from the registry.
com.dropbox.nmh.reg and HCUS-NativeMessagingHosts.reg in folder C:\Users\terry\Reg backups\HCUS-NativeMessagingHosts.reg

Details:
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\NativeMessagingHosts]

[HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.dropbox.nmh] @="C:\\Program Files (x86)\\Dropbox\\Client\\210.4.4854\\resources\\NativeMessagingHost\\chrome\\com.dropbox.nmh.json"

[HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.browsercore]
@="C:\\Program Files\\Windows Security\\BrowserCore\\manifest.json"

--------------------
C:\Users\terry\Reg backups\com.dropbox.nmh.reg

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.dropbox.nmh] @="C:\\Program Files (x86)\\Dropbox\\Client\\210.4.4854\\resources\\NativeMessagingHost\\chrome\\com.dropbox.nmh.json"

--------------------

Have not touched this yet.Tue 29 Oct 2024 17:20 HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.browsercore

But: https://www.dropbox.com/scl/fi/yy4eopxsgf9ezoouc48id/ThreeBAK.jpg?rlkey=8vafm97q494nxpjtjhiz3blkj&raw=1
I disabled these three .json files last night Mon 28 Oct
C:\Program Files (x86)\Dropbox\Client\210.4.4854\resources\NativeMessagingHost\chrome\com.dropbox.nmh.json.BAK
C:\Program Files (x86)\Dropbox\Client\210.4.4854\resources\NativeMessagingHost\edge\com.dropbox.nmh.json.BAK
C:\Program Files (x86)\Dropbox\Client\210.4.4854\resources\NativeMessagingHost\firefox\com.dropbox.nmh.json.BAK

(Puzzled about the Date Modified BTW.)
Today trying to establish what effect this has had. I have not had any
of the unwanted annoying black consoles as at Tue 29 Oct 2024 16:45. But
what are the negative consequences? And I was still be able to get
access to my password details for logon to a couple of sites.

Will shortly try a PC reboot. Tue 29 Oct 2024 1744
--------------------
Protocol handlers
I changed to this setting last night, 29/10/24. https://www.dropbox.com/scl/fi/e8wjhfadnw8644woylk8t/ProtocolsNOT.jpg?rlkey=zm1gf57qpzsxautp1xkrfvo2g&raw=1

But I don't really understand the description. Or why that email entry
is singled out? It's just one site, yet setting now stops ALL?

Terry

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)