I can answer part of this question. It says %profiles% instead of the username because that's a more helpful path for our heuristics engines. If we take the general name, we can feed that into logic easier than trying to parse down a practically infinite number of profile names.



Where Dropbox is concerned, I haven't seen this behavior myself. I'd suspect the temp files in question contain executable code. The fact that it does the same thing on an exe.part file supports that theory. Realistically, I doubt you'd be able to get these to stop showing up as undetermined, because that is in fact what they are. It doesn't mean they are threats, but Webroot is looking at those files as unknowns because it's never seen them before. Dropbox is actually a relatively common attack vector. Once you configure it to sync, it has a free pass through your firewall, so something needs to be keeping an eye on it, which is what Webroot is doing.



You could disable age-based and popularity-based heuristics and see if that cuts down on the number of undetermined files that are reported into the console, but you'd be limiting your protection by disabling portions of the heuristics engine.



In short, I'd say it's working as designed and that Dropbox just tends to create a lot of unknown files.

---