Tor was not working

[BitcoinGirl.Club]

Detected: Trojan:Win32/Malgent!MTB

Details: This program is dangerous and executes commands from an attacker.

Affected items: file: C:\Users\----pc_name-----------\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe

The above are the information.

When I was trying to connect TOR it was not working. Later I found it's blocked by defender and that file Trojan:Win32/Malgent!MTB was found. This is a less secure device so I removed it from Quarantine and TOR is working.

On my secure device it's the same. TOR is not working for the same reason. In both device same problem. My question is what should I do in this situation. I don't want to risk my secure device but I need to use TOR there too. is it okay to do the same on that device too.

Suggestions please.

[1714609190]

1714609190

[1714609190]

1714609190

[1714609190]

1714609190

[Crypto Library]

I also have been suffer kinda the same situation one year ago, My issue was that I was a victim of phishing while downloading the cracked game and the virus spread around my drives.
I think there is no other way but to setup your operating system again. And if possible recover the important files and format your all drives. Because since malware is detected I think it's best to start all over again in that case. It will be better to run Tor again on the new operating system.

[LoyceMobile]

I'm not a Windows user, but I run Tor (and other programs) either as a different user (with it's own permissions) or inside a VM. That limits the access possible malware has on my system.

[dkbit98]

Suggestions please.

Defender usually makes false positives a lot, so please STOP using wind0ws 0S spyware.
Linux OS (Fedora, Mint, Debian...) is free alternative and you won't have any issues with malware.

[JeromeTash]

Suggestions please.

What are you still doing with Windows OS?

If you are thinking of privacy and security, windows should probably be your least secure OS. Switch to Linux as soon as possible. Use windows for other less important activities like playing games. I don't know about windows, but I have never has such an issue with my Linux and… I don't need any Antivirus on my device because I don't click on malicious links or download suspicious apps aka Cracked premium apps.

[tabas]

If you can't do the other suggestions of using a Linux OS or change your OS asap. Try using Brave browser, it's got a TOR version.

Code:

New private window with Tor

But the cons on this one is that there will be some ads that will pop on your notification but you can easily close that. I usually don't click on their ads even if there will be some brave rewards or bat tokens that will be collected for each ad you click. It's not compulsory to click them so, you can ignore or close it.

[LeGaulois]

@BitcoinGirl.Club

The same happened with me this afternoon. It's caused by the new version of Tor (12.5.6) to include security updates from Firefox 115.3.1.0esr.
If you install the Alpha version, you won't have the problem anymore https://www.torproject.org/fr/download/alpha/
Or installing an older version works too https://www.filehorse.com/download-tor-browser/old-versions/

is it okay to do the same on that device too

I would say yes but I would also say no because a malware in an update is a regular attack vector. (not saying Tor is hijacking people héhé)

[DaveF]

I have seen this also happen when nobody checks an update against common AV scanners. No offense to the ToR browser people but checking releases against virustotal.com has become a standard for a lot of my customers. It sucks that you have to do it, but with all the different AVs out there you have to check against false positives OR the possibility that some dependency or library you use has been compromised.

Annoying, but it is the way it has to be done now.

-Dave

[o_e_l_e_o]

Try using Brave browser, it's got a TOR version.

This is poor advice. Using Tor via a browser which is not Tor negates like 95% of the reason you would use Tor in the first place. Not to mention that Brave is terrible for privacy, allows trackers from companies which pay them enough, still collects your data to serve you ads, and more.

I would echo that you shouldn't use Windows, and again, you are not going to get much in the way of privacy regardless if you use Tor if you are running Windows. However, one of the Tor devs is reporting that this seems to be a false positive from Windows Defender: https://forum.torproject.org/t/tor-exe-detections/9508/2. I wouldn't suggest removing the file from quarantine just yet until it has been confirmed that it is a false positive, and more importantly, why it's being flagged as a false positive. However, he also says the 32 bit version is unaffected, so you can just use that.

[tabas]

This is poor advice. Using Tor via a browser which is not Tor negates like 95% of the reason you would use Tor in the first place. Not to mention that Brave is terrible for privacy, allows trackers from companies which pay them enough, still collects your data to serve you ads, and more.

I thank you for that additional info that seems to be I have no idea about it. I thought that was fine but then, now I know it that it isn't a good idea to use TOR through a browser. As for Brave, that's the disadvantage that it has got. At first, they're like not really allowing ads through browsing experience but they're still able to inject it through the notification.

[BitcoinGirl.Club]

Try using Brave browser, it's got a TOR version.

This is poor advice. Using Tor via a browser which is not Tor negates like 95% of the reason you would use Tor in the first place. Not to mention that Brave is terrible for privacy, allows trackers from companies which pay them enough, still collects your data to serve you ads, and more.

I will never use Brave TOR browser. I cam mistakenly expose my real IP with the regular browser. With TOR I feel safer, safer than using a premium VPN.

I have seen this also happen when nobody checks an update against common AV scanners.

The default set-up of TOR even update the browser when you restart it. Yesterday I had to change the setting of auto update. It was not easy to find for me.

Or installing an older version works too https://www.filehorse.com/download-tor-browser/old-versions/

This was new to me. I hope it is trusted sharing platform.

[vv181]

Or installing an older version works too https://www.filehorse.com/download-tor-browser/old-versions/

This was new to me. I hope it is trusted sharing platform.

You can download the older version from the official source: https://archive.torproject.org/tor-package-archive/torbrowser/. Regardless of where you downloaded it, you should also verify its signature (https://support.torproject.org/tbb/how-to-verify-signature/).

I thank you for that additional info that seems to be I have no idea about it. I thought that was fine but then, now I know it that it isn't a good idea to use TOR through a browser.

Tor Browser is a fork of Firefox with additional configuration set in place. It has its own implementations to ensure it adheres to the required Tor Browser specifications. So it has rigorous processes that make the user safe and secure while using the Tor network.

[o_e_l_e_o]

I thank you for that additional info that seems to be I have no idea about it.

Tor isn't just useful for hiding your IP address, but also your browser fingerprint. Your browser fingerprint includes everything unique about your browser, from what version it is, to what fonts it has installed, to what resolution you are running it in (which is why Tor opens in a window and you should not maximize it), to what extensions you have installed (which is why you should not install any extensions on Tor beyond those which come pre-installed), and so on. By using Tor, your fingerprint matches tens of thousands of other users and makes you impossible to track. By using a Brave, you probably have a unique fingerprint (or share with only a handful of other users) and therefore you are much easier to track.

And then of course there is the issue with cookies, which Tor either refuses or deletes by default, while Brave will store and again will be used to track you. And all the other issues with Brave's awful privacy policy, ads, code injection, and more. Last I checked there was even code from Binance embedded in Brave!


Looks like Microsoft have confirmed this was a false positive and have updated Windows Defender definitions: https://forum.torproject.org/t/torbrowser-12-5-6-no-longer-flagged-by-windows-defender/9522/. So you should be safe to update the definitions and then remove Tor from quarantine.

[Lucius]

I would echo that you shouldn't use Windows, and again, you are not going to get much in the way of privacy regardless if you use Tor if you are running Windows.
~snip~

Could you elaborate a bit more on this? I understand that Windows is a privacy nightmare, but if someone uses Tor in accordance with all the recommendations, does that mean that some private things are still leaking and can be used to try to identify someone?

Tor isn't just useful for hiding your IP address, but also your browser fingerprint. Your browser fingerprint includes everything unique about your browser, from what version it is, to what fonts it has installed, to what resolution you are running it in (which is why Tor opens in a window and you should not maximize it)...
~snip~

This means that everyone should use Tor in the size of the window that opens at startup, but that doesn't make sense to me, because why would the normal window size that everyone probably uses somehow identify someone? What I know is that it is not recommended to use zoom in/out because the settings at 100% make all users unique.

[o_e_l_e_o]

Could you elaborate a bit more on this? I understand that Windows is a privacy nightmare, but if someone uses Tor in accordance with all the recommendations, does that mean that some private things are still leaking and can be used to try to identify someone?

It doesn't really matter how private your browser is when your OS is spying on everything you do. Using Tor is still better than using any other browser, but if you are using Windows 11 you should assume your privacy is roughly zero.

This means that everyone should use Tor in the size of the window that opens at startup, but that doesn't make sense to me, because why would the normal window size that everyone probably uses somehow identify someone?

Your browser fingerprint includes your window size, down to the pixel. If you maximize your Tor window, then you greatly reduce your anonymity set to the set of all users running Tor maximized with the same screen resolution as you are. If you make the Tor window bigger but not maximized, then you probably end up with a completely unique window size which no one else is using, and therefore a unique fingerprint.

[BitcoinGirl.Club]

Looks like Microsoft have confirmed this was a false positive and have updated Windows Defender definitions: https://forum.torproject.org/t/torbrowser-12-5-6-no-longer-flagged-by-windows-defender/9522/. So you should be safe to update the definitions and then remove Tor from quarantine.

After all we had nothing to worry about LOL

Could you elaborate a bit more on this? I understand that Windows is a privacy nightmare, but if someone uses Tor in accordance with all the recommendations, does that mean that some private things are still leaking and can be used to try to identify someone?

It doesn't really matter how private your browser is when your OS is spying on everything you do. Using Tor is still better than using any other browser, but if you are using Windows 11 you should assume your privacy is roughly zero.

I am yet to get my hand on Linux. Can anyone find a good tutorial of how to install it, some sort of step by step will be helpful with where to download it. I basically have two device. Old-school of course. On the other device which I consider secure I only brows known applications like exchanges I am in, occasionally bitcointalk.

[o_e_l_e_o]

I am yet to get my hand on Linux. Can anyone find a good tutorial of how to install it, some sort of step by step will be helpful with where to download it.

See above from dkbit98:

Linux OS (Fedora, Mint, Debian...) is free alternative and you won't have any issues with malware.

Personally I like Debian, but for brand new Linux users migrating from Windows, I always recommend Mint. It is far more newbie friendly than some other Linux distros, the GUI is the most similar to Windows, and there is an extensive online community which can assist with troubleshooting.

There are comprehensive and step by step download and installation guides here: https://linuxmint-installation-guide.readthedocs.io/en/latest/
And for any problems, the online community is here: https://forums.linuxmint.com/

[examplens]

Looks like Microsoft have confirmed this was a false positive and have updated Windows Defender definitions: https://forum.torproject.org/t/torbrowser-12-5-6-no-longer-flagged-by-windows-defender/9522/. So you should be safe to update the definitions and then remove Tor from quarantine.

The same thing just happened to me.
It seems that the last Windows Defender update brought much more restrictive filters. I already had a similar conflict with some files ^{scope_v2.json} from the Trezor application

BitcoinGirl.Club did you choose a Linux distribution?

[dkbit98]

It doesn't really matter how private your browser is when your OS is spying on everything you do. Using Tor is still better than using any other browser, but if you are using Windows 11 you should assume your privacy is roughly zero.

Or even below zero  
There are few tweaks and modified settings you can use to reduce how much you are spied by microsoft, but it will never be good base for any privacy.
I don't see any good reason for anyone to use windows unless they are lazy, or they simply don't care about privacy.
And let's not even start talking how most malware are made for windows.

Personally I like Debian, but for brand new Linux users migrating from Windows, I always recommend Mint. It is far more newbie friendly than some other Linux distros, the GUI is the most similar to Windows, and there is an extensive online community which can assist with troubleshooting.

I tried most of the big Linux distributions including Debian, and problem I have with Debian is often outdated old software, even if you are using latest testing instead of stable.
Another problem is that my hardware was not detected so I had to install different version and do a lot of manual post installations and fixing.
Mint is fine and it usually works for most people, but I don't like Ubuntu base, so maybe it's not a bad idea for people to try Mint Debian release.

[BitcoinGirl.Club]

BitcoinGirl.Club did you choose a Linux distribution?

Not yet, I will need a new device to practice it. Years of using Windows, never used anything else in my life so there is an element of uncertainty of how it will go, will I be able to handle it and so many things are in the mind.

so maybe it's not a bad idea for people to try Mint Debian release.