{"id":31838,"date":"2023-09-30T16:51:05","date_gmt":"2023-09-30T14:51:05","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=31838"},"modified":"2023-10-01T22:34:49","modified_gmt":"2023-10-01T20:34:49","slug":"tor-exe-microsoft-defender-triggers-an-trojanwin32-malgentmtb-alert","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2023\/09\/30\/tor-exe-microsoft-defender-triggers-an-trojanwin32-malgentmtb-alert\/","title":{"rendered":"Tor.exe: Microsoft Defender triggers an \"Trojan:Win32\/Malgent!MTB\" alert"},"content":{"rendered":"

\"Sicherheit[German<\/a>]A few hours ago, the Tor browser received a security update that closed a vulnerability. Now Microsoft Defender in the form of Windows Security triggers an alert when the Tor browser is called up and quarantines the tor.exe file. It warns about a \"Trojan:Win32\/Malgent!MTB\".<\/p>\n

<\/p>\n

\"\"Patrick alerted me to this via email (thanks for that) and wrote \"tor.exe\" (Tor Browser) is detected by Microsoft's Windows Security today, 2023-09-30 as \"Trojan:Win32\/Malgent!MTB\". It uses the following version:<\/p>\n

Tor Browser 12.5.5
\nFile: tor.exe (7.804.416 Bytes)
\nSHA256: 3807d96998a15aed25ec9a95c3183385c6c73f6dde811ef2452c30f5f7df2810<\/p>\n

\"Defender<\/p>\n

I immediately checked my Tor installation on a German Windows 10 and indeed got an alert via Toast notification (see above) and in Windows Security the following display.<\/p>\n

\"tor.exe:<\/p>\n

Patrick then uploaded the file times on Virus Total and writes that currently 3 virus scanners detect a Trojan. When I called the virustotal page<\/a> in question, there were already four scanners that hit.<\/p>\n

\"tor.exe:<\/a><\/p>\n

The status of the Windows virus signatures at scan is: 1.397.1801.0 and 1.397.1814.0 (2023-09-30 06:13).<\/p>\n

Patrick then downloaded again from www.torproject.org<\/a> from the archive and checked the PGP signatures as well. The file \"tor.exe\" has the same 256 checksum and the updated virus signatures still give the security message rated as \"severe\" in Windows 10. The analysis page at Virus Total for the uploaded tor.exe file kept updating today, Patrick writes.<\/p>\n

Blog reader Stefan also just got in touch by mail and writes:<\/p>\n

Hello G\u00fcnter,<\/p>\n

just updated Tor Browser and Windows Defender detects Tor.exe as trojan and quarantines it. I suspect a false positive.<\/p><\/blockquote>\n

He also gave me a link to reddit.com<\/a>, where you can also find a user comment. Other users confirm this observation. This means that a lot of people cannot currently run Tor Bundle or have to define an exception if it is a false positive.<\/p>\n

There is a second reddit.com post<\/a> on the subject where someone wrote that re-downloading and installing the Tor bundle stopped the false alarm for them. My attempt to reinstall an old installer of Tor did work and the Tor started again. However, after the auto-update, Defender again triggers an alert and moved the tor.exe to quarantine. Currently I will pause the Tor until the issue is resolved.<\/p>\n","protected":false},"excerpt":{"rendered":"

[German]A few hours ago, the Tor browser received a security update that closed a vulnerability. Now Microsoft Defender in the form of Windows Security triggers an alert when the Tor browser is called up and quarantines the tor.exe file. It … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580,1547],"tags":[773,69,529],"class_list":["post-31838","post","type-post","status-publish","format-standard","hentry","category-security","category-software","tag-defender","tag-security","tag-tor"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/31838","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=31838"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/31838\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=31838"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=31838"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=31838"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}