Recent versions of Tor Browser, especially due to the updated tor.exe they contained, were misleadingly identified as potential threats by Microsoft Defender.
See also: Trojanized Tor browsers target Russians with crypto-stealing malware
Users were alerted to a possible Trojan, causing a bit of a stir in the community. However, this turned out to be a false positive. Tor Browser has issued an update regarding this issue. After contacting Microsoft about the issue, Tor Browser has received a final response.
Microsoft said: “We reviewed the submitted files and found that they did not match our definitions of malware or unwanted applications. As a result, we have removed theflag.”
For users experiencing this false positive, Microsoft Defender provides a clear set of instructions for updating and clearing any previous flags:
- Open the command prompt as administrator.
- Go to c:\Program Files\Windows Defender.
- Run the command “MpCmdRun.exe -removedefinitions -dynamicsignatures“.
- Follow it with “MpCmdRun.exe -SignatureUpdate“.
For those who prefer not to receive automatic updates, Microsoft provides the latest definitions here
Similar warnings were also observed on Virus Total, a service that relies on third-party security vendors to scan downloaded files. Some users noted that ignoring this warning could have been avoided by checking VirusTotal.com first, expressing their frustration at ignoring this important security measure.
See also: Tor Browser 12.0: Comes with Apple Silicon support
One frustrated user noted: “This is about a release being made public without a prior check on VirusTotal.com. For an entire weekend, users were left with doubts. From now on, every release should be accompanied by a VirusTotal review. This way, anyone downloading the software can personally ensure that it doesn’t get flagged by virus scans — at least not at launch.”
In response to the criticism, a Tor spokesperson made a few important points. The tor.exe file shown here from TorBrowser 12.5.6 is not a new addition – it is the exact same file, byte-for-byte, used in version 12.5.5. An interesting aspect is that no issues were reported with the release of this version. Some people probably downloaded version 12.5.5 instead of the correct 64-bit version.
Currently, Tor does not have a permanent process for uploading files to VirusTotal before they are released.
See also: Microsoft Defender: Update causes chaos in Windows Hardware Stack Protection
If you've recently found your Tor browser not working, here's what you can do:
- Make sure Microsoft Defender is up to date.
- Either retrieve tor.exe from quarantine or,
- Redownload TorBrowser directly from the Tor Project website.
And as a security reminder, it is recommended to verify the signature before installation.
Microsoft Defender's non-identification of Tor Browser as malware may help to remove the negative stigma it had in the past. Many people perceived Tor Browser as a tool used exclusively for illegal activities. Microsoft Defender's recognition may change this perception and promote recognition of Tor Browser as an acceptable tool for protecting privacy and security online.
