Jump to content

TorBrowser False Positives


JorgeSilva

Recommended Posts

Certain files from TorBrowser Bundle 4.5.1 are being detected as Spyware.Password

 

Spyware.Password, C:\Users\Jorge\Desktop\TorBrowser\Browser\AccessibleMarshal.dll, , [4060cfc9e7a3b6807e6f7de52ed4ee12],Spyware.Password, C:\Users\Jorge\Desktop\TorBrowser\Browser\libEGL.dll, , [643c7127256537ff02ebee7431d1fd03],Spyware.Password, C:\Users\Jorge\Desktop\TorBrowser\Browser\libGLESv2.dll, , [f7a93e5a35552b0b6687da88996959a7],Spyware.Password, C:\Users\Jorge\Desktop\TorBrowser\Browser\mozalloc.dll, , [20807325880232045499fe6422e0a858],Spyware.Password, C:\Users\Jorge\Desktop\TorBrowser\Browser\browser\components\browsercomps.dll, , [fba5d3c5c9c13cfa67867ce65aa8f50b],
 

I have, for now, added an exception to MBAM installation on my computer to stop it from scanning TorBrowser files.

The software can be freely downloaded from:

https://dist.torproject.org/torbrowser/
My specific version is torbrowser-install-4.5.1_pt-PT.exe

For the record, attached are the scan log and the false positives archive.

TorBrowser.txt

TorBrowser.zip

Link to post
Share on other sites

Is it normal to have different hash for the above files ?

Also, i will like to add one more file to the above list :

 

Spyware.Password, C:\Users\XLm\Desktop\Tor Browser 4.5.1\Browser\AccessibleMarshal.dll, ,[148cdabe3753bd79618cec7657ab8a76],
Spyware.Password, C:\Users\XLm\Desktop\Tor Browser 4.5.1\Browser\libEGL.dll, , [366abedadeac80b67c7168fad82a2bd5],
Spyware.Password, C:\Users\XLm\Desktop\Tor Browser 4.5.1\Browser\libGLESv2.dll, ,[c9d7aaeea8e2c076707d68fafd0559a7],
Spyware.Password, C:\Users\XLm\Desktop\Tor Browser 4.5.1\Browser\mozalloc.dll, ,[742c0f89ec9e37ff3eaf3929ac568a76],
Spyware.Password, C:\Users\XLm\Desktop\Tor Browser 4.5.1\Browser\mozglue.dll, ,[415fd7c10d7dfc3a727b570bc63ca060],
Spyware.Password, C:\Users\XLm\Desktop\Tor Browser 4.5.1\Browser\browser\components\browsercomps.dll, ,[930d4a4e92f8a78f04e92e3429d92fd1]

 

 

Regards,

Link to post
Share on other sites

Hello,

 

Thank you for the additional report.

This will be fixed in about 1/2 hour from now (v2015.05.27.05)

Yes - those hashes change.. they are not file hashes - they are hashes that help us t-shoot.

OK, I've updated to v2015.05.27.05 and it still keeps blocking it (on pro) and quarantining it during scans.  :wacko: 

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.