Trojan after update to 12.5.6 on win 10

[pietronelli]

I’m using Win 10 and after update to 12.5.6(auto update when browser told there is a new version), and after when Tor browser reopened and trying to conect to Tor network that Windows Defender was poput message that some files are Trojans and automaticaly send them to quarantine. Now Tor browser cannot to connect to tor network.
And Tor logs are empty.

[trinity-1686a]

tor.exe was getting flagged by Windows Defender earlier, but it should be fixed since about 20 hours ago. Can you try the instructions in the following post?

TorBrowser 12.5.6 no longer flagged by Windows Defender

If you are a Windows user and a TorBrowser user, you are probably not without knowing that the latest version of TorBrowser, or more specifically the tor.exe it contains, was flagged as a trojan by Windows Defender. We finally received a reply from Microsoft: At this time, the submitted files do not meet our criteria for malware or potentially unwanted applications. The detection has been removed. Please follow the steps below to clear cached detections and obtain the latest malware definitio…

[BobbyB]

This will solve the problem for the next time and you will never have to wait for any AV to give you a green light.

New Release: Tor Browser 12.5.6

Here is what I learnt when I had this type of problem with Norton. This is for Windows and assumes a typical standard install onto the desktop. First the whole Tor browser is just a drop-in folder onto the desktop. Set the option to NOT auto-update but only give a notice. When a notice comes in, copy the whole folder to somewhere else like a USB stick. Do the update. If your AV thinks it is a malware just delete the whole folder from the desktop then drop the backup folder back on to the d…

[trinity-1686a]

@BobbyB please stop writing this everywhere. It’s even dangerous advice. 12.5.5 and 12.5.6 both fix important security vulnerabilities.

[BobbyB]

I know what changes are in 12.5.5 and 12.5.6.
Your advise is dangerous.
Which is better if you are in a place where you need Tor for your anonymity or even safety? Tor 12.5.4 or nothing or Chrome or Edge of even Firefox.

OK go with Tails but that was not in this conversation.

[trinity-1686a]

My advise from the get go was either to allow-list tor.exe if you are comfortable with it, or to download the 32b version of the browser. So if you are in a situation where you need any safety, use the 32b version of TorBrowser, not a known-vulnerable release.

I never mentioned Tails, I do believe it is a good solution, but also an unreasonable one.

[BobbyB]

I assume we are talking about the Zero-Day Attack/Exploit related to the libvpx library.

I never recommend ignoring your AV. When it happened to me, I knew tor.exe was safe. I trust TOR (99.5%) and those who supply it and actually made a donation.
I downloaded it on another computer checked the signature and it showed safe (MS Defender). Virustotal and Emsisoft also said safe but the newly downloaded binary still said malicious with Norton. In a day or so it was OK.

The allow-list for MS is not straight forward (on purpose ?) so most would not be comfortable with it.

The copy to a USB stick is a little less that 60 seconds. The update is about the same. If it works, you are good. If not, the back out is ~30 seconds and you are back to the state you were in ~3 minutes ago with which you were comfortable. I have no idea about this if you are not admin. With Windows it’s hard to not be admin. No sudo.

But wait! download the 32b version? Your Tor browser is gone. So you use Edge and the straight internet?

Agreed Tails is unreasonable except in extreme situations.