I tested Tor Browser with the Virus Total Online Scanner Website and got the message:

This is the Trojan by Rising - Trojan.DisguisedAsDocument/Heur!1.A502-8a37qDgkMnL (Cloud)

Is this correct, and if so how can I get a clean version?

  • Where did you download your version of Tor from? Jun 7, 2016 at 19:26

1 Answer 1


This is unfortunately pretty common. Note the "Heur" in the name, it means it has used heuristic scanning to determine it. It doesn't match any known sample but it has content that it doesn't understand.

The Tor Project actually uploads the browser builds to virustotal after each build and normally at least one false positive is seen as a result. You can find the results of their own uploads here.

If you're concerned that there is a virus in it there are some steps that can be taken. First of all, you should verify the signature of the download to ensure the tor browser development team signed it. Second of all if you suspected a developer put the virus there, the Tor Browser is built reproducibly which means if you have a copy of the source code, you can ensure that the source code builds to the same binary that they have signed by following their build process.

I expect this is a false positive which is a common effect of heuristic scanning and the second option for verification can be technically prohibitive but signature verification is a process you should make a habit of if you're concerned about malware being bundled with programs as it reduces the set of people who could infect it to those in control of the signing keys.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .