I tested Tor Browser with the Virus Total Online Scanner Website and got the message:
This is the Trojan by Rising - Trojan.DisguisedAsDocument/Heur!1.A502-8a37qDgkMnL (Cloud)
Is this correct, and if so how can I get a clean version?
Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.Sign up to join this community
This is unfortunately pretty common. Note the "Heur" in the name, it means it has used heuristic scanning to determine it. It doesn't match any known sample but it has content that it doesn't understand.
The Tor Project actually uploads the browser builds to virustotal after each build and normally at least one false positive is seen as a result. You can find the results of their own uploads here.
If you're concerned that there is a virus in it there are some steps that can be taken. First of all, you should verify the signature of the download to ensure the tor browser development team signed it. Second of all if you suspected a developer put the virus there, the Tor Browser is built reproducibly which means if you have a copy of the source code, you can ensure that the source code builds to the same binary that they have signed by following their build process.
I expect this is a false positive which is a common effect of heuristic scanning and the second option for verification can be technically prohibitive but signature verification is a process you should make a habit of if you're concerned about malware being bundled with programs as it reduces the set of people who could infect it to those in control of the signing keys.