1

Malwarebytes antimalware has detected the file ...\Tor Browser\browser\firefox.exe with virus spyware.lokibot. I even made a new installation of Tor Browser from its official site, but upon finishing the installation, the firefox.exe file was detected as malware. The file is then moved to quarantene, and I am unable to open the Tor Browser, since the file is moved from each original location.

Anybody familiar with this malware infection on the Tor Browser firefox.exe file? Seems like the malware is already infected on the original installation.

Improve this question
3
  • 1
    Don't use Malwarebytes.
    – cacahuatl
    Feb 11, 2017 at 18:05
  • Later this day, I tried to download and install Tor Browser again. This time, Malwarebytes found no malware in Tor browser firefox.exe file. Not sure whether Tor uploaded a malware-free firefox.exe file, or if Malwarebytes changes their detection procedure. But it does raise the question if somebody was able to infect Tor Browser with spyware.lokibot malware. I tried to look up more information about lokibot. COuldn't find much information, but found one article about lokibot being a malware that steals password and cryptocoin wallets information. Scary. hpc.name/thread/52514/p1.html.
    – DKB
    Feb 12, 2017 at 12:55
  • False positive, common with anti-virus.
    – cacahuatl
    Feb 12, 2017 at 18:24

2 Answers 2

Reset to default
1

It can be sounding funny, but the very name of the program describes it's quality - it's a malware bytes by itself :) But speaking seriously, after my experience in IT security, I can give you some advice in not using these so-called "anti-malware" crapware :

  • Kaspersky Internet Security/Kaspersky Crystal and all the Kaspersky Labs crapstuff. It performs undisableable HTTPS/SSL MitM - use a virtual machine, install the fully functional trial version and open the HTTPS site. Now check the certificate and the HTTP code(like in Firebug in Firefox or in Chrome/Opera built-into-browser development tools) - you will see a malicious Javascript code from their server inserted forcibly in every page to spy on you. And Mr. Kaspersky is an ex-KGB and FSB employee, so it should tell you enough
  • MalwareBytes - just a crap, disabling lots of privacy tools. I can hardly beleive that this thing actually fights malware, except e-icar maybe :)
  • ESet NOD32 - a Rest-In-Peace for a predecestor, a very decent tool NOD32... This "robo" on the box seems to be missing a very important part properly installed: the Eyes. I had a very hard cases when tons of malware and viruses plagued the corporate network but the "robo says it's all OK". If you have this one - deinstall it and run a full scan: an illusion of security is far more dangerous than lack of security, IMHO.
  • AVG - according to the quality of work of this tool I can make a guess that it was written and released the same day and it was precisely the first day after an Oktoberfest. It's more glitchy than useful and can give you a very odd false positives about the websites: for one of mine it gave a "malicious download" red warning, but the website has no downloads on it. Period.
  • Symantec Antivirus/Symantec 360-whatever-stuff - a Rest-In-Peace for Peter Norton's Norton Antivirus - one of the best ones in earlier days.
Improve this answer
0

The only way I can open tor browser is to exit Malwarebytes, re-download tor browser and run firefox.exe, simple work around but not what I should be doing.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .