Antivirus TrendMicro just removed "Brave Tor Client Updater extension" on my office laptop

[StefanLobbenmeier]

Description

Probably related to #724. This is a screenshot of the warning I received:

And this is what TrendMicro says on the linked website: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PUA.Win32.TorTool.A/

Steps to Reproduce

Did not try to reproduce yet, but probably Installation Trent Micro Office Scan and Brave should reproduce this

Actual result:

Expected result:

No antivirus messages :)

Reproduces how often:

Brave version (brave://version info)

Brave	1.4.96 Chromium: 80.0.3987.132 (Official Build) (64-bit)
Revision	fcea73228632975e052eb90fcf6cd1752d3b42b4-refs/branch-heads/3987@{#974}
OS	Windows 10 OS Version 1607 (Build 14393.2214)
JavaScript	V8 8.0.426.26
Flash	(Disabled)
User Agent	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
Command Line	"C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe" --enable-dom-distiller --disable-domain-reliability --no-pings --extension-content-verification=enforce_strict --extensions-install-verification=enforce --sync-url=https://no-thanks.invalid --enable-features=PasswordImport,WebUIDarkMode,SimplifyHttpsIndicator --disable-features=AutofillServerCommunication,AllowPopupsDuringPageUnload,LookalikeUrlNavigationSuggestionsUI,WebXrGamepadModule,NotificationTriggers,AudioServiceOutOfProcess,SmsReceiver,VideoPlaybackQuality,WebXR --flag-switches-begin --flag-switches-end --enable-audio-service-sandbox --disable-webrtc-apm-in-audio-service --disable-sync
Executable Path	C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe
Profile Path	C:\Users\stefan.lobbenmeier\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default
Variations	5e3a236d-4113a79e

Also the version of the Brave Tor Client Updater Extension:
{
"description": "Brave Tor Client Updater extension",
"key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1AYAsmR/VoRwkZCsjRpD58xjrgngW5y17H6BqQ7/CeNSpmXlcMXy6bJs2D/yeS96rhZSrQSHTzS9h/ieo/NZF5PIwcv07YsG5sRd6zF5a6m92aWCQa1OkbL6jpcpL2Tbc4mCqNxhKMErT7EtIIWL9cW+mtFUjUjvV3rJLQ3Vy9u6fEi77Y8b25kGnTJoVt3uETAIHBnyNpL7ac2f8Iq+4Qa6VFmuoBhup54tTZvMv+ikoKKaQkHzkkjTa4hV5AzdnFDKO8C9qJb3T/Ef0+MOIuZjyySVzGNcOfASeHkhxhlwMQSQuhCN5mdFW5YBnVZ/5QWx8WzbhqBny/ZynS4erQIDAQAB",
"manifest_version": 2,
"name": "Brave Tor Client Updater (Windows)",
"version": "1.0.9"
}

Version/Channel Information:

• Can you reproduce this issue with the current release? - Yes

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields?
• Does the issue resolve itself when disabling Brave Rewards?
• Is the issue reproducible on the latest version of Chrome?

Miscellaneous Information:

[jumde]

Hi @StefanLobbenmeier, the latest version of the Tor Client Updater is 1.0.10. Are you seeing this issue with 1.0.10 as well?

[StefanLobbenmeier]

I will attempt to reproduce the issue with 1.0.10 tomorrow, could you also give me a link where I would get that?

[jumde]

Hi @StefanLobbenmeier, v1.0.10 was released a couple of days back. The component updater should automatically update to v1.0.10. You can see the latest version by navigating to brave://components. You can also click on Check For Updates on the same page to download the latest version of Tor Client Updater

[StefanLobbenmeier]

Ok so I just checked it - when I opened the page it said "Update error":

When I click Check for update it briefly (had to use slow motion camera to see) flashes

• Checking for updates
• Updater started
• Component downloading

And returns to "Update error"

[StefanLobbenmeier]

I experimented a bit the the other components - there are some where it also says Update error, while others say Up-to-Date (and when I click on it it says "Component not updates") and some I was able to update (e.g. "Legacy TLS Deprecation Configuration"):

Here is after clicking some more - I was able to update "File Type Policies":

Not sure why I can not update some of them. Is there some log I could check?

[jumde]

@StefanLobbenmeier - Thanks for sharing the details.

1. Are you using OpenDNS? You can check by navigating here: https://welcome.opendns.com/
2. Can you try running this in Command Prompt. And see if you get the latest version 1.0.10:

C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe --user-data-dir=C:\Users\stefan.lobbenmeier\Desktop\component-test

This creates a new profile without meddling with your current user data directory.

[StefanLobbenmeier]

Yes it says that I am using it.

Interesting, in this Brave instance it does not download them either:

I guess I will try again in different networks, Brave might have installed / updated it while I was in the home office.

[jumde]

@StefanLobbenmeier - OpenDNS blocks tor.bravesoftware.com, so the component package cannot be downloaded. If you try the same on a different network you should be able to update.

[StefanLobbenmeier]

Thanks, that’s good to know. Would it be possible to add such information to either the issue template or to the report table brave generated? But anyway, hopefully I will have news on the original issue tomorrow.

[StefanLobbenmeier]

Ok I was able to update in the other network.

Also just did a manual rescan of the brave folder
C:\Users\stefan.lobbenmeier\AppData\Local\BraveSoftware

and TrendMicro did not complain anymore. So I guess this issue should not occur anymore for anyone using the latest version.

[bsclifton]

@Brave-Matt and I are working on a help article for this now 😄