Tor browser (firefox.exe) false positive? - Spyware.Lokibot

[taintedbloop]

Today I noticed when trying to open the Tor browser, it was blocked by Malwarebytes Anti-Malware (latest version). It said it was Spyware.Lokibot. I got pretty nervous, as its apparently a keylogger/cryptocoin stealer. I uploaded it to virustotal.com and only malwarebytes flags it. I asked on reddit for someone to do the same in case my .exe was compromised somehow and they said it shows malwarebytes red flagged it too.

When I saw I could upgrade to Malwarebytes 3.0 for free with my license, I did, and scanned again, and it still shows up.

I have attached the .txt log file for you to see.

 

Is this (I hope?) indeed a false positive?

 

Thanks in advance.

log.txt

[miekiemoes]

Hi,

Thanks for reporting. This is a false positive indeed and will get fixed in next database. This will be out in 10 minutes.

[taintedbloop]

Whew. I saw nothing about this on the internet and got paranoid and enabled 2-FA on everything and tightened up my security a bit. At least now I'm upgraded to Malwarebytes 3.0! I love that the anti-exploit is in there too. Even more I love the fact that lifetime owners are grandfathered into the new version :-)

[miekiemoes]

Thanks for the positive feedback

By the way, mind to zip and attach the following file to a next post? C:\USERS\TAINTED\DESKTOP\TOR BROWSER\BROWSER\FIREFOX.EXE

Thanks!

[taintedbloop]

Sure, here you go.

firefoxexe.zip

[miekiemoes]

Thank you!

In a meanwhile, the database has been updated to fix this.

MBAM2 Version: v2017.02.11.04

MBAM3 Version: 1.0.1233

 

[blender]

Hello,

The database has been updated to fix this F/P. Please update to the following definitions package & you should be good to go.

Thanks for reporting!

MBAM2 Version: v2017.02.11.04

MBAM3 Version: 1.0.1233

[taintedbloop]

After updating and removing firefox.exe from my exclusion list, I can confirm it no longer reports it as malicious. 

 

Thanks for the quick resolution, guys!