The browser handles common Internet-related tasks such as displaying websites, sharing websites via social networks, downloading torrents, accelerating downloads and grabbing online media, all directly from the browser.[4] Torch Browser is commercial freeware.[5]
Torch is based on the Chromium source code[6] and is compatible with all add-ons and extensions available in the Chrome store. On June 18, 2013, Torch announced that it had surpassed ten million active users.[7]
On July 1, 2013, Torch version 25.0.0.3712 was released. The release included the ability to download Instagram and Vine videos in a single click.[11] Torch's ability to download Instagram videos was featured on CNET's Tekzilla Daily.[12]
On February 26, 2014, Torch version 29.0.0.6508 was released. The release included the ability to customize the look and feel of users' Facebook pages using pre-set themes. Users can customize these themes or create their own. A user's customized page is visible to him/herself and to anyone visiting the original user's page from another Torch browser if the original user allows it.[13]
On May 20, 2014, Torch version 33.0.0.6975 was released. The release updated the Chromium engine used by Torch and introduced an embedded player to stream torrents downloaded before the download is completed.
Reviews of Torch have evolved over time, as the browser continued to add features and functionality. Early versions of the browser have received mixed reviews, with some praising its interesting feature combination while others pointed to the lack of add-on support (an issue which has been resolved in newer versions).[9][6]
In October 2012, The Blog Herald said of Torch: "The Torch Web Browser is built on a lightweight framework that offers what appears to be decent security. If you like to browse the web while grabbing various files this might be the perfect browser for your arsenal of web applications. Overall I have been pleased with the Torch Browser and I only hope it continues to grow so more social sharing features can be experienced and more files can be grabbed."[9]
In reviewing Torch in December 2012, CNET said of Torch 2.0.0.1614: "An all-in-one Web browser is nothing to sneeze at, but Torch Browser isn't going to pry you away from Chrome or Firefox. While it has options that make sharing and social media a breeze, Torch Browser just isn't unique enough to win people's hearts. It lags in performance and its major features aren't worth making the switch...Torch Browser tries to carve out its niche by being an all-in-one Web browser... However, it doesn't do any of those things well enough to replace what you currently use. Once you get over the novelty, it becomes obvious that Torch Browser isn't that powerful as a Web portal. It's noticeably slower than other browsers and it doesn't have the same sort of add-on support. The layout is just a rip-off of the open-canvas setup of other, more popular browsers. None of this is to say that using it is all a bad experience. Torch Browser still runs circles around Internet Explorer and would be a major upgrade there... While not a threat to Firefox or Chrome, Torch Browser is easy enough to use and might just impress Internet Explorer users. Heavy downloaders might enjoy the torrent downloader and media player that come with it, too."[6]
Torch Media receives payments from companies like Ask.com to bundle potentially unwanted programs with the browser. Users may be asked to install search toolbars or adware programs during installation. These bundled programs commonly do one or more of the following things:
Torch makes contradictory claims about the software they bundle. Their online troubleshooter claims that "Torch does not install additional toolbars" while at the same time stating that "the Torch installer may include an optional Ask.com toolbar" on another page.[17]
If you ever start seeing alerterdaemon crash logs in your Console, you've probably installed the Torch Browser at some point. Maybe you were just curious to try a browser with a media bias; maybe you wanted to see this new flavor of Chrome; maybe you'd heard it was a good way to download videos from YouTube. I don't know, and I'm not one to judge.
So you start sleuthing. This daemon was modified on July 30th. What else was modified on July 30th? Well, not that much, it turns out. But there is an application in my Applications folder called Torch with that same modification date. I still have the installer, so I run it, command-i the thing and it tells me that all it installs is Torch.app in /Applications.
I'm here to tell you, my friends, that that is an outright lie. A find command for the date in question reveals that the Torch installer installs a veritable buttload of junk all over the filesystem. There's stuff in /Library, there's a bunch of things in your home account. Oh, it's a scene, man, a real mess. And, yes, there's even:
/usr/local/libexec/alerterdaemon
I wanted to post about this for a couple reasons. Firstly I just want to say shame on the Torch browser installer team. You provide an installer that lies about what it installs, and you provide no uninstaller. This is a terrible practice that undermines the trust of your potential users, which I count myself no longer among.
Second, I wanted there to be some search results for this alerterdaemon. There's nothing scarier than Google finding nothing. It is truly terrifying. Hopefully this post will remedy this particular instance.
Then I did a find for everything on my boot drive that had the same modification time. You'll need to figure the number of days ago Torch was installed and enter that numer for the -mtime option. For the grep part enter the modification time pulled from ls. Finally, I specified the -x option to prevent traversing devices other than the boot drive:
sudo find -x / -name "*" -mtime 98 -ls grep 15:16
Also, here's the result of that command. This is pretty much everything I can determine that was installed by the Torch installer. Bear in mind, this is an older version, and things will likely have changed significantly in newer versions of their installer.
A short time ago I heard about the Torch web browser. It seemed pretty interesting and better than Internet Explorer so I wanted to try it out. I went and tried to download it on the Torch website. However, when I downloaded it, McAfee and Malwarebytes went crazy and were able to stop Torch from causing an harm. After that experience I did some research. As it turns out a small number of users (and I mean really scarce) reported that it contain Adware and other kinds of crazy stuff.
Torch Browser is a free, chromium-based, web browser and internet suite. It includes a media grabber, torrent client, drag & drop, site-unblocker, and music streaming service, all in one place.
Recently, we get a lot of complaints from our users (that use also ESET as anti-virus) that you detect our product as PUA and pop a notification about it every 30 minutes (attached a screenshot)
i still don't understand - why you consider our product as PUA? and how we can manage to remove this detection? we don't believe it is correct. our product is user friendly.
Exactly, the solution would be to make the installer without helper.dll (besides other necessary improvements). Arakasi, thank you for posting the link to best practices agreed on by anti-spyware coalition.
we want to solve this problem, i have talked with the developers and showed them your answer and they said the helper.dll just open and close browsers (i have no idea what it does in other products, i can talk only about our product - Torch browser).
There are quite many reasons accounting for PUA classification in this case (one can check privacy terms to find out). This forum is not a place to dispute detections. After the application has been adjusted to fulfill best practices suggested by anti-spyware coalition, you can send the new version to samples[at]eset.com and request a review.
Hello,
The HELPER.DLL file is classified by ESET as a Potentially Unwanted Application (PUA). The key word here being potentially. This category refers to programs that engage in behavior that some users do not want to occur on their system. Examples of this include (but are not limited to), changing web browsers' home pages, changing default search engines, monitoring URLs that web browsers visit, displaying additional advertisements in the web browser, replacing or substituting existing advertisements in the web browser and so forth. Of course, those are just a few examples, and specific to web browsing.
Before classifying a programs as a PUA, senior researchers at ESET's threat research lab examine a program to determine if it belongs in this category. Each examination is done on a case-by-case basis, so there are no specific guidelines we can offer about how a program should or should not behave. That said, the link to the Anti Spyware Coalition that Arakasi forwarded is a great introduction to the subject, as is the StopBadware coalition's Badware guidelines for software applications. You might also find the following ESET white paper helpful as well: Problematic, Unloved and Argumentative: What is a potentially unwanted application (PUA)? It's a little old (no mention of Android apps, for example) but still contains useful information.
Because some of ESET's customers wish to prevent such programs from being run on their computer, ESET provides them with the option to block these types of applications when our software is installed. Additionally, the option can be toggled on and off at any time after installation and in recent versions of ESET's software, customers can choose to whitelist (ignore) certain applications, which allows our customers some additional flexibility.
If you would like to have your application re-examined after making changes to it, you can submit it to ESET's threat research lab for analysis by following the instructions in ESET Knowledgebase Article 141, "How to submit virus or potential false positive samples to ESET's labs."
Regards,
Aryeh Goretsky