Tampermonkey added by a third party

[bob3rocks]

Today I installed AVX2 using thorium_AVX2_mini_installer.

One running, the browser displayed an extension error message. When I clicked on the error, a pop-up message stated Tampermonkey has been added by a third party to Thorium.

Is this reason for concern? I assume it's to be expected but wasn't able to find anything when searching forums and release notes etc.

[gz83]

Thorium browser does not have any bundled extensions, you need to check your usage environment yourself

@bob3rocks

[bob3rocks]

Thanks for the reply. This is quite disturbing, since I have never installed Tampermonkey on any browser on this computer. I'm curious how it got there -- I didn't do it 🙃

…

On Thu, Oct 26, 2023 at 10:25 PM Ho Cheung ***@***.***> wrote: Thorium browser does not have any bundled extensions, you need to check your usage environment yourself @bob3rocks <https://github.com/bob3rocks> — Reply to this email directly, view it on GitHub <#352 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFPYFAX7EJYBE456MKF6K7LYBNAWPAVCNFSM6AAAAAA6RTAOQSVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM3TGOJZGY3DG> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- ​​​Bob Wachunas​ 1(707) 536-1182​ the state of the world really makes me want to {uke}==*::​*

[gz83]

Can you provide more information or screenshots about this issue?

[bob3rocks]

Here's a screensnhot

[bob3rocks]

[bob3rocks]

One thing I notice is that it does mention "another program on your computer" added the extension. I wonder what that other program is. Maybe I can find clues in the install logs or system event logs.

[gz83]

I think you should check the applications installed on your computer and check for viruses.

And check whether the Thorium browser is injected with startup parameters by malicious programs such as viruses.

[bob3rocks]

It's a nearly brand new Windows 11 machine, scanned for viruses and found nothing.

I don't see any startup parameters for the executable, but I do see two unknown users which have read/execute permissions.

Do you think this is normal?

[gz83]

Since I don't have access to your computer, I can only provide some limited help.

You may want to check the chrome://versions page and the properties of Thorium's desktop icon for anything suspicious.

[bob3rocks]

Thank you Alex, I appreciate all the help. This is what I see at chrome://version Command Line "C:\Users\bob\AppData\Local\Thorium\Application\thorium.exe" --flag-switches-begin --flag-switches-end --origin-trial-disabled-features=WebGPU --disable-nacl I'm going to contact the developer of the extension too just for fun.

…

On Fri, Oct 27, 2023 at 9:29 AM Ho Cheung ***@***.***> wrote: Since I don't have access to your computer, I can only provide some limited help. You may want to check the chrome://versions page and the properties of Thorium's desktop icon for anything suspicious. — Reply to this email directly, view it on GitHub <#352 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFPYFAUONQXELEKN243SLBTYBPOPTAVCNFSM6AAAAAA6RTAOQSVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM3TIMBVGY4TI> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- ​​​Bob Wachunas​ 1(707) 536-1182​ the state of the world really makes me want to {uke}==*::​*

[gz83]

Thank you for cooperating with our investigation.

The first thing to point out is that I am a collaborator on the Thorium project and a friend of Alex, but I am not Alex himself, please don't get confused lol.

From the information you provided, I haven't discovered the problem yet.

[bob3rocks]

Understood! I appreciate the assist.

…

On Fri, Oct 27, 2023 at 9:55 AM Ho Cheung ***@***.***> wrote: Thank you for cooperating with our investigation. The first thing to point out is that I am a collaborator on the Thorium project and a friend of Alex, but I am not Alex himself, please don't get confused lol. From the information you provided, I haven't discovered the problem yet. — Reply to this email directly, view it on GitHub <#352 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFPYFASIHPT3KIV4M5BYEG3YBPRPVAVCNFSM6AAAAAA6RTAOQSVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM3TIMBVHEYDC> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- ​​​Bob Wachunas​ 1(707) 536-1182​ the state of the world really makes me want to {uke}==*::​*