Possible malware in official Torguard windows VPN client?

Torguard’s VPN client intermittently consumes 50% cpu, for long periods, unrelated to any network activity, which I find suspicious. Details below. I’ve raised this with TG’s tech support who have repeatedly denied that any such behavior exists. I’m seeing this consistently on 4 windows machines where I have TG running.

I’m not sure where to report this as there is no TG subreddit and the VPN subreddit doesn’t allow mentioning specific services. Hopefully you folks can point me in the right direction or give advice.

So, if the app is running and the VPN is connected, even if there are no other apps open, TG client will randomly begin consuming a constant 50% CPU. I can’t correlate this with any other condition like network traffic or other app activity or any obvious thing TG is doing. If I minimize the TG client window, it stops. And then it starts again in a few minutes, and so I repeat this remedy, and it stops. If I don’t do this it continues indefinitely. So, every computer this is running on experiences a significant heat/wattage increase and CPU performance degradation due to TG.

I took screenshots of this behavior using task manager. I also watched it using winternals’ process monitor, which gave much more detailed info than this. ---- But this forum doesn’t allow pictures.

Usually if a sub doesn’t allow pictures they want Imgur

I think the question here, keeping people from responding to you, is what makes you think it’s malicious and not just dogshit code

Depending on the duration/frequency it could come key negotiation or other operations. Seems a bit massive though. …

Give me a bit too see if I’m having this problem too. I will respond either in a few hours or tomorrow. But I will let you know about the usage regardless

Could be badly written code.
Maybe their codebase has been unknowingly compromised by a threat actor. I’m sure governments would want to know what people are doing with these VPNs…
Maybe one of their developers has coded something malicious in.
Probably the first one though.
You could try monitoring with Procmon and wireshark and see what activity occurs during the cpu spikes.
Also check the latest software EULA to see if they’ve got a statement in there about what you’ve allowed them to do on your computer.

I used to use Torguard and I ended up not chasing down a password reset because of ever increasing weirdness. I was disappointed since I trusted someone and it was the more frugal of a couple options.

I’ve actually been using public wifi, Algo, or Tor since a hard drive crash, I think VPNs might be overrated and not enough people threat model the true cost of having all your traffic in the same tunnel as the VPN you’re using to steal movies.

Just installed the latest TorGuard client (4.8.25) on an 8th-gen i5 with 32GB of RAM. Connected to VPN with no traffic, this thing pegs my CPU cores like I’ve never seen for a few minutes, then quiets down. It does this even without being connected to anything -* just sitting there.*

EDIT: When the application is just sitting there, no connection, no traffic, it’s now using 50% of my CPU. But when I MINIMIZE the app, it drops to 0%. It’s a RENDERING PROBLEM.

https://imgur.com/a/SCbSEbw

So I don’t have any problem, but what version are you using? And what type of connection are you using through torguard?

Late reply, but disconnect and switch your Torguard theme to “classic” in the settings menu. For some reason that worked for me, after reading it on another forum.

I just tried to download Torguard (December 2023) and Windows blocked the download. “Virus detected.”

Do you remember why? A mod explained on a different sub but apparently there’s a logical reasoning several of them use.

why not both? I don’t know anything for sure. It’s an irritating problem that I’m trying to make progress on.

It would be nice if TG itself found this to be a troubling behavior, but they don’t. It would be nice if they fixed it way back when I reported it. But they didn’t.

Yeah it’s running 90% of the time, I’m guessing.

why would key negotiation require any noticeable amount of cpu time? Maybe I’m not understanding what you’re referring to.

Browsers/internet apps could be closed and no network traffic may be occurring and TG still does this.

There’s nothing in the EULA about it, at least explicitly. No warranty: does that cover this?

I did use process monitor and it identified which threads were using it. Evidently it has a thread pool but the master thread is the culprit. At least, when I looked.

Wireshark is a good next step.

YES. This problem is back. I tried 4.8.25 and 4.8.26 and both do that, among other things. I reverted to 4.8.22 and the problem is gone.

Interesting screenshots. It’s actually pegging 8 cores for you with no traffic?? I used winternals (i forget which tool, procmon?) previously and it showed that TG had a master thread and then a pool of 8 or 16 worker threads. With zero traffic, just the master thread was pegged. So the problem, rather then being fixed, is worse.

Technical support wasn’t a lot of help, because it’s more like tier 0 customer support and there’s no actual tech support there.

It was on an earlier version. I updated it to the most recent and it’s stopped on 2 computers, so far. That is, I verified that it was still occurring before and not after the update.

Seems to me that TG used to check and prompt when there were new versions. I assumed no new versions.

Never too late - thanks for the reply. I’ll try that soon.

Hypothesis: that this only happens with OpenGL disabled during installation… did you also disable that? Because if this setting in effect disables GL to stop this from occurring… that breaks my hypothesis

i got no virus warnings on 4.8.26