In almost all of my trials, I used only tor for about a few hours with javascript off. So I’m pretty sure I got the virus from fedora and/or tor update. I just can’t prpve it because using wireshark in Qubes OS is complicated (or I failed). But before that I used to use kicksecure and got a wireshark record from there. There were connections made to Github, Google and Amazon out of nowhere. I just want people to live without viruses, so I warn them. Unfortunately viruses invade also bios, so I had to sell the system. I know it because I tried clean install and the slow downs and wierd behaviours continued on a kicksecure pc. So why not would it not continue in a Qubes setup?