Author Topic: "ERROR" : This file has been tampered with and may be infected by a virus  (Read 11127 times)

dragonetti

  • Posts: 7
Hello I am new here,

I get the following error when double clicking a media file that has been associated with XMplay.

"This file has been tampered with and may be infected by a virus"

I searched for this on the forum but I got results that where connected with comodo.

I do not have any comodo product installed, I have:

Windows 7 64Bit English + ALL security updates + .NET 3.51 and 4.0
Nvidia GPU
Intel I7 processor
- Easeus todo backup 5.0
- MS security essentials
- Malwarebytes Antimalware
- Goodsync
- Office 2010 (english)

These are the only applications that are installed, all other applications I use are portable applications.

When I start XMplay and drag a media file to it, it works.
Double clicking the media file results in the error stated above.

I totally have no clue what is giving this error.

And I can not pinpoint the exact time when the problems started.

What I did was reformat the HD, re-image from a CLEAN image.
But the problems keeps coming back.
I never had this problem before and I restore my pc every 3/4 months from a clean image.

And I am using the portable version of XMplay.

Ian @ un4seen

  • Administrator
  • Posts: 20437
That "tampered" message indicates that either the XMPLAY.EXE file has been modified, or something is modifying its content at load-time. The most likely candidates from your installed software list would appear to be "MS security essentials" and "Malwarebytes Antimalware", so you could try temporarily disabling them and see if that avoids the problem.

By the way, can you clarify what you mean by portable XMPlay version, eg. is that the standard XMPLAY.EXE but with "NoReg=1" in XMPLAY.INI?

saga

  • Posts: 2181
MS Security Essentials shouldn't trigger this, at least they don't do it here (running Win7 x64)

dragonetti

  • Posts: 7
Thank you for your replies!

I am using this XMPLAY version:
http://portableapps.com/apps/music_video/xmplay_portable

I only did the following with it:

right click on a media file (mp3, wave etc...) >> properties >> click "change" button in the "Opens with" section >> and then associate with F:\PortableApps\XMPlayPortable\XMPlayPortable.exe

I did not change any config file manually.

saga

  • Posts: 2181
Can you check if disabling Malwarebytes Antimalware temporarily fixes the problem? And if it doesn't, try the same with MSSE.

dragonetti

  • Posts: 7
I disabled Malwarebytes and MS security essentials.
Still I get the same error.

Maybe an MS update? I will have to look deeper fort this...

edit:

This is VERY strange.

I just disabled MS security essentials and Malwarebytes and some other apps that were running in the background (Listary, Clipmate and totalcommander) and I still got the error when opening an audio file.

I rebooted just to make sure everything restarted (especially MS Sec essentials and Malwarebytes) and now it 'seems' to work.
No error when double clicking an audio file ... xmplay works and plays the audio file.

I think indeed it may be malwarebytes OR MS security essentials... (but very weird)
« Last Edit: 1 Feb '13 - 20:14 by dragonetti »

Jimmy Neutron

  • Posts: 473
Did you use the PortableApps.com AppCompactor or UPX to make the exe or dll files smaller?

dragonetti

  • Posts: 7
Did you use the PortableApps.com AppCompactor or UPX to make the exe or dll files smaller?


No I didn't I just downloaded the version from here:
http://portableapps.com/apps/music_video/xmplay_portable

And installed it in the default location (only changed the drive letter to F: the rest was left default) F:\PortableApps\XMPlayPortable

I did a second restart and all is still working normally (no "tampered" error)

I didn't even now it was possible to 'compact' it.

Or the version I downloaded was already 'processed' in such a way (or similair?)
But looking at that page, it seems that no such processing has been applied to it (but that's what I think after reading the page again).

Dotpitch

  • Posts: 2871
Well, good that a reboot solved it so far :).

When I start XMplay and drag a media file to it, it works. Double clicking the media file results in the error stated above.
It's interesting that XMPlay only has problems when you start playing a file. Did it happen with every file?

By the way, what version of XMPlay do you have? You can find the version number by starting XMPlay, right-clicking the title area, choosing 'Options and stuff' and then looking at the lower corner of the window.

Jimmy Neutron

  • Posts: 473
History (or how we got here):
In the past, some PortableApps programs and dlls were internally compressed before packaging to save space on USB drives.  Some programs didn't like it, especially ones that perform a validity self-check.  As a result of those errors, they now make sure that everything is OK before making the package available for downloading.

It has been about five weeks that XMPlayPortable 3.7 has been posted, and it has received thousands of downloads.    I'm sure that PortableApps.com would have heard about a bad file long before this.  That's why I had to ask if you had compressed it yourself.

BTW, for the XMPlayPortable package, PortableApps basically establishes their own subdirectory structure so that it can easily integrate into their menu system, their backup system, and their automatic updating system for applications.  The only real substantial change is to accommodate drive changes (like when you plug your USB drive into other computers and get a different drive letter).  The ini and library (I think) are scanned and edited to ensure that everything works correctly with the new drive letter.

dragonetti

  • Posts: 7
Well, good that a reboot solved it so far :).

When I start XMplay and drag a media file to it, it works. Double clicking the media file results in the error stated above.
It's interesting that XMPlay only has problems when you start playing a file. Did it happen with every file?

By the way, what version of XMPlay do you have? You can find the version number by starting XMPlay, right-clicking the title area, choosing 'Options and stuff' and then looking at the lower corner of the window.

Yes, it happened to every file (not now anymore for the time being).
I have version 3.6.0.1
It all seems to work now. The disabling of MS Sec and MalwareBytes probably triggered/reversed something?

Both are running now and I have no problems (for now).

@Jimmy Neutron
Thank you very much for the info, this is very good to know!

Jimmy Neutron

  • Posts: 473
Go back to that download link and get the latest version of XMPlayPortable.  Install it right over the existing version.  It won't delete any of your settings, etc.  However, be careful of any skins you've installed.  If they aren't in the \Data directory (which is protected during upgrade), they might not survive.  You'll just have to make a copy of them before you start, so if things don't go well, you'll be able to put them back in place.

Happy XMPlay-ing and PortableApps-ing

dragonetti

  • Posts: 7
Go back to that download link and get the latest version of XMPlayPortable.  Install it right over the existing version.  It won't delete any of your settings, etc.  However, be careful of any skins you've installed.  If they aren't in the \Data directory (which is protected during upgrade), they might not survive.  You'll just have to make a copy of them before you start, so if things don't go well, you'll be able to put them back in place.

Happy XMPlay-ing and PortableApps-ing


Will do! and thank you!

dragonetti

  • Posts: 7
Sorry to kick this topic up, but I found the real culprit.

I forgot to mention that I had setup 'Total Commander' with Cameyo.

As far as I know Cameyo does not modify executables of the portababilized application but it changes the enviroment in which the portababilized application runs (using 'environment variables' like '%appdata%' and cameyo files).

This lead to the error I described and explains that it only worked when I dragged the mp3 file to xmplayer, I did that in the normal windows explorer enviroment.

I shouldn't have set-up total commander like that in the first place, there is better way to setup a portable total commander. My apologies for this somewhat confusing topic. But I hope that I have helped someone in the future if he/she reads this topic.

To sum it up, the application (file-manager) in which I started an .mp3 was set-up in way that lead to this error. It wasn't 'malwarebytes' or 'microsoft security essentials' that triggered the error.

Thank you again to everyone who helped me and gave me proper information.