.mkv files are just containers with a bunch of separate files inside. You can theoretically hide any kind of file inside, including an executable, so it might just be a blanket warning.
Hence the name “matryoshka”
MatrosKa Video
Oh, wow. TIL
That's the case for a lot of media and generic data formats.
What's the actual warning? Is is the one about "do you really trust this file you found online?" or is it Windows Defender saying it's infected?
It could potentially recognize from the metadata that the files were downloaded from the internet, but I'm not sure why it would do it to just a video file.
I tend to get warnings for things I install from the internet, not just video files I've downloaded.
It could also be an actual infected file that wasn't caught by AV before, but is with updated signatures. That or the current signatures could have a false positive. It happens
Exactly, which is why the type of warning they're getting matters.
Has any of you considered pirated files might be marked someday for automatic deletion? Until that happens, Windows Defender tries scaring you into not using them.
I would just love to see the fallout if Microsoft did this, just arbitrarily remove content it deems to not be suitable for its users. More Linux converts for sure
we are already here
pirated hogwarts legacy will have the main exe automatically deleted by defender upon execution
Yah but that's not new, AV never liked the packers. The difference here is the silent deletion :(
I used MKVToolNix to checkout the video file. Inside the MKV container appears to be: an H264 video file, an AAC audio file, 3x VobSubs, chaptering info, and 'global tags'. If I uncheck the 'Global Tags' entry and save the rest an a new MKV, the video opens in Windows 10 without any warning message from Windows Security.
I don't see anything in the properties data for 'global tags' that looks suspicious, or even has any entries at all (such as for timestamps, video properties, color information, color mastering meta information, etc. I don't know WHY having a 'global tags' "thing" in the MKV is causing the security warning.
Unless there's a way to have Windows 'ignore' the 'global tags' part of an MKV, I guess I will just re-multiplex the videos with that part removed.
(Sorry it took so long to reply, I didn't have my lemmy password saved to my online password manager and had to wait until I got back to my media PC to update the posts)
Thanks for the replies
I suspect what you really did by removing the global tags was change the file's hash to something brand new so it was no longer on Defender's list of suspicious files. Try removing different aspects of the MKV or add a random text file as an extra subtitle and see if any of those MKVs are also flagged; they probably won't be.
If it's this, it's likely that the MKV file OP had just happened to hash-collide with a different known malware and caused Defender to recognize it.
This is it. I remember watching a video about this a while ago but can't find it. It has nothing to do with pahe or mkv
Try removing or overwriting that tag, see if it fixes it.
Upload it to VirusTotal and let their meta engine scan it.
Thx for the suggestion, I forgot about doing that. However, VirusTotal shows a 0 / 59 for any threats.
If virus total says is not infected, I would say the likelihood of it being infected is very very low.
This is something Windows is known to do. I don’t use Windows and don’t know how to disable it other than installing Linux, but it is definitely safe.
Scan it eith different AV, like MBAM for example and if it also detects try googling the name of the detected malware.
This is what VLC shows in media information for the file
I thought I embedded the warning message in the first post, trying again here
[This comment has been deleted by an automated system]
Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ
⚓ Dedicated to the discussion of digital piracy, including ethical problems and legal advancements.
Rules • Full Version
1. Posts must be related to the discussion of digital piracy
2. Don't request invites, trade, sell, or self-promote
3. Don't request or link to specific pirated titles, including DMs
4. Don't submit low-quality posts, be entitled, or harass others
Loot, Pillage, & Plunder
📜 c/Piracy Wiki (Community Edition):
💰 Please help cover server costs.
Ko-fi | Liberapay |