I just tried opening a video I had gotten from Pahe many years ago, from an external USB drive, and have now gotten a Windows Security warning, ‘Do you want to open this file?’ (see top part of attached image)

I moved the file to another folder and renamed it from the original title (it was an episode of ‘The Blacklist’) to 'Movie.mkv and still get the warning. All files in the folder (22 of them) give this warning, plus some other videos I got from Pahe in the past. Clicking the checkbox ‘always ask before opening this file’ does not keep other files in the same folder from also showing the warning. I tried changing the default video player to PotPlayer, same warning comes up.

The only thing I can think of is that in the metadata of the file (bottom part of image), under ‘Encoded By’, it shows a URL, ‘pahe (DOT) in and pahe (DOT) li’

Is there any way this could actually be a security issue? If not, is there a way to ‘green light’ my MKV files on my local drives?

Thanks in advance

  • aeronmelon@lemm.eeEnglish
    24·
    1 year ago

    .mkv files are just containers with a bunch of separate files inside. You can theoretically hide any kind of file inside, including an executable, so it might just be a blanket warning.

  • Hot Saucerman@lemmy.mlEnglish
    19·
    1 year ago

    What’s the actual warning? Is is the one about “do you really trust this file you found online?” or is it Windows Defender saying it’s infected?

    It could potentially recognize from the metadata that the files were downloaded from the internet, but I’m not sure why it would do it to just a video file.

    I tend to get warnings for things I install from the internet, not just video files I’ve downloaded.

    • phx@lemmy.caEnglish
      13·
      1 year ago

      It could also be an actual infected file that wasn’t caught by AV before, but is with updated signatures. That or the current signatures could have a false positive. It happens

  • GoldCross@lemmy.dbzer0.comOPEnglish
    10·
    1 year ago

    I used MKVToolNix to checkout the video file. Inside the MKV container appears to be: an H264 video file, an AAC audio file, 3x VobSubs, chaptering info, and ‘global tags’. If I uncheck the ‘Global Tags’ entry and save the rest an a new MKV, the video opens in Windows 10 without any warning message from Windows Security.

    I don’t see anything in the properties data for ‘global tags’ that looks suspicious, or even has any entries at all (such as for timestamps, video properties, color information, color mastering meta information, etc. I don’t know WHY having a ‘global tags’ “thing” in the MKV is causing the security warning.

    Unless there’s a way to have Windows ‘ignore’ the ‘global tags’ part of an MKV, I guess I will just re-multiplex the videos with that part removed.

    (Sorry it took so long to reply, I didn’t have my lemmy password saved to my online password manager and had to wait until I got back to my media PC to update the posts)

    Thanks for the replies

  • Overboard8171@startrek.websiteEnglish
    4·
    1 year ago

    Has any of you considered pirated files might be marked someday for automatic deletion? Until that happens, Windows Defender tries scaring you into not using them.

  • HumanPerson@sh.itjust.worksEnglish
    41·
    1 year ago

    This is something Windows is known to do. I don’t use Windows and don’t know how to disable it other than installing Linux, but it is definitely safe.

  • taaz@biglemmowski.winEnglish
    3·
    1 year ago

    Scan it eith different AV, like MBAM for example and if it also detects try googling the name of the detected malware.

    • Skull giver@popplesburger.hilciferous.nlEnglish
      5·
      1 year ago

      I’ve never seen an MKV file carry the Mark of the Web before.

      Are you sure that’s just a video file, and not a shady combination of an executable and an MKV? It’s not exactly hard to give an executable the Windows icon for an MKV file and call it Movie.mkv.exe (or mask the executable nature in some other way).

      There are also various know exploits for (old versions of) media players that may trigger security warnings for all kinds of files, although Windows will usually quarantine those rather than prompt you like this.