problem running exiftool

deaded · August 30, 2022, 10:56:04 PM

I've had iMatch for a couple of years but today for the first time I get this error and can't figure out how to fix it. I didn't find anything searching google or this forum. I tried downloaded a new exiftool.exe but it didn't change anything. The error message says to repair it in Control Panel but how? I opened control panel, there is no repair option (I'm using the latest Windows 11). I tried going to Settings->apps->apps & features and clicking iMatch but there is no repair option so I have no idea what they are talking about.

Help please!

Mario · August 30, 2022, 11:09:44 PM

Unfortunately, Microsoft is removing useful features from Windows, for unknown reasons. Like the ability of Windows Installer to re-install a software (in this case IMatch) to repair damage done.
This was a feature automatically provided by Windows installer, but now it seems that this is no longer available for some Windows 11 editions in some areas. Don't know why, sorry.

You did not include a log file (see log file) so I don't know details about the error.
From experience, my guess would be that you virus checker has decided to delete ExifTool or some of the component it uses. And this is why IMatch cannot longer run it. Happens, occasionally. For whatever reason. Depends on the AV you are using. Did you get any message from your virus checker? Does it has moved exiftool.exe info "quarantine" (or whatever your virus-checker calls this)?

False positives are becoming a problem these days. Since Windows Defender (built into Windows) has become so good, the anti virus vendors try to be "better" to justify the cost, causing problems along the way...

You can always download and re-install IMatch from the customer portal (https://www.photools.com/customer/). Installing the latest version will also re-install all missing components and ExifTool.
It might happen that your virus checker is deleting ExifTool again (for whatever reason). In that case, please contact the support of your anti-virus solution for help.
Usually you would make the ExifTool.exe application in the IMatch program folder (c:\program files\photools.com\IMatch\...) an exception in your AV solution.

Note that the file has been signed by me with my code-signing certificate and that you can check if exiftool.exe is valid by right-clicking on the file in Windows Explorer > Properties > Digital Signatures. Windows would warn you if the certificate is invalid due to a modification on the exiftool.exe.

deaded · August 31, 2022, 02:10:28 AM

No, not the virus checker. I keep it on a very short leash and I'm certain. Like I said, I reinstalled exiftool but nothing changed so maybe you're right about one of it's components being deleted because the only way I could figure out how to reinstall it was with the -k option. I see there is a non critical windows update pending, doesn't seem to have anything to do with iMatch but will install it and re-install iMatch.

--edit--

Ah, yes! It was either the windows update (doubt it) or the re-install of iMatch (most likely).

Thank you very much for your help. I did have to select and update the ones it had a problem with but that was pretty easy and only took a minute. Everything is back to normal!

Oh, and Mario, NICE response time!!

Thanks again,
Ed

Mario · August 31, 2022, 08:46:18 AM

Good news!

Pending or stuck Windows updates sometimes cause strange issues.
Since Windows no longer really reboots but hibernates instead, 'stuff' can pile up and then causing problems.
Letting it finish the update, or just the following reboot, may have fixed the issue. I cannot tell.

In the past, when a user reported that he/she suddenly gets this ExifTool panic message from IMatch, the reason was a virus checker which quarantined or even silently deleted ExifTool or one of the components it relies on.

deaded · October 19, 2022, 09:17:36 PM

Odd. It happened again. I checked the ESET virus scanner and it had quarantined nothing. I re-reinstalled it with the -k option and everything is fine. I think windows 11 is screwing this up somehow. At least the fix is easy.

Mario · October 19, 2022, 09:24:35 PM

I use the latest version of Windows 11 on two PCs and a tablet.
The tablet uses Windows Defender, the two PCs use two different commercial anti-virus solutions from two different vendors. I like to be on the safe side.

No issues.

I also validate the files with Google's VirusTotal before signing and shipping. This means 79+ virus checkers checked the files and found no issues.

It seems that these days, after the free Windows Defender got so good, anti-virus companies try too hard to make a difference, causing way to many false positives. Annoying users.

lbo · October 20, 2022, 08:15:57 PM

Quote from: deaded on October 19, 2022, 09:17:36 PMOdd. It happened again. I checked the ESET virus scanner and it had quarantined nothing. I re-reinstalled it with the -k option and everything is fine. I think windows 11 is screwing this up somehow. At least the fix is easy.

what did you install - ExifTool?
If yes: Where did you install it, using which binary (Phil's or my "alternate installer"?)?

And what is the "-k option"?

Mario · October 20, 2022, 10:12:32 PM

Keep in mind that the exiftool.exe shipped with IMatch is signed with my Authenticode code signing certificate.
ExifTool installed directly is not. This may trigger virus checkers.

thrinn · October 21, 2022, 07:34:59 AM

I just wonder if this is the correct board for this question? Sounds more like General Discussion, or Bug Report.

lbo · October 21, 2022, 09:53:40 AM

Quote from: Mario on October 20, 2022, 10:12:32 PMKeep in mind that the exiftool.exe shipped with IMatch is signed with my Authenticode code signing certificate.
ExifTool installed directly is not. This may trigger virus checkers.

the Problem with the ExifTool binary you are using is that it is not the binary running in the end, but a self-extracting archive (using the PAR Packer pp).

exiftool.exe unpacks to the temp directory and runs there (in a hairy way, pp is not for the faint-hearted!). This behavior is considered suspicious by some virus checkers already, and of course, the binaries running there are not signed.

Besides, pp has no working integrity test (besides a "canary" file), so modifications of the extracted files or even partial deletes (not unusual in temp) are not detected. The whole exiftool is totally unprotected in %temp% and prone to malicious attacks.

That's why I made a better ExifTool binary a few years ago. It uses Strawberry Perl with a permissive license instead of the rather old ActivePerl used in the PAR/pp version.

It runs Perl and the original ExifTool files "the right way". The whole installation can reside in an access restricted directory like %ProgramFiles%.