The TOTALCMD executable file is corrupted, possible VIRUS

[burhanemre]

Hello Christian,

I have a script to start Total Commander in elevated mode and started getting the warning message below before TC exists. Root caused the issue to a mistake in the script that added a space at the end of the command line. Apparently Total Commander flags the space as a virus. I think the issue started after upgrading to version 9. Verified reproduces with 9.0a 32bit (2016-12-14). Please run the following command line from a cmd window (note the trailing space):

C:\Users\user>"c:\Program Files\totalcmd\TOTALCMD.EXE "

---------------------------
Total Commander
---------------------------
WARNING: The TOTALCMD executable file is corrupted, possible VIRUS!
Totalcmd will close. Please run a virus scanner as soon as possible!
---------------------------
OK
---------------------------

[petermad]

Hmm, if I try to launch totalcmd.exe with a trailing space, all that happens is that TC opens and closes again in a split second.

If I do the same with totalcmd64.exe, TC opens but only parts of the GUI is loaded and after a few seconds TC closes again.

But I don't get any arror messages.

Testet with TC 9.0, 9.0a and 9.1b3 32- and 64bit. both from an elevated and a non-elevated command prompt.

EDIT
If I start with a fresh ini-file like this:
"C:\Program Files\totalcmd\TOTALCMD64.EXE " /i=f:\temp\tc.ini then TC stays open and I get the virus warning after a few seconds,

[Dalai]

Set the current working directory prior to launching TC to avoid such issues.

A little background info: I had the same issue years ago with my ThinkPad which has some hotkey driver that can launch user-defined programs. Launching totalcmd.exe directly triggered the message in the OP. So I worked around it by launching a script by the hotkey driver instead. This script sets the working directory to TC directory and starts TC afterwards.

Regards
Dalai

[ghisler(Author)]

TC checks its own EXE on startup to detect tampering. Apparently CreateFile fails when there is an extra space at the end. Currently I don't have any plans to change this.

[Flint]

ghisler(Author)
You can use GetModuleFileName to get executable path instead of relying on what command line was launched.

[ghisler(Author)]

Yes, I could try that, but it may cause other problems (e.g. with Unicode names). Therefore I prefer not to change it now.

[MVV]

GetModuleFileNameW has no Unicode problems.

[Mlsoun]

this problem of corrupted file occure when you run TC from .rdp file to (Terminál Server). Use XXX.bat in .rdp and run Totalcmd.exe from bat file for resolving problem with this type of error message