Unsolved Windows installer detected as virus when downloading

[ustk]

Alright, trying to deploy on Windows...

Installer's been made with Inno Setup, but once on the server I can't download the file.
Chrome, Edge, etc... are reporting a virus.

It appears people around there are not necessarily signing with a certificate, right?

I tried pure .exe or .zip with same result.
So what's the trick, windows guys?

Thanks a lot

[Adam_G]

@ustk hey i use windows+inno setup and ive never experienced this myself. out of curiosity if you upload the downloaded file to virustotal.com whats the result? im just wondering what its being flagged as. edit: ive also never added a windows certificate

[d.healey]

@ustk said in Windows installer detected as virus when downloading:

It appears people around there are not necessarily signing with a certificate, right?

You need to pay the Micro$haft cartel and buy an EV certificate - @Christoph-Hart posted what's seems to be a cheaper solution recently, I think it was called Azure signing and I can't remember if it gives the instant reputation that the EV cert does.

[Adam_G]

@d-healey is that a windows 11 thing? afaik windows hasnt required certificate signing in the same way macos has

[d.healey]

@Adam_G Smart screen filter is the thing, not sure when it was introduced, been there since at least Windows 7 I think. It's not required, but without it you will get reputation issues with smart screen and inno setup installers might be flagged as malware.

[Adam_G]

@d-healey makes sense. never had to deal with it personally though. virustotal and then windows defender output will tell you if its being flagged for that if im not mistaken . id compare the two. sounds fishy to me

[d.healey]

@Adam_G The main problem is when users download your exe the browser will popup with a warning and the default option is to cancel the download. Then when they run the installer it will say it's from an unknown vendor and they have to go through another step before they can run it, looks unprofessional too.

[Adam_G]

@d-healey well i agree with you but you'd only be "blocked" from downloading an exe on windows that was detected to have a virus. if thats what happened its worth a look

[DanH]

@ustk there's a version of inno that doesn't set off the flag. I'll look at what one I'm using tomorrow. It's something like 3.6.1 (i.e not the latest)

[Adam_G]

@DanH 6.1.2 is working for me

[d.healey]

@Adam_G said in Windows installer detected as virus when downloading:

"blocked" from downloading an exe on windows that was detected to have a virus

Not so, you get warnings like this

[ustk]

Wouh it seems I got quite info down there!

@Adam_G On Win10, once detected I can still force the download.
On Win11 though, it's a "You shall not pass..."

virus total says:

about the Inno made installer (6.3.2)
but full green flag on my app alone, so def a Inno thing...

@d-healey Checked on Azure, effectively the cost is very much more better affordable once compared to the 500$ sharks out there. It's about ten fingers a month, so in the Apple's ball park anyway. Still too much, huh...
I agree with the professionalism needed, so I'll push that door after the final test...

But in the waiting it would be cool to make it work as is, so other people can test it (which a self made cert does not allow, right?)

@DanH Interesting, what flag are you referring to?
I'll check a prev version of Inno as well...

[d.healey]

@ustk said in Windows installer detected as virus when downloading:

Checked on Azure, effectively the cost is very much more better affordable

But does it give you instant reputation like an EV cert?

[ustk]

@d-healey Don't know yet, I'll check ;)

A few more discoveries:
My Inno script contains mods to make the uninstaller look a bit better.
When I remove that part, it's not reputed as a virus anymore when downloading (but still dangerous) so I can force the download.
But when running the installer, the SmartScreen pops-up so I can't go further

[Dan Korneff]

@ustk I get the same exact thing for some win10 users. I've tracked mine down to the files utilized for uninstall. Gonna comb through the code next week.

[ustk]

@Dan-Korneff interested indeed.
Are you code signing your installer or going barefoot?

[Dan Korneff]

@ustk I got the stupid expensive EV dongle.