C # application detected as a virus

Question

Regarding the same program as my question a few minutes ago ... I added an installation project and created an MSI for the program (just to see if I can figure it out), and it works fine, except for one. When I tried to install it on my parent laptop, their antivirus (free Avast Home Edition) gave an alarm and accused my setup.exe of being a Trojan.

Does anyone know why this is happening and how I can fix it?

Answer 1

Indeed, boot from a blank CD (use a well-known good BartPE build machine or something like that) and carefully scan your machine. Another good thing to check will be exactly that Avast virus! thinks your program. Once you know this, you can find it in one of the virus databases and make sure that your software cannot contain it.

Most likely Avast! for some reason, it’s just getting a false positive, and I don’t know that there you can do a lot, except contact Avast! and hoping for an answer.

Answer 2

The very first thing to do is scan your computer for viruses.

Answer 3

I would do what jsight suggested and make sure there was no virus on your computer. I will also send the .msi file to Avast online scanner and see what they have identified as being in your package. If this reports your file as containing a trojan, contact Avast and ask them to check if your package contains an .msi trojan.

If there is no trojan in it, find out from Avast what caused their scanner. There might be something in your code that matches the pattern that Avast is looking for. They can adjust their template to ignore your file, or you can customize your code so that it does not run their scanner.

Answer 4

I don’t know "Avast", but in Kaspersky, if the setting is set to a high level, almost every installer starts an alarm (iTunes, Windows Update, everything), especially if the installer modifies a registry key or opens a port. If avast checks the behavior and your program opens the port, this is probably the reason.

Answer 5

Restore the installation file, check the file size. Check the exact file size of the "suspected" installation file.

If the source code has not changed and the two file sizes are different from each other, there is a pretty good chance of infection on the way.

First, I will do it as a test of reasonableness.