How to make a .NET windows service install without antivirus problems

Question

Hey guys,

I'm making my first windows service in C#, at the moment a pretty innocent looking thing that doesn't do anything yet.

However I find when I try to install it, either using a standard Setup project in Visual Studio, or using the simple "self-installer" outlined here, our company's antivirus won't allow installation because it is a "suspicious looking service" (HIPS/RegMod-013).

Now, this doesn't happen with services that come in every other third-party service I've installed. What could it be about my service that probably makes it look suspicious? I tried signing the assemblies as well (just using a VS-generated key file), but no luck.

Anyone else experienced this? Any ideas?

Answer 1

According to the SOPHOS site it is upto you wether or not it is going to continue installing. As this is picked up by the SOPHOS behavioural engine I wouldn't think that there would be a way around it, except for stopping SOPHOS during the install.

You could of course try a different Anti-virus program, or if this isn't an option then just include the SOPHOS screen in your release/install instructions.

Answer 2

what your OS? i guess it is because your anti-virus software, may be you can change the setting. try.

Answer 3

Probably the first course of action is to submit your file as a false-positive and ask them(us) to look at it. Mention that you're developing the file, and would like to know what triggered the alert, and they might tell you.

Otherwise look at what registry changes your service is doing.

Answer 4

I've not had the issue with my own services (we also use Sophos in our organisation) but I have seen it when installing certain programs such as Folding@Home.

It does seem to relate to changes made to the registry since Folding@Home stores certain data in the registry, yet my own Windows services change the registry and don't have this issue. I'd go with Douglas's suggestion of submitting it to Sophos and see what they say.