tags:

views:

846

answers:

6

Regarding the same program as my question a few minutes ago... I added a setup project and built an MSI for the program (just to see if I could figure it out) and it works great except for one thing. When I tried to install it on my parent's laptop, their antivirus (the free Avast Home Edition) set off an alarm and accused my setup.exe of being a Trojan.

Does anyone have any idea why this would be happening and how I can fix it?

A: 

The very first thing to do would be to scan your build PC for viruses.

Greg Hurlman
+2  A: 

Indeed, boot from a clean CD (use a known good machine to build BartPE or something similar) and scan your machine thoroughly. Another good thing to check, though, would be exactly which virus Avast! thinks your program is. Once you know that, you should be able to look it up in one of the virus databases and insure that your software can't contain it.

The odds are that Avast! is just getting a false positive for some reason, and I don't know that there's much you can do about that other than contacting Avast! and hoping for a reply.

jsight
+1  A: 

I would do what jsight suggested and make sure that your machine did not have a virus. I would also submit the .msi file to Avast's online scanner and see what they identified as being in your package. If that reports your file as containing a trojan, contact Avast and ask them to verify that your .msi package does contain a trojan.

If it doesn't contain a trojan, find out from Avast what triggered their scanner. There may be something in your code that matches a pattern that Avast looks for, They may be able to adjust their pattern to ignore your file or you could tweak your code so that it doesn't trigger their scanner.

Chris Miller
A: 

I don’t know “Avast”, but in Kaspersky if the configuration is set to high almost every installer fires an alarm (iTunes, Windows Update, everything) especially if the installer modify some registry key or open a port. If avast checks for behavior and your program open a port probably that’s be the cause.

jl23x
A: 

Rebuild the setup file, check the exact file size. Check the exact file size of the "suspected" setup file.

If the source code hasn't changed and the two file sizes are different, there's a pretty good chance it got contaminated in transit.

I'd do that as a bit of a sanity check first.

DavidWhitney
A: 

Check out virustotal.com

DylanJ