Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm creating a piece of software, that will run on windows and will act like launcher for the game, to serve as an auto-updater and file verifier in client siede PC.

One thing I don't understand, why my antivirus software (Avast) is considering my exe file as dangerous and won't start it without asking to put it into sandbox, for safe use.

Is there any rules that my software should obey, to be treated as good, or should I pay hundreds of dollars for some sort of digital signing and other stuff?

I'm using C# with MS Visual Studio 2010.

VirusTotal report. No DLL injections, working as remote file downloader, using WebClient() class.

It is not like it warns about virus, but it "suggests" to sandbox it. Look at screenshot:enter image description here

share|improve this question
    
I suggest you first upload your program to virustotal.com to get an impression of the number of vendors that consider your app suspicious. If all AV programs flag your app you'll have to find out what your code is doing that an AV program might consider suspect. It is practically impossible to determine what heuristics AV vendors use - I doubt they'll tell you. If it's only one or two, you can report false positives to them (check their website, or google "vendorname report false positive"). The downside of this is that you'll have to do this with every release of your software. –  Jan Doggen Mar 18 '13 at 11:33
    
It's not doing anything DLL-Injection related activity, is it? –  l46kok Mar 18 '13 at 11:33
    
Make sure your computer is not infected with a virus. I've never seen that behaviour before unless there is an infection. –  Sam Mar 18 '13 at 11:34
4  
You could start removing functionality from your code, until AV is satisfied, or no code is left (whichever comes first). The part, whose removal made AV happy, should be checked. –  ugoren Mar 18 '13 at 11:46
1  
Does the problem occur during development only? I've had that problem at work plenty of times myself, when the compiler generates the executables. If so, the solution is indeed to uninstall the anti-program software. –  user29079 Mar 18 '13 at 12:07
show 10 more comments

1 Answer

up vote 5 down vote accepted

"File prevalence/reputation is low" means Avast uses a reputation system based on the usage of the program. Only if your program has been installed and 'marked as benevolent' by enough users will it develop a good reputation and will this suggestion go away. Avast calls this the FileRep cloud feature and says "All new unknown files are potentially dangerous. Whenever they have become widespread, there will not be a reason to AutoSandbox them anymore". This is a PITA for small software companies (and Avast is not the only one doing this, note e.g. Symantec's Suspicious Insight"). One thing Avast suggests is "you can accelerate the process if you digitally sign the files."

Locally (on your computer) you can go to autosandbox expert settings and disable autosandboxing files with a low reputation, or maybe use a self-signed certificate, but that won't help you with your end users. For those I suggest you do use a real certificate (costs money, but Windows likes it too), and update your documentation with this info.
Maybe there's more suggestions at the Avast forums as well.

share|improve this answer
    
Thank you for answer. Digital signing is way to go. –  Deele Nov 9 '13 at 21:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.