How to create secure desktop installer that doesn't trigger a virus alert for unknown exe?

Question

When I created a c# desktop application and move the exe file to another computer that has anti virus security, the security program shows an alert as unknown exe. I want to create a desktop application and a windows installer. How can I solve this problem? The virus programs should not alert an unknown exe.

Answer 1

You'll probably want to get a code signing certificate. That will identify your application. They are like SSL certificates, but for programs.

Once you have that, sign both your executable and your installer. That should help. When your installer is launched, you'll get the blue admin prompt, not the yellow one that indicates an unidentified author.

But... understand that there is no sure fire way to make sure anti-virus software doesn't flag your program. A code signing certificate helps, but it still may be flagged. Anti-virus software tends to be extremely aggressive, and some will essentially flag any unknown application (that is, anything not from a major company) as malware or a Potentially Unwanted Program (a meaningless term that can refer to anything). That has been a consistent problem for smaller software publishers for a long time.

If your application still gets flagged, you can hunt down the anti-virus software's website and see if they have a means of submitting apps to be white listed. Most do. You can use a service like VirusTotal to see which ones are flagging your program, and then contact them.

Answer 2

This message is more commonly associated with User Account Control (UAC) than with virus scanners.
The installer want to make changes to the computer so UAC steps in and warns the user that this is about to happen. It "classifies" the program in question based on the Author of that program, which is determined by the Certificate with which you signed the executable when you compiled it.

Didn't sign the executable?
Your program is from an "unknown" source and, therefore, untrusted.

You'll need to buy a certificate and sign your executable with it. It certainly used to be the case that self-created certificates weren't up to the job either - you have to part with Cash Money to get a real one for the warning to be downgraded (not eliminated), losing the "unknown publisher" bit.

You cannot [easily] get rid of the UAC Challenge entirely, nor should you; it's there for a Reason.