EXE Installer flagged as malicious.

[Codename K]

Hello,

I tried the trial version of Advanced Installer 21.1. I built an MSI installer and tested it in https://www.virustotal.com/. It came clean. However, I built the same installer as an EXE installer and this was the result,

https://www.virustotal.com/gui/file/716 ... ?nocache=1

12 out of 72 security vendors flagged this as malicious. It could be false positives. But, Microsoft is also flagged it as malicious.

[Catalin]

Hello K,

Do you face any issues with your installed AntiVirus software when executing a setup created with Advanced Installer?

Regarding the detections, unfortunately the antivirus heuristics are forever changing and unpredictable.

Before each release, we scan the setup and all the files from Advanced installer (each DLL, EXE) and we try to whitelist them before releasing the product.

However, after doing so, it can happen that the next day one of the files is flagged again...

So yes, this is a false positive deteciton.

If you encounter issues with any vendor, I would suggest submitting the setup for whitelisting.

For instance, if Microsoft Defender detects the setup, here's where you can submit the setup for whitelisting:

Submit a file for malware analysis

Best regards,
Catalin

[Codename K]

Hello,

For instance, if Microsoft Defender detects the setup, here's where you can submit the setup for whitelisting:

Thank you for your assistance in this matter. I will use this method. However, there are other issues. Google is also marking this as a threat. If you try to download the EXE installer, it blocks it as a threat. But, if you download the same installer as MSI, then it downloads it without issues. However, both Edge and Firefox are downloading it fine either way (EXE or MSI).

We will be OK with MSI installers. But, sometimes we need EXE installers. One reason is to install the Pre-install prerequisites. On this note, is there a way to install .NET Framework 3.5 as Feature-based?

[Catalin]

Hello K,

You are always welcome!

I'm afraid that .NET Framework can only be installed as pre-install due to some limitations of the .NET Framework setup itself.

Regarding chrome flagging it as well, could you please let me know if your setup is digitally signed? If you receive the "Unknown publisher" during your download, then most likely your setup is not signed using an EV certificate.

Tackling Unknown Publisher Warning: Understanding and Resolving User Account Control Alerts

Best regards,
Catalin