I am becomming convinced some problems with squirrel.windows and Antivirus software could be due to the dummy update.exe in the update.zip in the repository. It seems the Antivirus software has the update.exe in the threat signature database.

Aug 14, 2016. Help Avast won't install. Download Avast Free Antivirus: 2. And didn't make any difference, the avastclear.exe also left registry entries and the hidden files in C: ProgramData AVAST Software that i manually removed before the install. Windows startup programs - Database search. If you're frustrated with the time it takes your Windows 10/8/7/Vista/XP PC to boot and then it.

Any file it finds it it is flagged as a threat. Note, the threat isn't the setup.exe but the update.exe it finds inside the setup.exe.

I am thinking if the update.exe and update.zip were part of the compile process that would help reduce the flagging of a file with the current update.exe as a Threat. When setup.exe is packed with a nuget package using the --releasify the Antivirus does not flag the setup.exe. The setup.exe file that I build with nuget packages is not identified as a threat. The setup.exe file that was created from hello.squirrel is not identified as a threat. The setup.exe that is from the squirrel.windows nuget package 0.99.1.1 is detected as a threat because it contains the dummy update.exe The setup.exe compiled from the squirrel.windows source code is detected as a threat because it contains the dummy update.exe A failed releasify setup.exe is detected as a threat. The update.zip in /src/Setup/ is detected as a threat. Attached are links to the virustotal.com scans for the different files.

This is the setup.exe that is found in the nuget package 0.99.1.1 This setup.exe file has the dummy update.zip/update.exe in it. 3 out of 57 detected the file as a threat This is the dummy update.exe that is in the squirrel.windows source code repository update.zip. 8/57 identified the file as threat This is the update.zip with the same dummy update.exe as above but scanned as the zip.

This is the setup.exe that is compiled from the hello.squirrel example found in github.com. It is built with squirrel.windows nuget package updated to the latest 0.99.1.1 0/57. None of the antivirus scanners identified the file as a threat and the file is not code-signed. The following screenshot is from my workstation where I scanned my test squirrel.windows tests, hello.squirrel, squirrel.windows source code repository with built output, the zip of that source, and the nuget package unpacked. The Avast scan result has identified every file containing the dummy update.zip/update.exe as containing a threat.

None of the squirrel.windows setup.exe files I generated or the hello.squirrel setup.exe has been flaged as a threat. None of the files have been code-signed. Note from the screenshot that the result is explicitly pointing out that the update.exe inside the setup.exe is the threat. Not the setup.exe itself. Below is a screen shot of all setup.exe files that were included in the scan above.

Each of these directories had squirrel.windows --releasify generated content that was not code-signed. I wanted to initially post this as a lead into the issue.

I do have a remaining test at replacing the dummy update.zip with something else and see how that changes the detection with the AV scans. I have evaluated what happens if the dummy update.zip is replaced with a different update.exe file. When a different update.exe is used the newly compiled setup.exe is not identified as a threat. A screenshot of the scan will show that the unit test fixtures setup.exe is still identified as a threat because that file is static and is not updated during the build process. This file contains the original dummy update.zip/update.exe that is flagged as a threat. Missing from the scan results is the Setup.exe that was compiled using a new update.zip.

Also missing are the build artifacts /obj/Debug/Setup.res. Even the update.zip was not flagged as a threat. When the newly built setup.exe is uploaded to virustotal.com it hits 0/57 none of them find the file as a threat. Replace the update.zip with a component that has a project that builds the dummy update.exe and have that pulled into the setup.exe build would at least eliminate the hits that use the dummy update.exe as signature. My test was with an empty c# WPF form. Although, maybe releasify should have logic to prevent the need for a dummy executable file and not produce a setup.exe that would only be known to have failed if it was executed.

Alternatively if this is used for unit testing the goals of the unit test probably could be met in a different method. At the end of the day, Update.exe is a program that: • You click it • It copies executable binaries to another intermediate location, and • Runs them What does that sound like? It turns out there's not much difference between Squirrel (or any other installer that installs to the user's profile) and malware, except that our installation is consensual with respect to the user. For development, people just need to stop using Avast and use MS Security Essentials instead, which has never flagged us. For shipping an application, signing your application and installer with a Code Signing Certificate will solve this problem and AV vendors will trust you and you (mostly) won't see this problem. AV vendors put a pretty big weight on code signatures. Paul, We might not be discussing the same 'update.exe' here.

I am talking about the file This file has the update.exe that Avast and the other AV don't like. The update.exe that is produced from the project is not a problem. The setup.exe that is produced when I execute squirrel.exe (update.exe) --releaseify is not a problem because the dummy update.zip is replaced with my nuget package. There are alternative solutions to the problem that does not require all developers to switch AV or stop using Avast.

Sekai No Owari Earth Rare here. Auto generate the update.zip/update.exe as part of the solution. Trust me I would stop using Avast if I had the choice. I have the freedom for everything else but the Avast software is pushed onto all workstations via AD group policies.

The screen shots of the setup.exe was not ones that contain the workhorse update.exe but all contain the dummy update.zip/update.exe that is only there to display a MessageBox.Show of the command line parameters. I do understand that if i code-sign the setup.exe that contains the dummy.zip/update.exe it will be trusted by the AV.

Download Relativity Viewer Installation Kit. I have actually already tested this. Avast does not flag a file it had just identified as a threat once is signed. If it would help I can make an example of it in a fork or issue a PR.