PDA

View Full Version : SB8 installer gives a false positive Win32:Ransom with Avast



CyrilleLetellier
05-02-2013, 03:08 AM
Hello Every Body,

On a particular SB8 (dev 8.0.4000) project, i get a Avast (version 8.x) trojan Win32:Ransom [Tr] alert that locks everything. If i disable digital signing on the installer, i get untreasted alerts from Avast but if i continue, install is possible.

My simple project contains Clarion exe's + RT libraries + TPS FILES + some pdf files + RTF files: all these files are scanned individually successfully: no virus inside by the same avast.

I tried to compile the Run checkbox 2 sample adding some files and the same certificate to sign it: in that case no problem (i use MS signtool.exe).

Would you have any suggestion, some works around to get ride of these alerts ?

Thank you,

Cyrille Letellier

linder
05-02-2013, 03:14 AM
Cyrille,

Yes, very simple. But this has nothing to do with SetupBuilder. First of all, code-sign you install and then test it again. BTW, you should also test it against the other major protection systems on a regular basis. If it still gives a false-positive, report the bug to the protection vendor. They will request the file and then fix it in their next virus- or spyware definition update.

http://www.lindersoft.com/forums/showthread.php?p=69164#post69164

Hope this helps.

Friedrich

CyrilleLetellier
05-03-2013, 05:11 AM
Hello Friedrich,

With your link, i will have ,at least, a preventive and easyer way to test my installers against a lot of antivirus manufactures instead of letting my customers "discovering the trouble" ;-)

Thanks a lot again for the quality of your support.

Cyrille Letellier D+ SARL

CyrilleLetellier
05-03-2013, 05:18 AM
Hello Freidrich,

With your link, at least, i will have an easier and preventive way to test my installers against major antivirus manufacturers instead of letting my customers "discovering the problem".

Thanks a lot again for the quality of your support.

Cyrille Letellier D+ SARL

linder
05-03-2013, 05:46 AM
Hello Cyrille,

:) Thank you for your kind words!!!

Friedrich