Windows 8 / All Antivirus hates all mmf-made exes? Any solution?

Hey all!

Been peeking in at these forums for years now - thanks for all the assistance you didn't realize you were providing me :)

I've recently started playing with mmf a lot more - and I'm getting to the point where I'm going to give the whole retail release thing a go.

Imagine my shock when every single person I send my .exes to can't open them without jumping through hoops.

I combed through 25 pages of forums, and searched for every term I could think of that was related... But most people seem to be complaining about false positives concerning antivirus programs. In my particular case, I even removed Microsoft Security Essentials to eliminate that as an obfuscating factor - but every single time I download the .exe version of my application and try to run it, it's flagged as potentially dangerous on download (expected - I click "keep file") - then it's flagged as a potential risk on opening the file, and I have to click "More Info", then allow it.

I'm sure this doesn't need to be said, but this is a monumental imposition. If it's anything like install prompts in web-based content, I'll lose over 90% of my "customers" without them ever successfully opening my app with this type of issue present. I've tried plenty of different build options - including the "Compress at runtime" omission I've seen referenced - but nothing has any effect on how scared Windows is of my app.

Is there any solution to this problem? Am I doing something wrong w/ my build settings? I'm using nothing out of the ordinary - the PMO is the only non-pack-in extension I'm using. If this is unsolvable....well... Kinda pissed I dropped 400+ dollars :( I can't see how anyone could get an mmf2dev game on steam with this issue present...

What antivirus are they/you using? Your computer may be infected with a virus, which might be infecting the EXE files you make, which would make their virus scanners go berserk. Also, if they are using Norton, then that would explain the problem, as Norton requires that 10 people who have Norton already have the EXE file (which is perhaps the worst "protection" from viruses ever).

in this particular case, I've removed all virus protection from my computer (to test this issue). It seems that Windows 8 itself hates the file without any additional layer of virus protection...

And yes, Norton / Avast / MS Security Essentials have all had issues w/ exes in the past.

Comp was fine when I scanned 3 days ago, and haven't DLed anything except some music and my own file a few times. I highly doubt it's actually infected - it seems symptomatically similar to the previously-reported false positives... but at the OS level w/o extra protection. I'd be happy to screenshot what I see as I see it if that helps.

There are many, many reasons beyond MMF2 why this happens. More particular with newer updates to Windows and new Windows versions. Unfortunately for us developers, Microsoft are taking the route of "babysitting" their users, I even heard it's impossible to turn of UAC controls in Windows 8 now, if that's true I think I'll be sticking to Win7 much, much longer.

There are a couple of steps you can take, if you're a commercial developer and earning from your apps then some of these are certainly noteworthy:

1) Uncheck 'Compress the Runtime' for when you build. AV's that flag up false positives are usually in the form of stdrt.exe which is common for all compressed runtime exports. Uncompressing the runtime will allow the process "myapp.exe" to run instead of the common stdrt.exe

2) Sign your application. It's well worth the money to become a verified publisher and self-signing your applications for use on Windows. (Example: http://www.digicert.com/code-signing/ ) Verisign also offer a similar service.

3) Use a trusted installer. From a reputable company, such as Clickteams ICP.

4) Don't let people download your exe directly from your website, that is bound to hit roadblocks along the route (ie: google flagging as unsafe after downloading), Windows defender flagging up a suspect executable that doesn't appear to be a common 'install file'.

If I can think of anymore I will let you know, however be rest assured I have a lot of applications even being downloaded to this day and I rarely, infact can't remember the last time I got a support ticket for any of the above.

This is GREAT info Danny - this might make a nice sticky / addition to the "first time to the forums?" topic - as I've seen a lot of similar topics, and this is the best list of steps I've seen.

If this info is already present somewhere else, sorry for making you repeat yourself.

I'll give various combinations of all of this stuff a try and get back w/ potential success story.

For what it's worth - aside from the same irritating permissions issues, and aforementioned UAC lockdown - the OS itself is quite nice. Metro stuff is kinda meh, but the OS itself is faster and better than 7 w/o any usability sacrifices thus far.

it appears that "Unknown Publisher" is the primary culprit - as far as Win 8 is telling me. Assuming the digicert step will allow me to fix this? (And that there's no other way around this without paying 178/year?)

No that's fine, I don't think this info is mentioned anywhere else, there's hardly any talk of application development around these parts but I've been using MMF2 for the last 3 years or so for commercial and private developments so it's handy to know these things.

Yes you will need to pay for any kind of reputable publisher signing, shop around you may find some cheap ones. $178 for the year is pretty good though if you're making money off your developments that is!

I used windows 8 and havent run into any issues

Digicert, if you buy 3 years at once, charges 178/year. Most competitive I've found - most others (Verisign included) are more along the lines of 400-500/yr. Now to cross the money-making apps bridge :)

@Ratty - have you dried downloading and executing an .exe on your Win 8 machine? All 4 Win 8 machines I saw had similar problem with every exe I made w/ mmf - and the few unsigned examples I downloaded, also as .exes

You are confusing various things in this message.

Quote:

---

every single time I download the .exe version of my application and try to run it, it's flagged as potentially dangerous on download (expected - I click "keep file") - then it's flagged as a potential risk on opening the file, and I have to click "More Info", then allow it.

---

This is a standard Windows alert message. When you download an EXE Windows locks it and displays a message to confirm you really want to run it, because it assumes any EXE you download is a potential risk. Unless perhaps/probably if your EXE is signed.

Quote:

---

I combed through 25 pages of forums, and searched for every term I could think of that was related... But most people seem to be complaining about false positives concerning antivirus programs.

---

False positives are a different issue. They happen from time to time and are usually quickly solved by the AV vendors who fix the bug in their virus definitions when we report it to them.