3

I have a small program which converts some data files between different versions of a game (Age of Empires 2). It requires some dll libraries such as boost and a few additional data files. I would like to pack these into a self-extracting archive for a one-click installation. I've tried using both WinRar and the built-in Iexpress of Windows. The archive itself works fine, however it seems to trigger some virus warnings.

Here is the actual program: https://www.virustotal.com/de/file/aa06bd9eb77f2414a149e7312dcfbd70cfc6fb2f4888a385b3d00c55c32118cd/analysis/

And this is the packaged archive: https://www.virustotal.com/de/file/1e4272798163031fca982d5433b7e9c3c8378abb02cece9889384cef28f20cfc/analysis/

Is there an accepted way to do this without triggering false positives or should I stick to distributing it as a normal zip Archive?

3
  • 2
    One of the best ways to avoid this is to digitally sign the application including the archives you distribute it in. (.msi is just a scripted archive format)
    – Ramhound
    Apr 13, 2017 at 12:24
  • 1
    Ramhound is right. Unfortunately, digital signatures are not cheap.
    – user477799
    Apr 13, 2017 at 12:26
  • 1
    It's a purely non-commercial/hobby project so I don't really want to spend a lot of money on it. I guess I'll stick to distributing it as a zip.
    – Jineapple
    Apr 16, 2017 at 12:58

1 Answer 1

1

There are some tricks you can do to decrease the detection ratio. For example use WinRar 3. It will trigger less false positives. You can also use a 64 bit SFX header instead of 32 bit.

Source:
http://thesunstroke.blogspot.de/2017/11/false-antivirus-reports-on-installers.html

5
  • 1
    The link shows someone's detection ratio for various versions of WinRAR, while discussing other softwares they've used and the results. Using this information, I was able to create my repacked Notepad++ (silent installer+config+plugin) using WinRAR 3.11, without it triggering every AV in the world. Hopefully this info isn't used for nefarious means! Thanks. Jul 18, 2019 at 14:02
  • Perfect. Can you tell exactly how many AV you triggered? Also, how many of those AV are "big-brand" and now many are "under the table" unknown AVs. Some of those antiviruses you can just ignore.
    – IceCold
    Jul 18, 2019 at 14:24
  • I haven't been keeping track. Two in particular I know were triggered by the original were SentinelOne and Managed AntiVirus. I think AVG and MalwareBytes may also have, but I can't recall. Pretty sure it got past Avast. Using WinRAR 3.11 has an unfortunate side effect that Windows asks me when I'm done if it installed correctly or if I want to try again with Compatibility Mode. Jul 19, 2019 at 15:01
  • "unfortunate side effect" - yes I remember that.
    – IceCold
    Jul 22, 2019 at 13:35
  • It also makes a difference if you hide the dialogs and progress bars or if you keep them visible. With WinRAR 6.02 zip 64bit and the dialogs on I was able to create a self-extracting exe that will unpack to a temp dir and launch the program with a detection rate of 0/66. I also tried ILMerge, Costura.Fody and 7zip to distribute an exe with dlls as a single file and they all triggered anti virus software. So for the moment this seems to be the most reliable way if you can live with 64bit and a dialog flickering on launch.
    – Gellweiler
    Jun 17, 2021 at 11:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .