Wix Bootstrap prevent temp directory use

Question

I have builded "HelloWord" installer with the Bootstrapper Project for Wix v3 project type.

My bundle.wxs is

    <?xml version="1.0" encoding="UTF-8"?>
<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi"
     xmlns:util="http://schemas.microsoft.com/wix/UtilExtension"
     xmlns:bal="http://schemas.microsoft.com/wix/BalExtension">

  <Bundle Name="Bundle_name"
          Version="1.0.0.0"
          Manufacturer="Producter"
          UpgradeCode="C82A383C-751A-43B8-90BF-A250F7BC2863"
          IconSourceFile="..\WpfForms\Assets\my_lovely.ico"  >

    <BootstrapperApplicationRef Id="ManagedBootstrapperApplicationHost">
      <Payload SourceFile="..\WpfForms\BootstrapperCore.config"/>
      <Payload SourceFile="..\WpfForms\bin\Debug\WpfForms.dll"/>
      <Payload SourceFile="..\WpfForms\bin\Debug\GalaSoft.MvvmLight.dll"/>
      <!--<Payload SourceFile="..\WpfForms\bin\Debug\Microsoft.Practices.ServiceLocation.dll"/>
      <Payload SourceFile="..\WpfForms\bin\Debug\Microsoft.WindowsAPICodePack.dll"/>
      <Payload SourceFile="..\WpfForms\bin\Debug\Microsoft.WindowsAPICodePack.Shell.dll"/>-->

      <Payload SourceFile="C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\.NETFramework\v4.5\System.ServiceProcess.dll"/>
      <Payload SourceFile="C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\.NETFramework\v4.5\System.Configuration.Install.dll"/>
      <Payload SourceFile="C:\Program Files (x86)\WiX Toolset v3.11\SDK\Microsoft.Deployment.WindowsInstaller.dll"/>
    </BootstrapperApplicationRef>

    <Chain>
      <PackageGroupRef Id='Netfx4Full'/>
      <MsiPackage SourceFile="..\WixSetupProject\bin\Debug\WixSetupProject.msi" Id="InstallationPackageId" Cache="yes" Visible="no"/>
    </Chain>
  </Bundle>

  <Fragment>
    <WixVariable Id="WixMbaPrereqPackageId" Value="Netfx4Full" />
    <WixVariable Id="WixMbaPrereqLicenseUrl" Value="NetfxLicense.rtf" />

    <util:RegistrySearch Root="HKLM" Key="SOFTWARE\Microsoft\Net Framework Setup\NDP\v4\Full" Value="Version" Variable="Netfx4FullVersion" />
    <util:RegistrySearch Root="HKLM" Key="SOFTWARE\Microsoft\Net Framework Setup\NDP\v4\Full" Value="Version" Variable="Netfx4x64FullVersion" Win64="yes" />

    <PackageGroup Id="Netfx4Full">
      <ExePackage Id="Netfx4Full" Cache="no" Compressed="yes" PerMachine="yes" Permanent="yes" Vital="yes" Name="DotNet_4"
                  SourceFile="../WixBootstrapper/DotNet/NDP462-KB3151800-x86-x64-AllOS-ENU.exe"
                  DownloadUrl="http://go.microsoft.com/fwlink/?LinkId=164193"
                  DetectCondition="Netfx4FullVersion AND (NOT VersionNT64 OR Netfx4x64FullVersion)" />
    </PackageGroup>
  </Fragment>
</Wix>

My problem is that the work station's antivirus configured to block any activity from temp directories and the builded installer.exe make copy of itself as "C:\Windows\Temp{74EA5B2A-DA46-4B3F-A8E9-4FCEC4B4523C}.cr\WixBootstrapper.exe" and run it by default. So it get locked by antivirus so instalation is over on start.

Do somebody know how can i prevent WiX components from create a cache or something in temp directories and set to run any nested executable and themselfs from the curent folder, not from the temp?

Answer 1

After checking Windows's group policy settings this turned out to be an anti-virus blocking problem.

---

Group Policy?: Does the log contain something like this:

Error 0x800704ec: Failed to launch clean room process: "C:\WINDOWS\Temp\{AB10C981-0D7D-4AA6-857F-CC37696DB4BE}\.cr\Bundle.exe" -burn.clean.room="C:\Test\Bundle.exe" -burn.filehandle.attached=652 -burn.filehandle.self=656 -log "C:\Test\bundle.log"
Error 0x800704ec: Failed to run untrusted mode.

Or does it say something else? There is a group policy that can cause similar issues. See WiX issue 5856.

Anti-Virus Grace Period?: If you are administrator, there should be a possiblity to get a temporary grace period from your anti virus I would think. So you can perform your testing. I would give your own support desk a call first and then hit the Kaspersky user forums if unsuccessful. Perhaps you have a Kaspersky support agreement with priority support available?

False Positives: I also insist that you upload your binaries to virustotal.com to test for false positives. That you should do no matter what. Antivirus Whitelisting Pains by Bogdan Mitrache.

False positives can actually be worse than actual malware at times (so far as the malware isn't devastating) because you cannot just tell the user to rebuild their machine(s). Instead you actually have to fix the problem for them in a general sense. Not only does the user have a problem to fix, you have one as the vendor as well. How do you whitelist your product with 60+ anti-malware suites? You try virustotal.com first I think (not affiliated) - to check if you actually have such a problem.