5

My software is a .NET application. The original .exe compiled with Visual Studio works fine and Microsoft Defender has nothing to say about it or any of the dependencies.

I made an installer with INNO Setup, that has been working fine until now, on a bunch of different machines.

The installer deploys my two .exe (the main app and an admin tool) and my own libraries, a few other libraries (Helix Toolkit, Triangles.net), and some libraries from .NET 5.0 (so that the framework is not needed for an offline install).

Since this morning, I have the following :

  • one of the installed .exe is seen as a Trojan by Microsoft Defender, and is put in quarantine ;
  • when I put the original .exe back in the Program Files directory manually, no Trojan is detected (even when i manually test the directory).

EDIT To be clear :

  • no malware is detected in the installer
  • no malware is detected in the original file
  • only the file installed by INNO SETUP is concerned

Is it possible that Inno Setup put that Trojan in my exe ? If so, what could I do to prevent or circumvent it ?

EDIT The more I investigate this, the less I understand what Inno Setup does. My original exe file weighs only 280 Ko, and the exe file installed by Inno Setup weighs 132 Mo. And, again, the Trojan is ONLY detected in the exe installed by inno setup.

Screen cap

sorry for the french OS

enter image description here

The trojan description is :

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3aScript%2fWacatac.B!ml&threatid=2147735503

EDIT : the inno setup installer is now seen as containing the trojan and put in quarantine. enter image description here

geriwald
  • 190
  • 1
  • 4
  • 17
  • 2
    If the anti-malware engine thinks your executable looks suspicious, then sure, it would block it. You would need to inform the vendor of a false-positive or manually unblock in that case. (Digitially signing your executables and installers using a code-signing certificate from a validated CA is another very good solution, although this is not free.) – Bill_Stewart Aug 18 '21 at 15:37
  • I pay for a 3 year code signing certificate and whitelist each installer with the avast ftp server. – Andrew Truckle Aug 18 '21 at 19:11
  • salut ;) Which version of Inno Setup Compiler ? I have the same problème with 5.x. – Jerry Oct 11 '21 at 19:05

3 Answers3

2

This is a false positive alarm.

Report your software as safe to several AV companies and wait till the update their databases.

Also it helps if the software is signed with certificate, has many users/downloads and everyone reports it as safe.

Slappy
  • 5,250
  • 1
  • 23
  • 29
  • Ok for reporting and signing, but I don't understand why there is no Trojan detected in my original exe, and only in the much heavier exe installed by Inno Setup. See my edit about the file size, too. – geriwald Aug 19 '21 at 07:10
  • 1
    Setup is also an executable and the AV software may see some binary operation e.g. writing to files or folders, working in registry or anything suspicious. – Slappy Aug 21 '21 at 04:04
  • Again, defender sees no Trojan in the setup executable – geriwald Aug 21 '21 at 07:35
  • The Trajan was detected in the installed exe several weeks after having been installed – geriwald Aug 21 '21 at 08:05
0

My .net 6 app was flagged with the same Trojan. Defender had no issues when my code was just in the bin\release folder, but after publishing it to a folder and letting Visual Studio create a single executable, Defender started showing this false positive. For me the solution was simply to strong name my main exe assembly. This seemed to change the final resulting exe signature enough as to not get flagged anymore.

Marko
  • 2,266
  • 4
  • 27
  • 48
0

I removed the remarked items, the Trojan warning disappeared:

ChrisGPT was on strike
  • 127,765
  • 105
  • 273
  • 257
Hu Johney
  • 21
  • 1
    Please add code directly into answer , rather than screenshot. It would be more helpfull to other users when reading your answer. – Mr.SwiftOak Apr 22 '22 at 07:23
  • Given he's showing lines to remove, rather than lines that need typing - I'm not sure why code is better than a screenshot? – Dan Dec 02 '22 at 14:48
  • @Dan You can do blah blah blah (although the OP may not know this) – Paul Sanders Jun 08 '23 at 03:59
  • @PaulSanders - That still doesn't make it easier for the reader though. My point was just that in this context, a screenshot is fine. The reader would never need to copy and paste this code - the Op was showing what lines to remove. – Dan Jun 09 '23 at 05:53