PDA

View Full Version : Security Issue with generated application



pierrejean.pralong
11-19-2015, 10:23 AM
I am generating a setup with install shield limited edition (latest version) and visula studio 2013
and I seem to have a problem with the security of the generated setup and the applicationitself:
1. the setup will not execute (hangs) if Avast is running - if I stop Avast it runs properly
2. The installed application will not start (hangs) if Avast is running - if I stop Avast it will start but asks to run as administrator
How can I resolve this issue ?

P.S. I have othe applications generated with the same environment and same profile that do not show this odd behavior
I wonder (!!!) if the name of my application "WinBad" could be responsible for this strange behavior

Thanks for any help

DLee65
11-19-2015, 03:05 PM
I do not know the details of your application but I would do the following to start with:
1. Always code sign your setup with a valid certificate from a known vendor, like Verisign.
2. Double check the manifest file for your application to see if it is requesting administrative rights.

Note: If your application attempts to modify HKLM, Program Files, services, etc.; then your app will require administrative rights. In this case you just need to modify your manifest file so that it requires administrator.

pierrejean.pralong
11-23-2015, 04:24 AM
I do not know the details of your application but I would do the following to start with:
1. Always code sign your setup with a valid certificate from a known vendor, like Verisign.
2. Double check the manifest file for your application to see if it is requesting administrative rights.

Note: If your application attempts to modify HKLM, Program Files, services, etc.; then your app will require administrative rights. In this case you just need to modify your manifest file so that it requires administrator.

My application is a very basic simple WinForms application that does not modify HKLM, Program FIles or services, or other
I have a manifest file (see below)
I have genereated a test Certificate
but no progress, if Avast is running the application does not start (it hangs and I have to restart my PC) if I stop Avast it starts but the "User controls" authorization request pops up

I have a couple of other similar applications that do not show this problem I have compared and find no differences in the parametesrs of thes applictions.


<?xml version="1.0" encoding="utf-8"?>
<asmv1:assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
<security>
<requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
<requestedExecutionLevel level="asInvoker" uiAccess="false" />
</requestedPrivileges>
</security>
</trustInfo>

<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
<application>
</application>
</compatibility>

<!-- Activer les thèmes pour les contrôles et boîtes de dialogue communes de Windows (Windows XP et version ultérieure) -->
<!-- <dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
processorArchitecture="*"
publicKeyToken="6595b64144ccf1df"
language="*"
/>
</dependentAssembly>
</dependency>-->

</asmv1:assembly>

DLee65
11-24-2015, 02:00 PM
Your manifest file looks correct, so it should not be raising the UAC prompt unless your app is trying to do something that Windows and AVAST thinks is a security risk.

Is there any way to do remote debugging for your application and publish a debug version of your app with appropriate pdb files? I am not positive this will help or not but it is something to consider.

Another thing to try on this system is to install the app to somewhere else other than Program Files, such to a directory off of the system drive, C:\. Is the behavior any different?

Also, do you include any third party files that could be causing this problem?

At this time I do not see how this could be related to the installer itself, unless there is something I am missing from your description.

pierrejean.pralong
12-07-2015, 09:57 AM
Your manifest file looks correct, so it should not be raising the UAC prompt unless your app is trying to do something that Windows and AVAST thinks is a security risk.

Is there any way to do remote debugging for your application and publish a debug version of your app with appropriate pdb files? I am not positive this will help or not but it is something to consider.

Another thing to try on this system is to install the app to somewhere else other than Program Files, such to a directory off of the system drive, C:\. Is the behavior any different?

Also, do you include any third party files that could be causing this problem?

At this time I do not see how this could be related to the installer itself, unless there is something I am missing from your description.

After having "cleaned" my PC from all referrences to the application (files and registers), removed Avast and re-generated the application it seemes to install and work correctly. I will of course never know what the problem was.
Thanks anyway - the probleme was most probably linked to InstallShieeld