Windows SmartScreen blocking executables

[edouardo17]

Hi guys,

I've seen that the same kind of question has already been asked on the forum, but I'd like to rephrase it for in the past discussion, the problem wasn't realy resolved...

The question is simple : How do we make Windows SmartScreen trust our executables?

I've seen in many threads that one solution was to be famous enough to be safe... If you're downloaded enough times, you become safe... But this doesn't really suits me

Two things are getting in my way: First when you download my executables, Internet Explorer or Google Chrome warns you with the following message:

code:
"... is not commonly downloaded and could harm your computer"

Then once you've allowed the file to be saved on your computer, double click on it and there it goes again :


I understand that when you download the file on the internet, it can be flagged as "threatening" because SmartScreen can base its judgment on the number of download, or any kind of shitty presumption of that sort.

HOWEVER, when you run the executable on your computer, my guess is that SmartScreen runs a quick check on the file and somehow finds out that it could do harm to the bloody computer... So my question is:

What is the physical difference between a "non-threatening" software and my executables?

I've looked into a potential whitelist that probably exists, but not on earth for sure...

The question was asked on the Microsoft Community Forum, and the unique irrelevant reply was from a Microsoft bloke. I figured out the guy didn't even read the topic subject for he only "suggested" a link to SmartScreen FAQ, which by the way, doesn't mention anything about my problem ever...

I thank you in advance for your help. Last time I requested help here was to write the scripts of my installers. Now that they're perfectly working, Windows decided to annoy me a bit more than I ever could have expected!

Cheers,

Edouard Fourmaux

[Afrow UK]

You should digitally sign your installer. We have never had an issue with SmartScreen because we digitally sign.

Stu

[Theresias]

We've seen fresh digitally signed files to be blocked as well, usually it took a few hours/days depending on the download volume for the message to go away. In essence, sign your files and it goes away much faster.

[edouardo17]

Yeah... I figured that out when I saw people complaints about being blocked by SmartScreen after purchasing a very expensive Certificate...

So yeah, I'm definitely inclined to Digitally sign my .exe, but after spending a few hours on the net, jumping from Microsoft forum to NSIS DiscussionS, I couldn't figure out how to proceed...

The only interesting thing I found was this article :

This guy explains clearly what are the purposes of signing your code...
Though it remains unclear how to digitally sign my software in practice...
I figured I had to acquire a kind of Certificate from a Software Certificate Publisher, which in every cases costs a huge amount of money... But the small developer that I am can't afford such certificate. The budget is limited to the cost of a hosted domain at OVH...

I understood that buying a certificate also meant protecting your code, and my guess is that this is what costs money... However, I do NOT need a protection for I don't really care if anyone steals my code. My executables are no software. They're only extracting files, and they're freeware, and distributed to a small community of virtual aviation enthusiasts, therefore I don't need any protection.

So is there a way to just digitally sign my executables for free so that Windows SmartScreen trusts me?

[JasonFriday13]

So is there a way to just digitally sign my executables for free so that Windows SmartScreen trusts me?

If there was a free service then everyone would be using it, which would negate the security that Microsoft put up in the first place to protect the user.

I have a special "Program Files XP" folder for older software that has write permissions, so it's possible to use "RequestExecutionLevel User" for some situations where I don't need admin privileges. If it does need admin, then I generally run command prompt in admin mode and run the installer from there.

I don't use windows 8, so I don't get the SmartScreen prompt when I run my installers. I still get the UAC dialog like it's supposed to.

[Anders]

I understand that when you download the file on the internet, it can be flagged as "threatening" because SmartScreen can base its judgment on the number of download, or any kind of shitty presumption of that sort.

HOWEVER, when you run the executable on your computer, my guess is that SmartScreen runs a quick check on the file and somehow finds out that it could do harm to the bloody computer...

This is probably because of the Zone.Identifier ADS, if you download a file in most browsers or even extract a .zip you got from the internet with explorer the file is tagged as "from the internet" and smartscreen will check it. In the file properties dialog there should be a unblock button.

What is the physical difference between a "non-threatening" software and my executables?

None, it should really be called SheepScreen, it just means enough people thought it was safe to execute.

[AintBigAintCleve]

I hit the same issue with BGinfo. See my comment on this MS Community page showing how to copy a file with no ADS crap in a Group Policy Object: http://answers.microsoft.com/en-us/i...8-988860bac4fa

Basically you create a new file locally and move the downloaded/network copied file over the top of it. A ridiculous fudge that shouldn't be necessary, but it works.