1

I wrote a VS12 .net4.5 .exe that copies itself to the user directory (unless it's executed from there) and creates a shortcut to the user directory .exe in shell:sendto.
Every time it's executed with the send to menu just one of my colleagues gets the smartscreen warning where he needs to click on "more information" and then "execute anyway".
In the .exe properties there is an Allow button, if you click it it disappears but once you close the .exe property dialogue and open it again the button is there again!
How do I get rid of it?

I am often writing helpful little C# applications with different distribution strategies: Sometimes it's in a rar/zip archive and I put it on our NAS, sometimes I send it via email and sometimes it's transmitted with a data stick.

How can I reliably predict whether there will be a smartscreen warning?
I have read lots of unverified information about an invisible magical reputation value.
Is there truly no way to properly sign my applications to be sure there won't be a warning? We'd be ready to buy a certificate if we know for sure that it will remove the smartscreen warning.

1 Answer 1

2

Smartscreen is a technology from microsoft that establishes an internet connection to one of microsofts servers and checks if the exe that you are trying to execute is on a whitelist or correctly signed. Therefor it will warn the user when executing all not fully signed and unknown applications.

You can use any official digital signing company to get a certificate (they cost something). One of the most popular is VeriSign. As far as I know this should stop the warnings from smartscreen.

Also you should use the signtool to create an assembly with a strong name. That gives the assembly a basic level of trust. However this will not stop Smartscreen from warning the user from executing your application. http://msdn.microsoft.com/en-us/library/ms247123(v=vs.90).aspx

An assembly signed with a strong name is ensured to not have undergone any changes since the assembly got compiled. It therefor prevents viruses from infecting the assembly, that makes the computer trust the exe file more.

2
  • For my .net programs, do I want the "Extended Validation Code Signing" certificate or "Code Signing Certificates for Microsoft Authenticode"? SEVCS explicitely talks about Smartscreen in it's description but it's still unclear to me...Are there cheaper but reliable alternatives you can recommend? What are their drawbacks, why is anyone buying from more expensive sellers?
    – ASA
    Dec 10, 2013 at 12:03
  • In the company that I used to work, we used a certificate from verisign. However I don't know which one we used or the exact differences between those certificates. I have only digged into the free certificates so far. I never took the time to take a closer look on those certificates that cost... All our assemblies were certified by verisign and had a strong name. We used post-build events in visual studio to sign the assemblies
    – RononDex
    Dec 10, 2013 at 12:21

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.