How do I make sure my installer doesn't set off virus scanners?

Question

The converse of this question.

How to give evidence that an open-source project is reputable?

The installer for my project is being picked up as "Untrusted" by a popular anti-virus software (in this particular case, Symatec). The scanner doesn't say that my project is a virus, but really just warms that it is Untrusted because it's only seen it in the wild a few hundred times. The software is safe, but this warning is potentially scaring off new users.

How can I either get virus scanners to trust my software, or impress upon my potential users that the software really isn't contaminated?

Answer 1

There is a great deal of malware out there. There are new exploits every day. From the point of view of non-technical users of computers, particularly Windows computers, it is a good thing that AV systems warn them against the rare and unusual.

So, realistically, anyone with a new thing has a hill to climb. It's a marketing hill. What can you do? If your audience is really nontechnical people, you have to find a way to get noticed by the media. Get your program reviewed in places where potential users will read the review. If trustworthy people write 'this is a good thing, don't worry about the AV' warning, then people will install it. If enough people install it, you won't get warnings any longer.

Answer 2

First off, you need to understand that this isn't just you. It happens to all kinds of projects.

That's Git several hours after release. Symatec thinks it's not trust worthy too. Bmarguiles is absolutely right that the "easy" way to deal with this is to have a large number of users. Then, this will magically take care of itself as the AV vendors see more instances of the software.

That's not very practical for a young project though. That warning is scaring off the very same users you need to make that warning go away. The solution here is to start blanketing as many AV vendors as possible with Whitelist requests. Each vendor has a different process, but it generally involves filling out a form, attaching your installer, and sending them the request. Wikipedia has a non-exhaustive list of notable AV software that would be a great place to get started. Settle in though, because it's a big list and you generally need to do this every time you release. At least until you have a good reputation with a consistent user base. Honestly, as often as we release our project, we just don't bother making whitelist requests, but it could be manageable if you're only releasing a few times a year.