2

I'm using the following code to set an Autostart of my Application:

using (RegistryKey rk = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true))
{
           rk.SetValue("Application", Application.ExecutablePath); //add autostart
}

When i compile it my Windows Defender instantly deletes the File because it found "Trojan:Win32/Bearfoos.A!ml" and "Trojan:Win32/Azden.A!cl"

I've have already tried to remove those lines without success. This is one of the easy ways to create an autostart application, so i would want to do it.

VollRahm
  • 397
  • 1
  • 16
  • So you have determined that is the line of code that is causing the problem? Virus scanners arent perfect, however i would seriously scan your system for viruses first thoroughly – TheGeneral Apr 28 '19 at 00:12
  • Yep it was that Line, when i moved it to Form_Shown() it worked. – VollRahm Apr 28 '19 at 00:13

1 Answers1

1

I got it. Apparently you can't have this in the Form constructor, you need to edit the Registry AFTER the Form_Shown() Method otherwise Windows Defender get's you. I can't undertsand the logic behind this :thinking:

VollRahm
  • 397
  • 1
  • 16
  • 1
    Funny how i always get stuck for 1 hour with no help from Google and when i ask the question on StackOverflow i find it out in 5 minutes by myself – VollRahm Apr 28 '19 at 00:22
  • 1
    Logic behind this is pretty simple: at the point the constructor is run, there is no UI yet. So Windows Defender has no idea whether your app is intending to add the entry and actually do something, or just add the entry and then exit (which is something a malicious app would do). – Ian Kemp Dec 25 '19 at 23:59