Signed inno exe extremely slow on windows 7+

Question

I found that under certain conditions, my signed, inno created installer.exe file takes about 10 minutes to open or view properties. When I start the administrator, it is immediate, so it seems obvious that the UAC is somehow connected. The size of the EXE is about 13 MB.

If I copy the file using a flash drive to the target machine, no wait. If the same file is downloaded via the browser, there is a 10-minute wait, and the explorer is going to la-la-earth, who knows what. After 10 minutes or so, the file opens normally, without waiting for all subsequent openings.

I use ksign + commo to sign inno exe, and internal dotnet exe in inno setup, although I don't think that is a factor.

Windows 10 has a 10 minute wait, even running as an administrator.

This action takes place for most versions with a victory over 7. It seems that some changes in the contents of the exe caused it, but I did not find the reason.

Edit 1: I contacted ksign earlier, they don't seem to have any problems with my exe, it opens without lag in their environment. However, this is not typical, as many installations run into this problem. I also tried to make some sense out of the monitoring monitor of the process monitor, but there is too much information that happens to the researcher to choose the suspension process if I am not looking in the wrong place.

Edit 2: MsMpEng.exe, which is the main security requirement for Microsoft, seems to work amok. This happens almost endlessly.

Answer 1

Try the steps described here: Offline Environment and Authenticode :

To work with UAC-compatible Windows, winsw comes with a digital signature. This causes Windows to automatically verify this digital signature at application startup (see discussion for more details ). This adds some delay to starting the service, and more importantly, it prevents winsw from starting on a server that does not have an Internet connection. This is because part of the signature verification includes verification of the certificate revocation list.

To prevent this problem, create myapp.exe.config in the same way as myapp.exe (renamed winsw.exe ) and put the following in it:

 <configuration> <runtime> <generatePublisherEvidence enabled="false"/> </runtime> </configuration> 

See KB 936707 for more details.

Note. This may not work if your installer already has a built-in manifest ( more ). In this case, you should try changing the built-in manifest instead.