AVG charges infection in Windows service application if add command to Windows Firewall is present

_{the question itself has already been answered in the other answer so I will try to just supplement it.}

This code snippet WinExec(....) is quite well known( eaten/beaten) by antiviruses because it is doing this in the background, the antivirus is right to consider its application as a malware.

Try to approach this in some other way, such as using the APIs of the Windows Firewall, more precisely using the interfaces INetFwPolicy2 e FWRule.

See the following example that will try to add a rule to an application (Note: privileges are required to run the application):

program Project1;

{$APPTYPE CONSOLE}

uses
  SysUtils,
  ActiveX,
  ComObj;

// Este código adiciona uma regra de aplicativo usando as APIs do Windows Firewall.
Procedure AddApplicationRule;
Const
 NET_FW_ACTION_ALLOW = 1;
 NET_FW_IP_PROTOCOL_TCP = 6;
var
 CurrentProfiles : OleVariant;
 fwPolicy2       : OleVariant;
 RulesObject     : OleVariant;
 NewRule         : OleVariant;
begin
  // Cria o objeto que permite acessar a política de Firewall
  fwPolicy2   := CreateOleObject('HNetCfg.FwPolicy2');
  RulesObject := fwPolicy2.Rules;
  CurrentProfiles := fwPolicy2.CurrentProfileTypes;

  // Cria o objeto que proporcionará acessar as propriedades de uma regra.
  NewRule := CreateOleObject('HNetCfg.FWRule');

  NewRule.Name := 'Foo Bar';  // Nome da Aplicação
  NewRule.Description := 'My Powerful Service Example'; // Descrição da Aplicação
  NewRule.Applicationname := ParamStr(0); // Caminho da Aplicaçao
  NewRule.Protocol := NET_FW_IP_PROTOCOL_TCP;
  NewRule.LocalPorts := 4000; // Porta
  NewRule.Enabled := True;
  NewRule.Grouping := ''; // Grupo
  NewRule.Profiles := CurrentProfiles;
  NewRule.Action := NET_FW_ACTION_ALLOW;

  // Adiciona a nova regra
  RulesObject.Add(NewRule);
end;

begin
 try
    CoInitialize(nil);
    try
      AddApplicationRule;
    finally
      CoUninitialize;
    end;
 except
    on E:EOleException do
        Writeln(Format('EOleException %s %x', [E.Message,E.ErrorCode]));
    on E:Exception do
        Writeln(E.Classname, ':', E.Message);
 end;
 Writeln('Press Enter to exit');
 Readln;
end.

When opening the firewall advanced settings panel (type firewall.cpl in the windows run - on the left side click advanced settings ) the application will be present there.

I hope I did not escape the focus of the question. For more information on how to manipulate the firewall through the APIs see esse tópico no MSDN e aqui precisely in Delphi .

Update

From @Renan's answer, I was able to reproduce what he mentioned, I'm not sure if the antivirus will block or not , it follows the procedure AddInFirewall() modified ( tested not Windows 7):

procedure AddInFirewall(cApplicationName, cEntryName: string);
Var
  TShell: TShellExecuteInfo;
  cAppName: string;
begin
  if Trim(cApplicationName) = '' then
    cAppName := Application.ExeName
  else
    cAppName := cApplicationName;

  if Trim(cEntryName) = '' then
    cEntryName := ExtractFileName(cAppName);

  FillChar(TShell, sizeof(TShell), 0);
  TShell.cbSize := SizeOf(TShell);
  TShell.fMask := SEE_MASK_NOCLOSEPROCESS;
  TShell.Wnd := Application.Handle;
  TShell.lpVerb := Nil;
  TShell.nShow := SW_NORMAL; // Utilize SW_HIDE para esconder a janela
  TShell.lpFile := 'cmd.exe';
  TShell.lpParameters := PWideChar('/k netsh advfirewall firewall add rule name="' + cEntryName + '" dir=in action=allow program="' + cApplicationName + '" enable=yes');
  TShell.lpVerb := 'runas';

  ShellExecuteEx(@TShell);
  WaitForSingleObject(TShell.hProcess, INFINITE);
  CloseHandle(TShell.hProcess);

  ShowMessage('Procedimento concluido!');
end;

Call the procedure the same way you were doing, like this:

AddInFirewall(Application.ExeName, 'MeuServico');

When calling the function, we will create the process cmd.exe and pass as a parameter the command responsible for adding the application to the Firewall, a popup of the UAC will appear asking for confirmation to execute cmd.exe with elevated rights.

Through WaitForSingleObject we can only continue to use the application after cmd.exe has been finalized.

If everything goes well, we will see the command Prompt show something like this:

And finally, in the Advanced firewall settings panel: