Antivirus and allow lists
Some antivirus products flag any remote control tool, whoever makes it. This page lists exactly what to allow so the Helios agent and its remote access install cleanly.
Do you need to do anything?
Usually not. Microsoft Defender does not flag the Helios installer (checked 13 October 2026). Add an allow rule only if your antivirus warns about Helios, blocks the install, or removes remote access after it is installed.
If remote access is blocked on a machine, your dashboard says so in a card named Remote access blocked or removed. Monitoring, patching and scripts on that machine keep working.
Why it gets flagged
Helios installs two programs on Windows: its own agent, and a remote access component based on the open-source MeshCentral agent. Antivirus products often label remote access software as a "potentially unwanted application" or "remote admin tool". That is a label for the kind of software it is, because criminals misuse the same kind. It is not a finding that the file is malware.
Best: allow the publisher
Every Helios file for Windows is code-signed. If your antivirus can allow by publisher or certificate, use that. It keeps working when Helios updates, and it does not leave a folder unscanned.
| Signed by | Nexborne Ltd |
|---|---|
| Applies to | The installer, the agent and the remote access component |
Otherwise: allow these folders
| Folder | What is in it |
|---|---|
C:\Program Files\Helios Agent | The agent, and the remote access installer it carries |
C:\Program Files\Mesh Agent | Remote access, once it is switched on |
C:\ProgramData\MSPAgent | The agent's settings, logs and downloads |
C:\Program Files\MSPAgent | Older installs only |
Programs and services
| Program | Windows service | What it does |
|---|---|---|
MSPAgent.exe | MSPAgent (shown as Helios Monitoring Agent) | Monitoring, patching and scripts |
MeshAgent.exe | Mesh Agent | Remote access |
Addresses the agent talks to
The agent makes outbound connections only, over HTTPS on port 443.
| Address | Used for |
|---|---|
app.heliosmsp.io | Check-ins, commands and updates |
connect.heliosmsp.io | Remote access sessions |
If something was already quarantined
- In the antivirus, restore anything named
MeshAgentorMSPAgentfrom quarantine. - Add the allow rule above.
- Open the device in Helios and turn remote access on again from its page.
What we do on our side
Every day we check what antivirus vendors say about our Windows installers, and we report false positives to the vendor when one appears. When someone connects to a Windows computer through Helios, that computer shows a notice and a bar on screen for the whole session.
Blocked by a product not covered here? Email support@heliosmsp.io with the product name and what it said.