Application signing/verification
Unfortunatley, yes, you do need to pay money.
What you need is a code signing certificate. You can get them from the below certificate authorities:Thawte
Or if you are looking for a cheap one, I would buy one from here, that is where I got mine:Tucows
Once you get your cert, you can integrate it into the build process to sign your application and it will show your name as the publisher.
This is known as code signing. If you want to generate your own certificate just for you, you can follow the instructions in this answer.
As Eaton suggests, you'll have to pay if you want one for public use. I recently purchased one for our BuildMaster software from http://www.instantssl.com/code-signing/index.html for 2 years at about $340.
Response to comment:
If I generated my own certificate, how would it work for me but not for everyone else (publicly)?
Steps 1 and 2 in the linked answer create a self-signed Certificate Authority (CA) and then add it to your Windows Certificate Store. Step 3 then generates the code signing certificate and specifies the issuing CA (the -ic switch). Since the issuer is a CA that was created in step 1 and then set to manually be trusted by you in step 2, the code signing certificate generated in step 3 appears to be signed by a trusted party on your machine.
There is no way it can be trusted by the public because you both generated the code signing certificate and the authority used to verify that its creator is actually who he says he is. Imagine if you were evil and put fake info in the code signing certificate that says the signer is Microsoft.com instead of Aaron! All certificates would useless if there was no trusted authority to verify the actual identity of signer.
When you order the certificate from a trusted CA, they'll verify your identity in some way. They'll probably ask for a scanned copy of your driver's license if it's for signing as your name, or something only the business owner would have like the articles of incorporation (we used our D&B D-U-N-S number to verify Inedo).
Once they have verified your or your company's identity, they'll send you a certificate that is trusted by typical web browsers that you can use to sign your executables and the public can be assured that it's actually you signing them because the CA would be whichever company you bought the certificate from. If you look in the Options section of your favorite web browser you can see which CAs are deemed trusted.
Beside bought certificates as @Eaton explained and selfcreated selfsigned certificates as @John Rasch suggested
you can try free comunitee-based certificates from http://cacert.org that works simmilar to pgp/gpg-s trustsystem. For codesigning you need a trust resumee of at least 100 points.
German users can also use free http://web.de certificates that also permits codesigning.
The drawback of this approach (as well as self-created certs) is that "verified" is only activ, if the operating system of the executing client has installed the root certificate of the signing agency which in 99% is not the case.
However Firefox knows cacert.org so certs from cacert can be used for https, java and silverlight but not for standard msie without installing the root certificate.