The bundle is flagged as trojan by security vendors

[MarioLeung]

I'm not sure this is a bug or not. So I post it as discussion.

I try to build a bundle, which download and install 4 libraries when run as my program prerequisite: Visual C++ Redistributable, .Net 6.0 Desktop runtime, .Net 6.0 ASP runtime, and Access Database Engine 2016
Example code as shown in here: https://github.com/MarioLeung/testBundle

I build the project in release x64. Everything is fine until my client submits my program to security check.
This is the result: https://www.virustotal.com/gui/file/9bee5e5fbee331f4de630848975c398268acb62e3ba4e825e8586950ec037539/detection

My program is flagged as trojan by four Security vendors: AhnLab-V3, Bkav Pro, Elastic, and Zillya

My client is now asking why my program is a trojan. But the code are all from WixToolset (4.0.5).

My question is:

1. Is the Security vendors' result false positive? How do I prove that?
2. If it is not false positive, how can I tune my program so that my program is not flagged as trojan? Should I remove any prerequisite installation?

[robmen]

1. Depends. Does your bundle have a virus in it? Did you sign it after scanning it with antivirus tools to ensure it wasn't infected during your build process? These are only questions you can answer.
2. Sign it. If still flagged, submit it to the appropriate antivirus vendors as a false positive. If they agree, they update their signatures.