virustotal.com 4 engines rate the installer.exe as possible malware about jwlmerge

[AntonyCorbett]

@peter-altherr Hi Peter. Thanks for your message. It is an ongoing problem - as malware distributors become smarter at hiding malicious code in Win32 and .NET apps the AV suppliers introduce more cunning detection algorithms which add to the "false positive" rates. Generally large software companies can get around this by code-signing installers ($$) and submitting builds to AV suppliers. Also the more popular an application is, the quicker these are whitelisted by the AV companies. A small app like JwlMerge will always raise a few alerts on VirusTotal. It's not a commercial app, so I don't want to spend money on a code-signing cert nor do I have the time to submit builds to AV companies. I suppose there is some comfort in knowing that it is open-source - the code is available to anyone to inspect and build. Hope this helps.

[peter-altherr]

@AntonyCorbett hi antony, thank you very much for the comprehensive explanation. absolutely reasonable. as i do not develop software i do not know if there is free (in terms of money) code signing certs. so i will give it a try.