This is ridiculous
The current release
is now flagged by no less than 35 Antivirus products! Most of the hits are "generic/malware/suspect/PUA/variant/etc", but there's a few there accusing it of being a Trojan or CoinMiner. Symantec claims "high confidence"
I recompiled the current code with just a change from v3.3 to v3.3.1 - suddenly only 16
detect something.
Then I removed the AutoUpgrade checks, the Google Analytics and the Sound effects downloader - still,
10 hits, but now most of them are the same "variant.bulz" which apparently means they think the app is bundling some component/app inside it (it's not)
Lastly, I added a digital signature to the .EXE (self-signed, as a proper one is paid) - and it's
down to 8, including BitDefender (this tells you how "good" it is - it's the only big name in that list, but is apparently using the same crappy DB as those other unknown ones)
No matter what I do I can't get it to go lower than this. The problem is that these AVs use heuristics (probability) to flag some application, and once they add it to their databases it's extremely hard to remove, because they just add a very small snippet of the EXE (16 bytes or so) and then flag any future EXE that has that same signature/sequence of bytes. So I would need a full rewrite of the app to get out of their idiotic DB. Or, I would need to contact each one to ask them to review the application, complaining about the false positive.
I'm really not willing to do that. The source code is published - anyone can just pull it, inspect it, and compile from source (I know not everyone can do that, but that's the premise of open source - *some* people will do that).
I also cannot ask you to trust some random stranger on the internet. If you are comfortable enough with that, just add an exception on your AV to ZRatrings.EXE. But it's your call.
What I usually do is disable the flagging of "Potentially Unwanted Applications" (PUA) - most AVs have an option for this. PUAs are anything that is not really dangerous, but unwanted mostly in an enterprise setting; think Password Recovery apps, apps that make funny sounds (joke apps), etc - these are usually fine at home.
Here's some info on "bundled apps" PUA - these guys flag an app as PUA just because the developer is distributing it as a single EXE...
https://www.f-secure.com/sw-desc/application_bundler.shtml