Determining the root cause for this can be very difficult. The ultimate determination of the root cause would have to be made by the companies who maintain the virus scanners in question. However, I can provide some guesses that might provide you some leads. I would advise you however, not to assume that any of these guesses are accurate, without verifying with the virus scanner vendors first.
- It may be that you are distributing and using a utility program that has been flagged as suspicious because it has been used by virus authors in the past. For example, certain open source programs that are part of a Cygwin or MinGW environment may be flagged by WebRoot, even though the programs by themselves are not malicious unless used in a malicious way by other code. Examples I've seen include
- Certain virus scanners use the cloud, plus community feedback from regular users, to automatically detect potentially malicious downloads. This can involve (a) users manually "flagging" the download as something they think might be malicious; (b) the software itself automatically determining that the user received a virus shortly after downloading your software; (c) the combination of your domain name and the executable name or contents triggering some type of filter or heuristic algorithm.
- It could just be a simple false positive, where it was manually or automatically determined to be potentially malicious.
In all cases, determination of the root cause should be done by the virus scanner vendor. We can't tell, from the outside, what the actual problem is.
To actually resolve the problem and to stop this from happening, the easiest thing to do is to ask the virus scanner vendors (each of them, individually) to please manually check out your download and/or your corporate reputation in order to determine that (a) your company website is a reputable vendor of legitimate software and (b) the downloads you are offering are not, in fact, malicious in any way.
Most virus scanner vendors have a way to report false positives on their website, or through the scanner program itself. You can continually test this and monitor the situation by setting up virtual machines or cheap test boxes and install a potpourri of virus scanners and check the download on a weekly or daily basis.