Re: Avira false detection
I suspect it's a combination of the fact that:
* MMF2 generated executables are executables with data appended to the end (that isn't in the EXE header)
* The data that's appended includes ZLIB compressed extensions, which are extracted at runtime
It's pretty common for a virus to hide code in an EXE in this exact way, so it's not surprising MMF2 EXEs keep getting picked up.
It's a bit concerning that certain antiviruses seem to have viruses actually called things like "win32/Adware.Clickteam". I suspect Install Creator's wide usage is to blame for this.