I don't know. But maybe the detection is because a specific function, for example: CreateRemoteThread or LockResource. Or maybe is some sign in the pe file. I remember a executable with this problem. I solve it modify tccpe.c for use "This program must be run under Win32" instead "This program cannot be run in DOS mode" or moving the pe header from the offset 128 to offset 512.
Or because something is missing: For example, I added this foo function in some executables for avoid a false detection:
/*
This function is never called.
Is used for avoid AntiVir false detection: TR/Crypt.XPACK.Gen
*/
void nothing(void)
{
ExitProcess(0);
}
You have the dll for try found the cause of the detection?