Regarding the DLL getting flagged, we figured it out, and the reason is kind of crazy: it was a code comment!
First off, the DLL itself getting flagged is a new one for us. We've had our installer get flagged, and the reason is always due to some change in how our installations are built using our Build tool. Nothing nefarious, just a change that various antivirus vendors don’t understand.
For this instance, we started digging through the code because nothing had really changed between builds that we could figure would raise any concern. Then, we checked the modifications we made to the documentation of our APIs, and go figure, it was a comment in text that was causing it to be flagged.
So, one code comment flagged the DLL. Kind of amazing. Just one more example of the difficulties we, and other software companies, face when delivering products. Virus scanners intermittently think there's a Trojan or virus in the product, but when it comes down to it, it's just a line of text.
We have modified the text to be slightly different, but we get the same message across to those using our APIs and documentation. We'll have a new Bulid this week with that change, and maybe a few other minor fixes.
Hope this helps alleviate any concerns and further supports our comments from time to time when our installers and/or builds get flagged. It’s becoming more and more common for us to need to work with various antivirus vendors and help them adjust their signatures and/or modify something on our end to work around it, like we did in this case.
EDIT: here's what VirusTotal now shows on a scan of the DLL
