WATCOM compiled programs leave VirtualSize to zero which triggers the virus check. Use SizeOfRawData instead.