WATCOM compiled programs leave VirtualSize to zero which triggers the
virus check. Use SizeOfRawData instead.

diff --git a/loader/pe_image.c b/loader/pe_image.c
index 3b025b5..8775c1f 100644
--- a/loader/pe_image.c
+++ b/loader/pe_image.c
@@ -521,7 +521,7 @@
         {
             if (nt->OptionalHeader.AddressOfEntryPoint < sec->VirtualAddress)
                 continue;
-            if (nt->OptionalHeader.AddressOfEntryPoint < sec->VirtualAddress+sec->Misc.VirtualSize)
+            if (nt->OptionalHeader.AddressOfEntryPoint < sec->VirtualAddress+sec->SizeOfRawData)
                 break;
         }
         if (i == nt->FileHeader.NumberOfSections)