Hi DJ_Teach,
Based on your post I got in touch with Justin Comroe the chap that built the software (via the contact details on the website listed above) who was enthusiastic to help and very happy that the software was finding a use in Education. He has assured me that the software isn’t malicious in any way and is happy for anyone to submit the setup files and binaries to AV providers for analysis.
Basically, his reply was that he's not hugely surprised that the software triggers some heuristic scans through some AV software packages and generates false positives. The original setup file was created with InstallShield (produced by SetupFactory 8) and hasn't been touched since it was pushed out for Shareware review (where it was peer checked and found to be clean) in 2015.
He said:
“I do see that there's quite a few detections on VirusTotal right now, so you're absolutely right on that part. DisplayClone itself {and all other executables within} are packaged with "Obsidium" [for code-protection / activation], and do contain code-virtualization. Given there's code-signing cert on any of the binaries, I'd suspect that modern heuristics and to blame here coupled with the packing -- {e.g, that the software performs hook injection, uses low level hooks, web-access, window manipulation, shared memory,etc}.
For the sake of experimentation, I re-ran the unpacked (unprotected) binaries through VirusTotal. Seems that there's still some false positives on the loader processes, yet everything else in the clear with the exception of "SecureAge" on the TTS module (SpeechCore) and DisplayClone itself. Will look into this a bit more, could probably drop the software protection in future builds as we're no longer charging for the product.”
Justin also provided the attached zip-archive with the obfuscation-free test binaries that can be run/analysed individually.
“The more well known that the software is, the less false-positives that should exist as each company does their malware analysis.”
Justin is aware of this thread, so he might register and get involved himself. He’s said if there is enough interest he may rewrite/update the software too.
Zip/Hashes included below.
DisplayClone -- no obsidium.zip
--
SHA1 Size Name
1F19066DF22C5384AD9A427F508A1828C84E1E02 3732932 DisplayClone_Setup.exe
4B6B594BFAE7AE542EC4F9DC8BFC6C2D4FFB4043 4669361 DisplayClone -- no obsidium.zip