Your script is clean, your intentions are clean - and the antivirus still flags the EXE. That is not a bug in your tool or in the scanner. A new, unsigned program carrying encoded text it executes genuinely resembles malware delivery. Here is why it happens and the fixes that respect the system instead of fighting it.
Every admin who ships a first converted tool meets the same rude surprise: Windows protected your PC, on a file they wrote themselves that morning. The instinct is to be offended. The professional response is to understand the scanner's reasoning - because your users cannot and should not have to - and to fix the file's identity properly.
Put yourself in the antivirus's seat. A brand-new program it has never seen, written by nobody it knows, appears on a PC - and inside it is a blob of encoded text that the program decodes and executes. That is also an exact description of how a lot of real malware is delivered. The scanner is not broken and it is not accusing your script of anything specific; it is reacting to a shape it has learned to distrust.
Two systems pile on. Heuristic detection flags the wrapper behaviour, and SmartScreen flags the file for having no reputation - no history of safe downloads by other users. Both calm down the same way: with time, consistency and identity.
Never tell users to disable their antivirus, add a blanket exclusion for a folder, or click through warnings as a standing instruction. The day you train people to ignore those screens is the day a real malicious file walks through the same open door - wearing your tool's name, possibly. If your converted tool cannot survive the organisation's security controls, that is a conversation with the security team, not a workaround to hand out quietly.
Also never download a "clean" or "undetected" version of a converter from a random site. The converters themselves are favourite bait for exactly the malware your scanner is worried about - get PS2EXE from the PowerShell Gallery only.
Even doing everything right, a first release may still show a SmartScreen prompt until reputation builds. Warn your users in advance, in writing: "the first time, Windows may ask - here is the exact screen, and here is the More info, Run anyway choice for this one file." One warned user is calm. Fifty unwarned users are fifty tickets and one rumour that you sent a virus.
And test on a machine with the same antivirus your users run, before they do. Discovering the flag yourself is a task; discovering it through them is an incident.
Watch the video for the build - this page covers the part that happens after the build, when real PCs react.
Watch Full VideoPartly. SmartScreen reputation builds as more people run the same file without incident, and scanners learn the wrapper over time. But reputation attaches weakly to unsigned files and resets when the file changes, so the warning often returns with each new version. A code-signing certificate is what makes the trust stick.
The deletion is about the wrapper's shape and the file's lack of reputation, not about your script's contents being judged malicious line by line. Prove it to yourself: scan the plain .ps1 (it will pass), then work through the honest fixes - version details, signing, vendor false-positive submission - rather than hunting for a converter that promises to be undetected.
No. Undetectability is a selling point aimed at malware authors, and tools marketed that way are frequently malicious themselves. The legitimate path is the opposite of hiding: a named, signed, consistently distributed file that scanners can build trust in.