You converted a clean script and Defender calls it a trojan. This is a known false-positive pattern for batch converters - here is why it happens and the professional, honest ways to fix it.
It is the most common shock after a first conversion: the script you wrote yourself, converted five minutes ago, gets flagged as a trojan by Windows Security. Before you panic or, worse, before you start searching for ways to dodge the scanner, read this page. The detection has a structural reason, confirming a false positive is straightforward, and the fixes that actually work are the honest ones - reporting, signing and reputation.
The reason is structural, and it is not your fault. A converted EXE drops a script file into the temp folder and executes it - and that is also exactly what a large family of real malware does. Antivirus engines cannot read your intentions; they see an unsigned, unknown program that extracts and runs a script, and their heuristics score it as suspicious. Microsoft and independent advisors confirm this is a known false-positive pattern for batch converters, and the converter itself collects several heuristic hits on VirusTotal even when empty scripts are compiled.
Add the invisible mode option or UPX compression and the score climbs further, because silent execution and packed files are also malware habits. None of this means your file is dangerous - it means it resembles dangerous files.
!ml style detections from many engines is typical for converters; a specific named trojan from many engines is a different storySubmit the false positive. Every major vendor has a false-positive report route - Microsoft accepts file submissions for analysis through its security intelligence portal, and other vendors do the same. A clean verdict after review fixes the problem properly, for everyone.
Sign your EXE. A code-signing certificate gives the file a verified publisher identity, and signed files build reputation. The professional command is signtool sign /fd SHA256 /a YourTool.exe. Signing costs money, which is why hobby scripts stay unsigned - but for tools you distribute widely, it is the real fix.
Build reputation honestly. Distributing from one stable page, keeping the same file name and publisher details, and filling in complete version information all help engines and SmartScreen treat your file as a known quantity over time.
Reduce heuristic triggers you do not need. If your script does not need invisible mode, ship it visible. If it does not need admin rights, drop the manifest. Every malware-like behaviour you remove lowers the score - legitimately.
Do not hunt for ways to evade or trick the scanner - obfuscating the script, splitting strings, encoding commands or packing repeatedly are malware techniques, and using them makes your file genuinely indistinguishable from malware. Do not tell users to disable their antivirus to run your tool; if a technician asked you to do that, you would refuse, and so will they. And do not add blanket folder exclusions on customer machines to make the warning go away - an exclusion you create today protects real malware tomorrow.
The short version: verify it is clean, report the false positive, sign what you distribute, and strip behaviours you do not need. Slow, boring, and it works.
The video covers the conversion itself; pair it with this page before you distribute any converted EXE to other machines.
Watch Full VideoThe BAT file is readable text that the scanner can inspect directly. The converted EXE extracts and runs that script at launch, which matches the behaviour pattern of real malware droppers, so heuristic engines flag the wrapper even when the script inside is completely clean.
On your own test machine a narrow exclusion for one signed file can be acceptable, but never create folder exclusions on customer machines and never ask users to disable their antivirus. The correct route is a false-positive submission to the vendor and, for widely distributed tools, code signing.
Not by itself. Converted batch files commonly collect a few heuristic detections out of seventy-plus engines. What matters is the pattern: vague heuristic or machine-learning labels are typical for converters, while many engines agreeing on one specific malware family means you should rebuild from a clean converter download and investigate.