Support

McAfee is known to falsely report innocuous PHP software as malicious. Same goes for Avast (also AVG and Norton which share the same engine as Avast). I can tell you what they report as a problem, too: the PostgreSQL backup engine which has to run pgdump through the shell since PostgreSQL, unlike MySQL, does not have a native DDL export accessible through standard SQL and implementing it from scratch would be a fool's errand as the SQL necessary and parsing its results is PostgreSQL-version-specific.

The SHA-512 sums of all our software is of course published on our CDN, in the same update XML file Joomla reads. In fact, Joomla checks it before installing an update.

The recommended safe procedure for handling this detection is to use an antivirus which works without too many false positives and false negatives. You may laugh at this, but Windows Defender is actually good. The whole point of it existing is that Microsoft got tired of Windows getting a bad reputation either from viruses / malware or misbehaving antivirus applications, so they spent real money (gasp!) and actual engineering effort (GASP!) to create a security tool which works very well and doesn't suck. I know, it's hard to believe that anything good has ever come out of Redmond, but in this case it's true. I guess it's the exception that validates the rule?