False Positive from enterprise level anti-viruses

Sophos database
Runtime behavior alerts of this type inform the user that an attempt has been made to write an autorun file to an attached removable drive. Any attempt at this behavior by an unauthorized program could indicate a malware infection.

Please note that the behavior of some legitimate product installers can sometimes resemble that of malware.

I know the Platform allows you to rename the drive. The drive name is stored in the autorun file.

One of the methods Anti-Virus software utilizes in its scanning is to "dissect" executables in order to find out what "functions" it's runing.

Many of our launcher executables (ex: FirefoxPortable.exe) manipulate registry entries, redirect environment variables, and many other actions required to move personal data. Overall, the intention is good, but each function looked at individually represent actions a virus would typically execute.

As even high-end Anti-Virus can't efficiently manage a large database of known viruses, they often resort to this tactic in order to help identify new ones.

That explains why our base exe's come up in your scanner, but I'm afraid there isn't a very good solution other than reporting the file as a false positive and keeping your virus definitions/database up to date.