I doubt that a 16k file with an OS in it manages to accommodate a virus too. It's probably heuristics, AV software is very picky about stuff that does booting

I doubt that a 16k file with an OS in it manages to accommodate a virus too. It's probably heuristics, AV software is very picky about stuff that does booting a system or have very optimized code. You see this kind of alert in the demo scene quite often too, because AV also don't like their packing algorithms.