Sfz-toolbox downloaded from official site!!! (http://www.soundbytes.de)
From this time I don't believe any small vendors.

[mod edit: Updated subject line so it's a question, not an accusation, since we don't know yet whether this is real malware or (far more likely) just another in a long line of false positives.]

How sure are you it's not a false positive? Common problem...
Ran it through several other online scanners to rule that out?

Neither MS Essentials nor Malwarebytes detect anything. As BertKoor says, false positives happen quite often. Maybe you should be more thorough before you start to imply that small vendors cannot be trusted.

Whoa there big fella! If you've never experienced a false positive then it's an understandable reaction. Let's try to be a bit more practical...

@krandr: what antivirus / antimalware program is giving the alarm? If folks here test the file with a variety of security programs and only yours detects malware then it's a false positive - a string of code in the file that resembles a known threat, but isn't dangerous.

First thing to do is contact soundbytes (be polite!)

Second thing to do (if it is a false positive, which it almost certainly is) is to follow the instructions from your antivirus supplier to send them the file - it'll be in the help document, or on their website. Then they can fix the problem and distribute the fix in a definitions update.

Simples!

Was checked on http://virustotal.com

Which antivirus program on virustotal gave the alarm? (you'll also need to tell soundbytes).

Edit: Ah, it's TheHacker antimalware. Anybody heard of them?

Have extracted the zip (I'm reckless, me!) and am checking eack file. I'm sure it's fine. One positive out of 43 doesn't ring any bells with me!

Hmmmmmm... sfz-toolbox.exe gives two positives (with superantispyware and thehacker). Maybe they share heuristics info, but who knows...

I'd shoot an email to soundbytes and the two antimalware companies giving them this information and see what they say.

Edit: It's probably a false positive, but the relevant people need to know - if only to stop other potential users from going through the same grief.

False positives are very common. Google "virus false positive site:kvraudio.com".

SynthEdit-based plugins have a long history of triggering false-positives.