Best practices to avoid having legit program being flagged by virus scanners?

I'm creating an app for SecureCoop.com, no malware, but Microsoft antivirus keeps flagging my installer as malware. First Trojan:Win32/Wacatac.B!ml then Backdoor:Win32/Bladabindi!ml.

I can't be unnecessarily scaring my users. What are the best practices to avoid this happening?

My app consists of a systray executable and I will also soon be adding a system service. The systray .exe monitors the service and reports to the user on failure. I had placed a shortcut in $SMSTARTUP, and I wondered if that is cause it to flag as abnormal behavior. If this is not the recommended action for a systray, please share a better solution.

The app is written in Python then compiled to .exe with pyinstaller.

I think I will pursue Comodo code signing. What else?

Forgot to mention: My systray .exe has a built-in Bottle.py tiny web server, which could also be causing it to flag.

If only I could edit my posts here...