99+% of the code I write is for Word.

Most viri attack Word, n'est-ce pas?

I vaguely recall seing a problem using late binding in an Excel project I did for a Client, but I was able to code around it. Don't recall the details.

The worst case is releasing software that you know has no virus, but one of the AV programs claims it does. If it is a known named virus, then one can check the documentation to see what are some symptoms, but the worst case is a false positive based on heuristics, such as NAV's bloodhound. Unless the AV vendor supplies details, there's no way to know what to look for.

A number of false positives that I've seen went away after a few virus definition updates, but in the meantime, users suspect our code.

I'm not sure how the AV vendors handle such things. They are not going to reveal how their heuristics work and I sure won't reveal my source code.

I would ASSuME as the program's author, you are legally entitled to require them to tell you exactly what their software thinks it is finding? But dealing with the vendors, in practice, is likely to be quite difficult.

If I live long enough, I am hoping to release a shareware program.

In the documentation, I will point out that I have run the program under NAV version xyz using virus defitions as of a certain date, but there is no guarantee that other AV software, or even updates to the same AV software, will not produce false positives.