So 35.2 and 36.1 appear to be infected by Trojan:Win32/Vigorf.A but versions 35.0 and 36.0 do not. Maybe false positive? Would it have something to do with how you sign your packages? Just odd that it appears only on patches.