The problem isn't anything you did. It's your AV vendor.
UPX is often used, and unfortunately, some of the users have nefarious purposes -- meaning that AV software will tend to group
your innocent application in with the (relatively few) bad applications made with UPX.
You have about three options:
1) Package with a different version of UPX. (Not a guaranteed solution.)
2) Submit your UPXed application to your AV software vendor as a false positive.
3) Don't use UPX.
Frankly, unless you have some serious space considerations, you should choose option 3. There is really not much need to package with UPX.
Once you are done, try
https://www.virustotal.com/ to see what AV software will incorrectly flag your software as infected, and make sure to submit false positive reports to those AV vendors.
Hope this helps!