Thanks for the reply. I found it easier to use SysInternals Process Explorer, find the reference to WinSparkle and deactivate it within the Windows registry. I wasn't able to modify the auto-update since I don't trust software that triggers anti-virus alerts and the "Modify" button was greyed in Windows "Apps & features" screen. I tried again by downloading the latest version and it seemed to no longer trigger the anti-virus, and I unchecked "Subscribe to product updates notifications" and "Check whether this is the most recent installer" - both which are confusing wording ("subscribe" is usually email-related, and when is it "checking" for the installer? once? every day?). It's unclear which of those stops the annoying recurring update notifications:
This is the most complicated update package of any software I've seen before. I saw your other comment about how you build it across multiple OS's, but as purchased software this really should be easier (and not a trigger of Microsoft's anti-virus). Thanks