ok i can explain, i read the post from beginning and i found this links and if the virustotal in new version didnt find anything its mean nothing. you just encrypt it.
back to subject, you said this fork no fees, and i think you just convert the fees developer to you because the scren shot showing there is some fees going somewhere, anyway i don't care, take the fees for you just don't add malware and bad files
First - it was "encrypted" from the begining. Now some AV on virustotal even marks it as "hsrminer", if it tells you something.
Second - all that your screenshot is showing is that diff was low, then it became higher. I won't be like you and won't accuse you for lying - I can suppose that it's result of some bug in original hsrminer because it certainly have bugs as any software - I've already fixed atleast one of the palgin' bugs in -d option parsing. When I will have more free time I will try to repeat what you have described and hopefully fix this bug if it actually exists.
As for devfee, I will implement --donate option with next release, because several users already asked me about it.