**Edit: Just downloaded, Avira has scanned a few times, no findings. Ran it through virustotal, 12/54 reported a problem - thats high but not unheard of. Other ones all come back fine too. If your still worried, get a virtual image and copy it onto that.


Run the file through one of the online scanners:
https://www.virustotal.com

Its likely your AV picked up a false positive, it happens a fair bit. Even games I brought here I had problems downloading sometimes (Sherlock Holmes for instance always got auto removed).

ModDB is pretty trustworthy site, you wouldn't find any more so.

I can have a look later on when I get home, probably already got that file but don't know off the top of my head.

*Edit, I know your AV deletes it immediately, you can either exlcude a folder location from the scan (probably in settings, don't know what you use), or sometimes you can recover from quarentine (and if ok, ignore from future scans).

I do use Norton so do you suppose it's that?

Mod DB is a trustworthy site.

I already knew that but I got a bit of a scare when my AV found a "Trojan" in Keen 9. I think it might be false considering I use Norton and it's been wrong before, but I just want a definite second opinion that that particular download is safe.

I used Norton for a few years, was ok, but as with any av does have false positives. As mentioned avira says its fine and so do the majority of av's. Mods are usually more likely to be picked up, as they can, by design change other files. Av's really don't like programs which change other programs.

If you want peace of mind, there's plenty of free online virus scanners you can upload to.

You can also get something like Sandbox to run suspicious files in a virtual environment without actually writing data to the hard drive.

And false positives aren't exclusive to Norton, all AV will sometimes flag something harmless.

The item flagged in question in the Keen 9 zip file is called "unizexe.exe". Is this a necessary file for the mod or is it something else?

Norton might be flagging it because of its filename, some viruses and trojans use weird names, just upload the file to virus total but I am 99.999999999% sure the file is safe, sometimes perfectly legitmate files can be heuristically similar to viruses, since technically viruses are simply programs themselves.

Yep, most likely. that or the patching exe. Basically mods can do more than just add assets in, they might need to modify other exe or dll files in order to work. The unizexe you can see is called by one of the batch files and the patch program by the other batch file (right click edit on them to see exactly what they do - always a good idea). They call this exe or the patch one and apply some changes to the executables - probably, and just guessing - because the levels are hardcoded into the original. Thus if level1 is actually level_new_1, then you need to hack the exe to change the part that says load level1 and replace it with load level_new_1. AV software really takes a dim view on programs that modify other programs, quite rightly as that is hijacking the functionality, but in modding that is a normally a core requirement - mostly on older games. But even Oblivion and Skyrim have mods that either modify or extend the functionality of the original code.
Now, just run this on my machine, and it states:
usage: UNLZEXE packedfile [unpackedfile]
And it is doing this to the keen5e.exe file that you will need from Keen 5 program you will have brought. What it seems to do is unpack this exe.
A quick search of the forums gives this which is a release post for ckpatch (the other exex in this case) which states you need to unpack you exe with this tool first for the patching process to work.
http://keenmodding.org/viewtopic.php?t=975&postdays=0&postorder=asc&start=0&sid=1324b835b02ffc23f1e87d3a2f357909