Both the gog-version of BGII and EasyTutu can be trusted. A long time ago, I was given a cracked copy of BGII that immediately was recognized as a threat by Norton (not the game itself, but the crack). I did not install or play that one, only ever played legal versions.

With trustable mods, there only has been an issue once with some earlier version of WeiDu (can't remember which one, it all got deleted) used by the RR mod (and maybe others too), that was falsely flagged as a threat. Very annoying, as I knew it too be trustworthy, but it kept getting deleted.

If you don't use a cracked version but got the gog-version, maybe you should contact the Gog technical staff. The way GOG removes DRM is (often) making use of cracks that were once developed by the hacking community. All malware should have been removed by GOG, but might it be some fingerprint trace is left?

In my time on the GOG-community, I can't remember ever encountering a game that still had malware in it, GOG is quite thorough in making sure the DRM-removal is done in a safe way.

Hope this is any help to you.