According to virustotal, 9 of 69 scanners flag this file as malicious.
On my system, this was reportet by Windows defender.

This needs to be fixed. Even if it is an false positive, this will be reported on nearly al Windows-PCs.
I will not add exceptions to security software, this should never be necessary for commercial software!

It got detected and removed by my copy of Norton 360, too.

This has been covered in the other thread in this forum - https://www.gog.com/forum/demonicon/app_data_exe_positive_in_malwarebytes - GOG says the file is safe, it is just a false positive and as such won't be fixing it. They suggest that it is down to the user to "report this false positive to the anti-virus software manufacturer customer service" so that it is no longer flagged.

`

My point is that 9 venndors of security software including flag the file is malicious. Thats the point of Virustotal: If only one or two scaners report this file as positive, I might treat this al false positive.

But 9? Seriously?

You have to admit, this is at least fishy, and something needs to be done. By GOG. You cannot expect your customers to write to 9 different companies, right?
I hope, GOG is not treating a potential security issue for their customers simply by denying any danger?

At the very least it is very inconvinient for your customers, that Windows defender triggers, since this software is included in a default windows 10 installation.

I do agree with what you're saying but according to GOG "if the results are inconsistent (as in, different scanners show different results), this practically proves that it's a false positive." (My highlight). The trouble is that the 9 results are all different which does strongly suggest that it is indeed a false positive but it is a worry that GOG doesn't categorically say that the file is 100% clean. For what it's worth I think it is but GOG do need to do more about problems like this. Like you say, it really shouldn't be down to the customer to report this to the anti-virus manufacturer.

In my experience with false positives, most times there is just one scanner, which reports such a file. I had this issue a few times with some odd tools for electronics

On the other hand: I reportet a new screen locker virus to Avira, and it took a whole week, for just 10% of all scanners on virustotal to recognize this file. The companies seem to share signatures, but slowly. Which is why I dont buy security software anymore, its more or less pointless.

If virustotal has 9 positives, its a very bad sign.

To be clear: I dont claim, that gog intentionally ships infected files, or that they dont care about customer safety. But gog has a lot of games which they receive from a lot of different vendors. Its just a matter of time, until one of them makes a mistake. If the virus is not recognized by the tools gog uses, then thats it.

I will wait a few days for an update, but if nothing happens, I will ask for a refund. The first time in my case.