Hi have just installed it.
Installation proccess stopped by norton antivirus because a suspious.pithya trojan is detected on menus.dll file and in is-28mec.tmp file.
i've downloaded agein the setup file trough browser instead gog installer and the same message appear.
the third time i installed id nothing happen ( good) but during the game it stops and signal me a suspicious.pithya virus on file : menu .dll.
someone can explaim me this.
Gog support think a false positive but i'm not so sure ..

I have both Syberia and Syberia 2 installed and I can't find a "menu.dll" anywhere, be it while the game is running or while the game is installing.
Are you sure it comes with the installer and is not actually brought along by another app?
Could you give us the path to that "menu.dll"? File information (description, size, version...)

Game: Syberia
File: Syberia\dvd.dll

Sophos Anti-Virus 7.6.20: Sus/Cazcan-A
Virus Total:
ClamAV 0.96.2.0-git 2010.09.24 PUA.Packed.StarForce.CopyProtect.3XDLL
Sophos 4.58.0 2010.09.24 Sus/Cazcan-A

Game: Syberia 2
File: Syberia 2\dvd.dll

Sophos Anti-Virus 7.6.20: Sus/Cazcan-A
Virus Total:
ClamAV 0.96.2.0-git 2010.09.24 PUA.Packed.StarForce.CopyProtect.3XDLL
Sophos 4.58.0 2010.09.24 Sus/Cazcan-A

LOL Starforce is a pain in the backside but it's not a virus. Starforce is a form of DRM (copy protection) which obviously has been disabled to make the game DRM free, perhaps the method GOG is using to bypass it is being detected as a malicious action. I shouldn't worry as I'm pretty sure that's all it is.

Edit: To further explain it a bit; a lot of anti-viruses now offer a service whereby when the anti virus protection level is set to Medium+ it also searches out suspicious operations, and altered files that may be a virus not contained on the Anti virus's database, it's increased security but it's not literally detecting viruses, just possible viruses which you then need to verify or disregard.
For instance if you download things such as NoCD patches for games or Trainers for games, you'll get these pretty regularly as they are designed to alter code your pc deems protected. These detections are known as "False Positives." At the end of the day use your discretion, or throw the results in google and see if it comes up with anything (guessing it won't in this instance.)

Hope that Helps.