Don’t trust to products with a dubious reputation
Although it is on a server with an openstreetmap name, I don’t think it is part of the main openstreetmap project. Also the operators of that server are unlikely to read this forum. I’d therefore suggest contacting the operators of the server directly.
Note that some virus checkers are particularly bad at generating false positives.
@hadw This forum is the long-established place to get support for garmin.openstreetmap.nl (indeed, they were both founded by the same person).
So it looks like there is no consensus as to if the file contains real viruses or not. Saying “don’t trust a virus detector” is somehow not very satisfying nor smart, IMHO.
The only way to know for sure is to contact the maker of your virus scanner, like this guy did for Norton: https://forum.openstreetmap.org/viewtopic.php?id=53602