Over the years, I’ve used Windows from 3.0 to 10. I’ve used a variety
of AV programs, and would be inventing it I claimed I remembered which
ones I actually used. I’m pretty sure one of them was MalwareBytes.
I do understand that the threats to Windows are real, and am not
suggesting to ignore or minimize any warnings.
Whenever I got a positive hit, I searched for information on that hit
for that program. Not just a search for the AV program, or for the
virus/bug it said was present, but specifically for the file/program it
said was infected. How seriously I took any particular search result
saying that the hit was a false positive depended on where it was, and
how reliable I considered that site. For example, I tend to trust
forums and mailing lists of well known, open source projects more than
sites I never heard of. I also considered whether the posts tended
toward informative and well reasoned from experienced users, vs often
wrong advice from beginners who clearly didn’t know very much. My
opinions of that sort simply depended on my long history of having
browsed such sites. I started using Linux in the early 90’s, but for
various reasons was mainly stuck with Windows PCs, so I’ve been
compiling under Windows for a LONG time. Multiple, agreeing posts were
also more likely to convince me than a single first post from a new
user of that forum.
It also had to do with where I downloaded the program. If I got it
from some random Windows download site (which I rarely used) I would be
much more suspicious. If I downloaded it from the github site of a
known open source project, I was more likely to trust the source. I
know such sites can be compromised, but I don’t believe it happens very
often.
I don’t want to say anything against Kaspersky or other major AV
vendors, but they are commercial operations. I don’t claim to
understand their methods for detecting malware, but it’s obviously not
foolproof. In many cases, you could submit something their program
says is infected so they can evaluate it and either confirm infection
or modify their detection or add an exception. The problem is that
they are not likely to be interested in doing that for an obscure, low
use programs, which is what I suspect they consider most open source
projects. Yes, I do admit having an attitude about this.
On your specific mentions of Kaspersky and any specific virus they
claim to find, searching on the virus itself is not relevant. I do
believe the virus is real, and potentially very damaging to an infected
system. The question is whether that virus is truly present in the
file you want to use. Going back to your first post, you didn’t say
which packages were suspected of containing the malware and where you
downloaded them. You than mention gmp (which I believe IS necessary
for KMyMoney) but again, not where you downloaded it. More
specifically, if you are using msys2 packages, have you looked at their
site (https://www.msys2.org) and their page on getting help
(Support & Contact - MSYS2) ?
Sorry to be so long-winded, but by trying to compile KMyMoney on
Windows, you have entered an arena that still has lots of unknown paths
and alley ways, and no definitive best practices to follow.