Lucius, yeah, just seen that thread.
ThomasV, could you, please, write here in sticky thread MD5 / SHA-1 / signature of real Electrum 3.3.3 ?
Just verify the signatures.
Electrum is commonly acussed as a trojan by a few random AVs. But thats just a false-positive. It happens all the time.
Here is Electrums official explanation:
"Anti-virus" software uses shitty heuristics to detect malware. PyInstaller is a convenient tool to package python apps. We use PyInstaller. Malware authors use PyInstaller. Everything that uses PyInstaller is detected as malware.
Anti-virus software have (and always had) false positives, and some of them tag Electrum as malware. This is out of our control. This does not mean that Electrum is or contains malware.
The Windows binaries are signed using the native Windows signing scheme by an entity named Electrum Technologies GmbH. They are also signed using GPG by @ecdsa (ThomasV). The GPG key fingerprint is 6694D8DE7BE8EE5631BED9502BD5824B7F9470E6.
If you trust the developers of the project, you can verify the GPG signature, and ignore any anti-virus warnings.
If you don't trust the developers with not backdooring the binaries, you can (1) build binaries yourself; or (2) you can run from source. Some of the binaries are built reproducibly, so you can also check that those match.
More:
https://github.com/spesmilo/electrum/issues/3198#issuecomment-458949319