Although it is on a server with an openstreetmap name, I don’t think it is part of the main openstreetmap project. Also the operators of that server are unlikely to read this forum. I’d therefore suggest contacting the operators of the server directly.
Note that some virus checkers are particularly bad at generating false positives.
So it looks like there is no consensus as to if the file contains real viruses or not. Saying “don’t trust a virus detector” is somehow not very satisfying nor smart, IMHO.