It looks like our CNET account has been compromised and someone has uploaded installer which is not ours. I don’t really check these things as CNET brings less than 1% of our downloads but still.
I have resubmitted our installer. I still don’t think someone else’s installer would contain any virus as CNET check for these things (they have that 100% virus free guarantee or similar) but 3rd-party software which we have no control over was definitely bundled.
To be safe, you can’t really trust download sites on the Internet even if it’s CNET. Always download software packages from official website of software vendor.
As for the negative review, there is nothing that can be done. CNET has a policy to never delete any reviews no matter what.