I'm trying to update one of my CDLCs with lyrics But virustotal and malwarebytes tells me the one from Sourceforge contains a Trojan and other nasty stuff, (i don't know if its true but I'm not risking it) and there's no other place to download it besides other dodgy sites on the second page of google, so I'm kinda lost here on what to do.

Take a look at all of the discussion about antivirus false positives on the forum. Same concept here. Only 3 out of 60 antivirus solutions actually think it's a virus:

https://www.virustotal.com/en/file/4b89a1d29d3423508e59489ed20b0e82a3dff77b59d81407728d4f4901df82a5/analysis/

 

So is it malware? Probably not, but take any precautions you feel necessary, such as not running it with Administrator privileges. During installation, if it offers to install any other software, it's up to you to decline them as desired.

This is the problem with Virus Total. You gotta really look at what it says and not just the scary red text.

Only 1 of the 3 AVs that detected something actually gave it a name. Google the name, one of the results says "Microsoft detects this."

Scroll down that Virus Total list, notice Microsoft didn't detect that trojan... Therefore, Baidu is paranoid BS.