This has already been resolved by jacob1 and others that TPT has no viruses.
nmd:
You know, TPT should have a public SHA256 checksum.
Not that it would really be needed, but it would be an (easy) added layer of reassurance.
Or even better, GPG-signed builds.
Some lua scripts can cause viruses actually.