Anyone can pay a third-party Certificate Authority several hundred dollars to be able to sign their own binaries (executables). Viral or not. 99% of all AVs would not flag them because they're "signed". As for "safer" patch, hernycwo is right. That isn't how patches work. If you don't trust it, don't run it. Simple. Or you could literally follow the directions I mentioned several times throughout the thread to crack it yourself. Then you could be 100% sure and never have to download anything. Then you could compare the resulting binaries and see that I haven't done anything to them. (Timestamps will be different for obvious reasons.) Oh and just because "a patch works" doesn't mean they are safe, either. Remember WildTangent? Everyone loved that viral spyware. Fun games I was told, but totally spyware and worse. HP even pre-bundled them on their PCs in the mid-2000s.
I think I'll just teach some trusted member of the forum how to do this so I don't have to face this kind of stuff. Eh.