Your AV is detecting "TR/Hijacker.Gen", I'm guessing "Gen" is short for "Generic" and I don't know what "TR/" means. Describing the mod as a hijacker is accurate, I would just object to the word's negative connotations. The mod works by packing additional code into the Civ executable then modifying it so that it runs the injected code instead of, or in addition to, its own. This is called hijacking and it's a technique sometimes used by viruses, for example they could try to hide by writing themselves into a base Windows program so that they don't appear in task manager. The mod uses this technique but not for nefarious purposes, and there's nothing I can do to fix this because it's the only way to implement a mod of this kind. And if you don't trust me, the mod is fully open source. You can read INSTALL.bat and ep.c (which is what gets compiled to produce temp.exe) with any text editor.