thanks, I will run a full scan (it takes 13 hrs).
Post back after you run your full scan. Many people start that when they go to bed.
Koz
@Quantum - sorry, but what you’re suggesting is that the malware was contained inside the “audacity-2.4.2.zip” file.
No, that’s not what I’m suggesting at all. In fact, I’m not suggesting anything - As I said, I’m NOT a cyber expert and this is not a complaint 
Because that file was flagged as infected by Bitdefender TWICE yesterday, the moment I attempted to install AUdacity from the zip folder (twice), what I thought is that - somehow that file attached itself to the Audacity while it was “in transit”. Is it possible? I don’t know!
All I know is that this file was not on my computer before. I checked my Windows downloads - the only file I downloaded yesterday was Audacity.
I also wanted to check my browser history, and it was empty. My Firefox updated itself earlier today, and when I checked the settings - it was to clear all history when Firefox closes. That was NOT my setting as I like to keep the history, so Firefox has changed it. Since I had to reboot my computer twice today, the history was cleared.
I have scanned my computer with RogoueKiller today - there were only a few PUPs but no threats.
That infected file was disinfected by Bitdefender (it has earned its keeps!), then it was deleted, my computer is clean, I’ve got the current version of Audacity - all is well. I’m not pursuing anything! We may never know how this has happened - doesn’t matter.
In fact, I’m so happy with the new Audacity and grateful for all your wonderful work that I made a donation yesterday.
thank you
“Is it possible?” is not a good question.
“Is it possible that JFK was shot by a space alien from planet Zog?” Most people would be reluctant to say “it’s not possible”, even though there is no evidence to suggest that it is true, no evidence that space aliens from Zog have ever been to Earth, or even if planet Zog exists. The actual evidence overwhelmingly suggests that JFK was not shot by a space alien from planet Zog. Similarly, the actual evidence overwhelming suggests that the “mail[1].zip” trojan on your computer has nothing whatsoever to do with Audacity from FossHub.
My personal view (and I have worked in tech for a long time), is that I am 100% confident that the trojan did not come from FossHub.
Great. Fine. Thank you.
I’m NOT accusing Audacity or FossHub of creating infected files, I think I made this point very clear.
My question was rhetorical.
All is well in my world.
Super 
I’ll close this topic as “solved”.
For the benefit of others that may find this page in the future, I’ll give this link again for Audacity’s brief guide to safe downloads: https://www.audacityteam.org/download/online-safety-when-downloading/