Totally normal, almost all anti virus will detect miners as a virus, because there are people who sent miners to another people to have a lot of machines mining for them, without permission, like a malware.
But Claymore and Phoenix are realiable, they are here for a long time and every miner uses, another realible miners are NBminer, Gminer etc, it's simple to check here on BitcoinTalk and see what another people are saying about miners
You don't have to be so worried about this kind of stuff
You can check on https://whattomine.com/coins and see what's an estimate amount of coins you'll earn with the hashrate you have, but remember that almost all times you'll gain less coins because of the difficulty, internet connection, bad shares etc, Whattomine will calculate for you in a perfect situation
About the pools you can use reliable pools, I'll say again, use this forum to check if a pool is reliable or not, here: https://bitcointalk.org/index.php?board=199.0
And, as a side effect of pool mining, this isn't as decentralized as it should if top 3-4 mining pools have 50% of the network because again, they own the place and could team up for a 51% attack anytime.
Do you know how mining works? I suggest you to start with Nicehash to let the app mine for you, without worry about miner, pool etc, Nicehash will pay you in BTC every 4 hours, simple like that
And do your own research to learn more, with a single card, or a single rig for example, it doesn't worth to solo mining, you won't find any block of a good coin, and pool mining exists to let small miners get rewards too, not only big miners.
So if you think, pools are good to keep the mining process decentralized