My AV flag this trojan: Trj/CI.A
I will not put my machine in risk. I prefer give up and ask for a full refund.

It's been proven false by GOG so there's really no issue, but if you're still worried you can still remove the files your anti-virus program think are infected. These files are only there for the level editor, so all 3 games will still work to play.

Windows Defender found "Trojan:Win32/Rundas!plock" in the setup file (2.0.0.15) downloaded from GOG about half an hour ago. Nothing found in the game files though.

see also: Viruses found during instalation

File: setup_rayman_forever_2.0.0.15.exe

Symantec doesn´t do anything, but says known as "bösartig"

GDATA Total Security 2017, actual Version from 2017.12.25, says:
(app)\RayKit\RAYRUN.EXE - Virus - Win32.Trojan.Agent.FPI8TH
(app)\RayKit\OSD\CLIENT.EXE - Virus - Win32.Trojan.Agent.3E7KG5 (Engine B)

I would like to hear something from a gog-official ...

PS: GDATA´s Software is based on Bitdefender

Full disclosure here: I am not a security researcher, what I say here might be complete rubbish. That aside, I've taken a look at this and it seems that the version of Rayman Mapper included in Rayman Forever (on GOG and on the original disc) does in fact contain code for the CIH virus. Most people won't need to worry about this, the virus does not have any effect on systems running XP and above, only Windows 9x and below. Additionally, I believe that while the code for CIH is in the executable, the executable has been fixed in some way meaning that the code will never run. Despite this, it is flagged by a number of antiviruses. GOG could fix this simply by using a version of the mapper that is not infected with CIH. These versions were released in multiple other Rayman CDs. If anyone at GOG is looking at this message, the uninfected and otherwise identical versions of the mapper (in English, French and German) can be found on the original "Rayman Designer" CD.