In the end, I was able to get the latest version of nim (2.0.2), nimble, and koch. Recall that Windows defender (and various browsers) are not allowing the standard zip file from the Nim site to be downloaded. When I compiled Nim another way, the koch executable was deleted by Defender right after it was compiled, and the result didn't include nimble. Here's what worked in the end:
I ran a Linux VM and used it to download the Nim zip *for Windows* from the Nim site. I unzipped it *on the Linux VM*. I copied the unzipped tree from the VM to my Windows drive - I have a shared directory that lets me do this.
Then (on Windows) I ran the build-all script and it built the Nim 2.02 compiler. When it went on to try to build the koch executable, Defender deleted it as before. However, I was able to run the Nim compiler to create a nimble executable. Then I was able to run nimble install nim, which rebuilt nim but also succeeded in building koch, which this time Defender did not delete.
Apparently the spurious virus warning applies to the version of koch compiled by an earlier version of Nim, but not by the latest version.
Remember, you have to have installed the gcc compiler package, which you can get from the Nim GitHub site in the minGW distro. The reason is that earlier versions of Nim were compiled from c code (or maybe c++, I'm not sure). The newer versions can be compiled by the Nim compiler itself. You have to have a working Nim compiler before it can be used to build later versions of itself, and that's where the gcc compiler comes in.