# Joplin 3.7.16 TR/Crypt.XPACK.Gen2 detected

**URL:** <https://discourse.joplinapp.org/t/joplin-3-7-16-tr-crypt-xpack-gen2-detected/50871>\
**Category:** Support\
**Created:** [8 September 2026 07:56 UTC](https://discourse.joplinapp.org/t/joplin-3-7-16-tr-crypt-xpack-gen2-detected/50871 "2026-09-08T07:56:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![srx](https://avatars.discourse-cdn.com/v4/letter/s/e36b37/32.png) [@srx](https://discourse.joplinapp.org/u/srx)\
**Post date:** [8 September 2026 07:56 UTC](https://discourse.joplinapp.org/t/joplin-3-7-16-tr-crypt-xpack-gen2-detected/50871/1 "2026-09-08T07:56:54Z")

</div>

### Operating system

Windows

### Joplin version

3.7.16

### Sync target

File system

### What issue do you have?

Hello,  
I just downloaded the setup file for version 3.7.16. My regular virus scan (Avira, just updated) reported that "TR/Crypt.XPACK.Gen2" was found within that file. According to the avira website, that this indicates a trojan horse.  
The previous version 3.6.16 did not return any negative feedback when scanned with the same scanner (also repeated today with the updated version).

### Screenshots

 ![Screenshot 2026-09-08 095621.png](https://canada1.discourse-cdn.com/flex028/uploads/cozic/original/3X/2/9/297a319e33b0a032e02cbc2e43db685fb419e281.png)

---

<div class="post-metadata">

**Author:** ![Pizza](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/pizza/32/30152_2.png) [@Pizza](https://discourse.joplinapp.org/u/Pizza)\
**Post date:** [8 September 2026 14:29 UTC](https://discourse.joplinapp.org/t/joplin-3-7-16-tr-crypt-xpack-gen2-detected/50871/2 "2026-09-08T14:29:39Z")

</div>

Bitdefender didn't seem to return anything, neither did virustotal, and my understanding with that particular result is that it just means "this looks strange and I can't see inside."  
It might be Joplin is using some sort of obfuscation within their installer.  
Would be great if a dev could respond, though.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex028/uploads/cozic/original/3X/1/c/1c948e33314e232a0927789508474d8624f4270b.png) [@system](https://discourse.joplinapp.org/u/system)\
**Post date:** [8 October 2026 14:29 UTC](https://discourse.joplinapp.org/t/joplin-3-7-16-tr-crypt-xpack-gen2-detected/50871/3 "2026-10-08T14:29:54Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.