# Trojan detected

**URL:** <https://discourse.joplinapp.org/t/trojan-detected/51149>\
**Category:** Support\
**Created:** [4 October 2026 08:31 UTC](https://discourse.joplinapp.org/t/trojan-detected/51149 "2026-10-04T08:31:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![marcel.benhur](https://avatars.discourse-cdn.com/v4/letter/m/278dde/32.png) [@marcel.benhur](https://discourse.joplinapp.org/u/marcel.benhur)\
**Post date:** [4 October 2026 08:31 UTC](https://discourse.joplinapp.org/t/trojan-detected/51149/1 "2026-10-04T08:31:50Z")

</div>

### Operating system

Linux

### Joplin version

3.7.21

### Sync target

OneDrive

### What issue do you have?

I download the last appimage 3.7.21.  
despite the fact I'm on linux, Microsoft antivir (via Virustotal) found the Trojan:Script/Wacatac.B!ml.  
Maybe it's a fake detection ?

---

<div class="post-metadata">

**Author:** ![marcel.benhur](https://avatars.discourse-cdn.com/v4/letter/m/278dde/32.png) [@marcel.benhur](https://discourse.joplinapp.org/u/marcel.benhur)\
**Post date:** [4 October 2026 09:02 UTC](https://discourse.joplinapp.org/t/trojan-detected/51149/2 "2026-10-04T09:02:14Z")

</div>

to go further, where find pgp signature of the file appimage?

regards

---

<div class="post-metadata">

**Author:** ![LeoW](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/leow/32/22171_2.png) [@LeoW](https://discourse.joplinapp.org/u/LeoW)\
**Post date:** [4 October 2026 09:07 UTC](https://discourse.joplinapp.org/t/trojan-detected/51149/3 "2026-10-04T09:07:09Z")

</div>

Hi, it is almost certainly a false positive.

Personally I wouldn't worry about Microsoft flagging a Linux app as a virus. None of the other virus scanners found anything at all.

---

<div class="post-metadata">

**Author:** ![dpoulton](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/dpoulton/32/29723_2.png) [@dpoulton](https://discourse.joplinapp.org/u/dpoulton)\
**Post date:** [4 October 2026 09:36 UTC](https://discourse.joplinapp.org/t/trojan-detected/51149/4 "2026-10-04T09:36:10Z")

</div>

> [@marcel.benhur](#):
>
> ... where find pgp signature of the file appimage?

There isn't a GPG signature file but the [releases section on GitHub for v3.7.21](https://github.com/laurent22/joplin/releases/tag/v3.7.21) does include SHA256 and SHA512 hashes of the AppImage.

![image](https://canada1.discourse-cdn.com/flex028/uploads/cozic/original/3X/c/2/c27f965c18d54120da7afa9a65bb16f0b8ceea80.png)

---

<div class="post-metadata">

**Author:** ![LeoW](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/leow/32/22171_2.png) [@LeoW](https://discourse.joplinapp.org/u/LeoW)\
**Post date:** [4 October 2026 09:59 UTC](https://discourse.joplinapp.org/t/trojan-detected/51149/5 "2026-10-04T09:59:25Z")

</div>

Here are the results from my search on ChatGPT Plus. It explains exactly how to verify the file that you downloaded is exactly the same as the published file and it is an explanation to be used on Linux.

> **[Check out this chat](https://chatgpt.com/share/6ac22296-88b0-83ea-87aa-a2fcfc842a60?ogimg=plain)**
>
> Here's a chat someone thought you'd want to see.