VirusTotal Alert?

Support
1

Operating system

Windows

Joplin version

3.7.16

What issue do you have?

Joplin 3.16.4.exe (Windows 11) displays a malware alert on VirusTotal (attached).

Is this a false alert? This is the first time I've ever seen a malware alert for Joplin on VirusTotal.

Screenshots

20260906-11.16.40-sha256 Joplin-Setup-3.7.16.exe (VirToT)-ShareX-zsqs9HNQoo.png
20260906-11.16.40-sha256 Joplin-Setup-3.7.16.exe (VirToT)-ShareX-zsqs9HNQoo.png1990×850 93.4 KB

2

Pasting error - I meant the latest Joplin version 3.7.16.exe (not 3.16.4).

3

Lumo.2 (Proton, Switzerland) reports the following:

This is very likely a false positive. Here's why the evidence lines up:

What the screenshot shows

  • File: Joplin-Setup-3.7.16.exe — the official Windows installer for Joplin, the well-known open-source note-taking app
  • 1/50 vendors flagged — only one engine (the Avira-engine heuristic TR/Crypt.XPACK.Gen2) out of fifty. The other 49, including the major engines (ESET, Kaspersky, Bitdefender, Microsoft, etc.), consider it clean
  • Tagged signed — the binary carries a digital signature
  • Aggregated threat label: trojan.gen2 — VirusTotal's aggregation here just echoes the single generic "gen2" hit; there's no specific malware family attribution anywhere

Why Joplin specifically trips this

Joplin is built on Electron and ships as an NSIS/Squirrel installer. Its installer (and many Electron-based apps) gets runtime-packing treatment that heuristics like Crypt.XPACK frequently misread as typical malware packing. The earlier search surfaced a Joplin Discourse thread titled "VirusTotal Alert?" describing exactly this scenario — a Joplin setup executable showing a malware flag on VirusTotal and the poster asking if it's a false alarm — so this is a recurring, community-known phenomenon with this software, not something unique to your file.

Practical checklist to close this out

  1. Verify the source — download only from the official site (joplinapp.org) or the GitHub releases page for the Joplin project.
  2. Check the signature on the VT Details tab (or right-click → Properties → Digital Signatures locally) to confirm it's signed by the legitimate publisher and the certificate is valid.
  3. Optional belt-and-braces: cross-check the SHA-256 against the hash published with the official GitHub release notes for 3.7.16, if listed.

Bottom line: 1/50, heuristic-only, signed, from a reputable open-source project, matching a documented false-alarm pattern — this is a textbook precautionary/heuristic false positive. It's reasonable to keep the installer. If you got it from anywhere other than the official site or its GitHub releases, re-download it from there and compare the hash before running.