# VirusTotal Alert?

**URL:** <https://discourse.joplinapp.org/t/virustotal-alert/50847>\
**Category:** Support\
**Created:** [6 September 2026 15:54 UTC](https://discourse.joplinapp.org/t/virustotal-alert/50847 "2026-09-06T15:54:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jobel.2026](https://avatars.discourse-cdn.com/v4/letter/j/a4c791/32.png) [@jobel.2026](https://discourse.joplinapp.org/u/jobel.2026)\
**Post date:** [6 September 2026 15:54 UTC](https://discourse.joplinapp.org/t/virustotal-alert/50847/1 "2026-09-06T15:54:31Z")

</div>

### Operating system

Windows

### Joplin version

3.7.16

### What issue do you have?

Joplin 3.16.4.exe (Windows 11) displays a malware alert on VirusTotal (attached).

Is this a false alert? This is the first time I've ever seen a malware alert for Joplin on VirusTotal.

### Screenshots

 ![20260906-11.16.40-sha256 Joplin-Setup-3.7.16.exe (VirToT)-ShareX-zsqs9HNQoo.png](https://canada1.discourse-cdn.com/flex028/uploads/cozic/original/3X/9/f/9f2b7c4fd399db4106dcbf47e474918135559a2d.png)

---

<div class="post-metadata">

**Author:** ![jobel.2026](https://avatars.discourse-cdn.com/v4/letter/j/a4c791/32.png) [@jobel.2026](https://discourse.joplinapp.org/u/jobel.2026)\
**Post date:** [6 September 2026 16:00 UTC](https://discourse.joplinapp.org/t/virustotal-alert/50847/2 "2026-09-06T16:00:14Z")

</div>

Pasting error - I meant the latest Joplin version 3.7.16.exe (not 3.16.4).

---

<div class="post-metadata">

**Author:** ![jobel.2026](https://avatars.discourse-cdn.com/v4/letter/j/a4c791/32.png) [@jobel.2026](https://discourse.joplinapp.org/u/jobel.2026)\
**Post date:** [6 September 2026 19:48 UTC](https://discourse.joplinapp.org/t/virustotal-alert/50847/3 "2026-09-06T19:48:28Z")

</div>

Lumo.2 (Proton, Switzerland) reports the following:

This is very likely a **false positive**. Here's why the evidence lines up:

## **What the screenshot shows**

- **File:** `Joplin-Setup-3.7.16.exe` — the official Windows installer for **Joplin** , the well-known open-source note-taking app
- **1/50 vendors flagged** — only one engine (the Avira-engine heuristic `TR/Crypt.XPACK.Gen2`) out of fifty. The other 49, including the major engines (ESET, Kaspersky, Bitdefender, Microsoft, etc.), consider it clean
- **Tagged `signed`** — the binary carries a digital signature
- **Aggregated threat label:** `trojan.gen2` — VirusTotal's aggregation here just echoes the single generic "gen2" hit; there's no specific malware family attribution anywhere

## **Why Joplin specifically trips this**

Joplin is built on Electron and ships as an NSIS/Squirrel installer. Its installer (and many Electron-based apps) gets runtime-packing treatment that heuristics like `Crypt.XPACK` frequently misread as typical malware packing. The earlier search surfaced a Joplin Discourse thread titled _"VirusTotal Alert?"_ describing exactly this scenario — a Joplin setup executable showing a malware flag on VirusTotal and the poster asking if it's a false alarm — so this is a recurring, community-known phenomenon with this software, not something unique to your file.

## **Practical checklist to close this out**

1. **Verify the source** — download only from the official site ([joplinapp.org](http://joplinapp.org)) or the GitHub releases page for the Joplin project.
2. **Check the signature** on the VT Details tab (or right-click → Properties → Digital Signatures locally) to confirm it's signed by the legitimate publisher and the certificate is valid.
3. Optional belt-and-braces: cross-check the SHA-256 against the hash published with the official GitHub release notes for 3.7.16, if listed.

**Bottom line:** 1/50, heuristic-only, signed, from a reputable open-source project, matching a documented false-alarm pattern — this is a textbook precautionary/heuristic false positive. It's reasonable to keep the installer. If you got it from anywhere other than the official site or its GitHub releases, re-download it from there and compare the hash before running.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex028/uploads/cozic/original/3X/1/c/1c948e33314e232a0927789508474d8624f4270b.png) [@system](https://discourse.joplinapp.org/u/system)\
**Post date:** [6 October 2026 19:49 UTC](https://discourse.joplinapp.org/t/virustotal-alert/50847/4 "2026-10-06T19:49:15Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.