# Virus Report on FossHub for JabRef-5.9.msi

**URL:** <https://discourse.jabref.org/t/virus-report-on-fosshub-for-jabref-5-9-msi/3950>\
**Category:** General Feedback\
**Tags:** release\
**Created:** [August 24, 2023, 10:12am UTC](https://discourse.jabref.org/t/virus-report-on-fosshub-for-jabref-5-9-msi/3950 "2023-08-24T10:12:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JasonClarkson](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@JasonClarkson](https://discourse.jabref.org/u/JasonClarkson)\
**Post date:** [August 24, 2023, 10:12am UTC](https://discourse.jabref.org/t/virus-report-on-fosshub-for-jabref-5-9-msi/3950/1 "2023-08-24T10:12:02Z")

</div>

I am currently using only Jabref 5.8 and I do not dare upgrade to 5.9 as there is a Virus Alert for the Windows installer release on FossHub. Only 1/15, but still…

Could someone please check why Jotti’s Malware Scan using ClamAV reports

_Win.Malware.Sivis-6744066-0_

when scanning JabRef-5.9.msi

Disclaimer: This is my first post on here, please tell me if it fits better somewhere else. I didn’t post this on github as I couldn’t find a fitting category.

---

<div class="post-metadata">

**Author:** ![Siedlerchr](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.jabref.org/siedlerchr/32/216_2.png) [@Siedlerchr](https://discourse.jabref.org/u/Siedlerchr)\
**Post date:** [August 24, 2023, 11:26am UTC](https://discourse.jabref.org/t/virus-report-on-fosshub-for-jabref-5-9-msi/3950/2 "2023-08-24T11:26:05Z")

</div>

Hi,

this is very likely a false alarm. I checked the file again from fosshub.  
You can also download it from github [Release JabRef Version 5.9 · JabRef/jabref · GitHub](https://github.com/JabRef/jabref/releases/tag/v5.9) and check again. The file hashes shoudl also match.

I checked with VirusTotal again and it looks fine;

> **[VirusTotal](https://www.virustotal.com/gui/file/7c03092b5c9aa3e7da7f6e04895a1dbfd48c6bd88790ced13ac728b8e6c88cb7)**
>
> VirusTotal

---

<div class="post-metadata">

**Author:** ![ThiloteE](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.jabref.org/thilotee/32/1008_2.png) [@ThiloteE](https://discourse.jabref.org/u/ThiloteE)\
**Post date:** [August 24, 2023, 8:28pm UTC](https://discourse.jabref.org/t/virus-report-on-fosshub-for-jabref-5-9-msi/3950/3 "2023-08-24T20:28:50Z")

</div>

Apparently ClamAV does not really describe why _Win.Malware.Sivis-6744066-0_ is classified as malware. I found this signature listed in their archives, but there is no description whatsoever. It may or may not be a false positive. They also use RegEx to detect malicious signatures.

Found these docs about how to interpret scan alerts on their website though: [Interpreting Scan Alerts - ClamAV Documentation](https://docs.clamav.net/faq/faq-scan-alerts.html).

---

<div class="post-metadata">

**Author:** ![JasonClarkson](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@JasonClarkson](https://discourse.jabref.org/u/JasonClarkson)\
**Post date:** [August 25, 2023, 3:05pm UTC](https://discourse.jabref.org/t/virus-report-on-fosshub-for-jabref-5-9-msi/3950/4 "2023-08-25T15:05:36Z")

</div>

> [@ThiloteE](#):
>
> _Win.Malware.Sivis-6744066-0_

googling it, I got to a Microsoft Defender Info page

[https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus%3AWin32%2FSivis.A](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus%3AWin32%2FSivis.A)

which dates back to 2011. Not sure if that’s the very one.