# Vendor has flagged this as malicious

**URL:** <https://forums.ankiweb.net/t/vendor-has-flagged-this-as-malicious/31156>\
**Category:** Help\
**Created:** [June 12, 2023, 2:56pm UTC](https://forums.ankiweb.net/t/vendor-has-flagged-this-as-malicious/31156 "2023-06-12T14:56:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![MatthewKyes](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@MatthewKyes](https://forums.ankiweb.net/u/MatthewKyes)\
**Post date:** [June 12, 2023, 2:56pm UTC](https://forums.ankiweb.net/t/vendor-has-flagged-this-as-malicious/31156/1 "2023-06-12T14:56:06Z")

</div>

Hello,

I am new to this product as it was recently suggested to me as a good learning tool -  
Before I install anything I usually run it through VirusTotal and doing so I’ve noticed that I see the following for both Qt6 & Qt5:

1 security vendor flagged this file as malicious  
Jiangmin Backdoor.Androm.bdka

**(I had to take out the first part of the virustotal URL as it would not allow me to include a link in this post)**  
Qt6: /gui/file/02d992a47fe826254b3dc707226d9d06c006f3fa0dc1e66c9e47767316896ed9/detection

Qt5: /gui/file/0fecc6c5e51174431e209377f4eaed6a52cd2648fdafb3e79e6f6eb6cd3f461a

**Any advice or plans for remediation?**

Thanks,  
Matt K.

---

<div class="post-metadata">

**Author:** ![ijgnd](https://avatars.discourse-cdn.com/v4/letter/i/bbe5ce/32.png) [@ijgnd](https://forums.ankiweb.net/u/ijgnd)\
**Post date:** [June 12, 2023, 9:18pm UTC](https://forums.ankiweb.net/t/vendor-has-flagged-this-as-malicious/31156/2 "2023-06-12T21:18:58Z")

</div>

I guess the official position is: [My antivirus program says Anki is infected! - Frequently Asked Questions](https://faqs.ankiweb.net/my-antivirus-program-says-anki-is-infected.html)

virustotal is even “worse”. If 50 engines check the file and each antivirus program has a false detection rate of only 1% there’s an about 40% chance to get at least one false positive …

It’s also interesting that it’s always the same one engine that reports having found a virus:

- for 2.1.65 the virustotal report is at [VirusTotal](https://www.virustotal.com/gui/file/02d992a47fe826254b3dc707226d9d06c006f3fa0dc1e66c9e47767316896ed9)
- for 2.1.55 from 2022-12 the virustotal report is at [VirusTotal](https://www.virustotal.com/gui/file/1dce28567a37ed3d47ae024e92ed71c0e769a0cc955e9259fdba477f9e6383d6?nocache=1)

I guess it’s likelier that one engine has false positives than all other engines not finding a virus (even after weeks of having access to the positive result from jiangmin which should have prompted them to recheck the binary …)

there are may threads about how to handle virustotal reports in this forum or the anki subreddit. you could also search sites like [https://security.stackexchange.com/](https://security.stackexchange.com/) to find out how to make sense of virustotal results in general.

In the end you must make the decision that’s right for you.

I guess there’s no binary distinction between safe-unsafe/untrusted but it’s always a question of how much you trust software.

Many people here have been using Anki for years and trust it and are not deterred by such reports. I have installed Anki 2.1.65 on my machine.

If you are very cautious and are interested in specialized computer knowledge and don’t care about user friendliness there are always solutions to “isolate” software you don’t trust like vms, windows sandbox etc. I guess many people should take care of other security related problems in their computers before they take steps in this direction … When it comes to trying out new software [windows sandbox](https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview) is especially useful.

---

<div class="post-metadata">

**Author:** ![MatthewKyes](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@MatthewKyes](https://forums.ankiweb.net/u/MatthewKyes)\
**Post date:** [June 13, 2023, 5:27pm UTC](https://forums.ankiweb.net/t/vendor-has-flagged-this-as-malicious/31156/3 "2023-06-13T17:27:46Z")

</div>

@ijgnd  
Thanks for the input - I was hoping to bring this into a security review process but I suspect the red flag might dissuade.

Didn’t know if we might be able to get some feedback from those active on the project regarding any plans to remediate the detection with that specific vendor.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex002/uploads/anki2/original/1X/8f1279ababc5879d54e4838989f606cfe55af8c7.jpeg) [@system](https://forums.ankiweb.net/u/system)\
**Post date:** [July 13, 2023, 5:28pm UTC](https://forums.ankiweb.net/t/vendor-has-flagged-this-as-malicious/31156/4 "2023-07-13T17:28:25Z")

</div>

Closed on July 13, 2023, 5:28pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
