How to remove “Heur.Zybut.1”?

The Heur.Zybut.1 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Heur.Zybut.1 virus can do?

The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Heur.Zybut.1?


File Info:
name: 46600F38755D9DFF79C3.mlw
path: /opt/CAPEv2/storage/binaries/aeca8de6c51e1464e96c188131171bec17491958c497a55fd979c2401ef754d8
crc32: 024F2026
md5: 46600f38755d9dff79c3b1068bc9365f
sha1: bdfab8ced6cc7931598e7d12b0b07e45334eabc7
sha256: aeca8de6c51e1464e96c188131171bec17491958c497a55fd979c2401ef754d8
sha512: df6b5a51067fc3a3c3b2edfa76f1aad605f4d9846e01df19205e65750fb1eb97f5e04b32352afc9cb655b7566b891230530ef3811ea6b26c2f0734cfb256538c
ssdeep: 384:DQy4RwDuWcZcDHJ7u5eqURx5w+8jHhGS4OSeNGWJkkx:caCWz4+8rSO3Jx
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13C447C5BBB5212CBD51D0930D99358D29BFE8D332652037FCB08982A7CF0AC239C5875
sha3_384: a990186f2294e1fddb153814669680bde741e65b649076d5355edfd3ca7a09c8af267203cf1f8eb12adf4906bfc48d2b
ep_bytes: 558bec83ec0cc705a5b04300a0090000
timestamp: 2008-01-10 20:31:36

Version Info:
FileVersion: 3.8.7.1
ProductVersion: 1.7.4.9
FileDescription: africanthropus
CompanyName: flouncey
LegalCopyright: Knitter
ProductName: Canorousness
Translation: 0x0000 0x04b0

Heur.Zybut.1 also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.Zybut.1
FireEye	Generic.mg.46600f38755d9dff
McAfee	Generic-FAES!46600F38755D
Cylance	Unsafe
K7AntiVirus	Backdoor ( 003f4df21 )
K7GW	Backdoor ( 003f4df21 )
Cybereason	malicious.8755d9
BitDefenderTheta	Gen:NN.ZexaF.34712.qK0@aGlW8@fi
Cyren	W32/Agent.OC.gen!Eldorado
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik.ADEY
APEX	Malicious
Kaspersky	HEUR:Backdoor.Win32.Generic
BitDefender	Gen:Heur.Zybut.1
NANO-Antivirus	Trojan.Win32.PWS.reyld
Avast	Win32:MalOb-KC [Cryp]
Ad-Aware	Gen:Heur.Zybut.1
Emsisoft	Gen:Heur.Zybut.1 (B)
Comodo	Backdoor.Win32.Shiz.BWWS@4n4fjv
McAfee-GW-Edition	BehavesLike.Win32.Generic.dz
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A + Mal/EncPk-AEC
SentinelOne	Static AI – Malicious PE
Jiangmin	Backdoor/Shiz.btv
Avira	TR/Crypt.XPACK.Gen
Microsoft	Trojan:Win32/Wacatac.B!ml
ViRobot	Backdoor.Win32.A.Shiz.263680.M
GData	Gen:Heur.Zybut.1
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.Shiz.R21304
ALYac	Gen:Heur.Zybut.1
MAX	malware (ai score=80)
Malwarebytes	Malware.Heuristic.1008
Rising	Trojan.Zybut!1.9996 (CLASSIC)
Yandex	Trojan.GenAsa!3s7PJp8yfhc
Fortinet	W32/Shiz.NCF!tr
AVG	Win32:MalOb-KC [Cryp]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Heur.Zybut.1?

Heur.Zybut.1 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X