Win32/Heri: what the AVG alert means and how to clear it
Win32/Heri is the name AVG gave to files it judged suspicious, and it labels many different files, not one virus. Find out which file it flagged and whether it ran, then follow the check, scan and removal steps.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Programs like an AVG alert for Win32/Heri on a Windows file usually arrive in groups; a free scan lists the companions that are easy to miss.
Do it yourself · free Remove Win32/Heri yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Win32/Heri: summary
| Type | A detection name AVG products show for Windows files; not one program or one virus |
|---|---|
| Risk | Unknown until the file is known. The reports we read mostly look like false alarms on signed software, but a real trojan cannot be ruled out from the name |
| Symptoms | The AVG alert itself, often the only sign; in some reports it came back after every restart |
| How to get rid of it | Keep the file quarantined, find where it came from, update AVG, scan in Safe Mode, run Microsoft Defender Offline, update Windows, try System Restore |
| Our check (6 October 2026) | No PC test: we read BleepingComputer, AVG Community, Fantasy Grounds and Proofpoint pages; no sample was run |
| Detection | AVG: Win32/Heri. No Microsoft detection name is known for it; we found none in the sources we read, and Microsoft's own names are written Trojan:Win32/Name |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 8 more facts
| First seen | Reports from December 2016 on; our first guide 4 December 2018; newest report we found January 2019 |
|---|---|
| Shown by | AVG Internet Security, AVG Rescue CD and AVG Business, in the threads we read |
| Not to be confused with | Win32:DangerousSig and other Avast-style names with a colon, and with the Zbot trojan, which no source ties to this name |
| Name | Win32/Heri |
| Evidence | 0 write-ups by security sites; details still limited |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against AVG Community, BleepingComputer, Fantasy Grounds, Reddit, Steam and Windows 10 Forums threads that mention the name, Proofpoint's page on Zbot, and Microsoft Support pages. We ran no sample and tested no PC; the removal steps follow Microsoft's pages and were not tried on a live infection. A quiet result from any check does not clear a PC.
What Win32/Heri is, and what it is not
Win32/Heri is a detection name shown by AVG security products, not the name of one program or one virus. The alert tells you that AVG judged one file suspicious. It does not tell you which malware the file is, or whether the file is malware at all.
- 1
What the name is
AVG used the form Win32/Name for detections on Windows program files. Heri is the label AVG gave to this one. Our 2018 guide called it a heuristic detection: a verdict from rules that look at how a file is built and what it does, instead of a match with a known sample.
- 2
What AVG does not say
We found no AVG page that describes Win32/Heri, so what the rule looks for is not documented. The word heuristic comes from our 2018 guide, not from a vendor description we could read, and the meaning of Heri itself is not stated anywhere we looked.
- 3
What the name is attached to
In the sources we read, the same alert is reported for the Fantasy Grounds updater, the Spybot service file SDWSCSvc.exe, an Mp3tag download and a game launcher file, wot.exe. That is a list of very different files, and none of the reports shows a confirmed infection.
- 4
What our 2018 guide got wrong
It told readers to uninstall their AVG product, called a false positive highly unlikely, and tied the name to the Zbot trojan without showing why. The name is a label on one file, the reports we read lean towards false alarms, and the Zbot link is not documented in any source we found.
- Shown by
- AVG products (AVG Internet Security, AVG Rescue CD and AVG Business appear in the threads we read)
- Usual form
- Win32/Heri, written with a slash, the older AVG style. Avast-style names use a colon, as in Win32:DangerousSig
- Platform
- Windows program files. Win32 does not mean your Windows is 32-bit
- Is it one program?
- No. The reports we read name several unrelated files
- Newest report we found
- January 2019. We found no newer report, so the name may have been retired from current AVG alerts. We could not confirm that
So the useful questions are which file triggered the alert, where it came from and whether it ran. The next chapters help you answer them before you delete a file or add an exception.
What Win32/Heri does on an infected PC
How to read the alert, part by part
There is no AVG description of this name, so the table below separates what the alert text shows from what we can only read into it.
| Part | What it shows | What it does not show |
|---|---|---|
| Win32/ | A detection on a Windows executable or a related Windows object | That your Windows is 32-bit. It also says nothing about the file being 32-bit |
| Heri | The label AVG attached to the rule that fired. Our 2018 guide called it heuristic | What the rule looks for. No AVG page we found explains it |
| Object name | The path of the file, for example a game or updater folder | Whether the file is the real program or a copy dropped by something else |
| Threat removal completed | The window in our 2018 picture: AVG reports processes stopped and files and registry keys deleted | That a virus was removed. It is AVG's own summary of its action |
| Severity level | A small bar of red squares in the same window | How sure AVG is that the file is bad |
What we checked on 6 October 2026, and what we could not
There is no website here to test and we did not run a sample. We read forum threads and vendor replies that mention the name, and we ran nothing on a PC.
Our reading of the sources, 6 October 2026
- The name is a real security product labelAVG alerts carry it, and the AVG Community, BleepingComputer, Fantasy Grounds, Steam, Reddit and Windows 10 Forums threads we found all show the same name, so it is not an invented scam message.
- What the name meansNot documented. We found no AVG description of Heri.
- Which program is behind itDiffers per file. The threads name an updater, a security tool's service file, a music tag editor download and a game launcher.
- At least one clear false alarmFantasy Grounds' maker said AVG told him the updater was cleared, and the reader who posted the alert thanked him for confirming it was only a false positive.
- Real infection or false positive in your caseCannot be told from the name. A forum helper said the Spybot service file may be a false positive, but he could not see the PC. Nobody in the threads we read confirmed a real infection.
- Our 2018 link to ZbotNot confirmed. The guide said Win32/Heri might be associated with Zbot but showed no sample or source.
- A clean second scanDoes not clear it. Scanners label files differently, and malware can hide from some of them, so a quiet result from another tool is one data point, not a clearance.
Treat as unknown until you know the file The reports we read lean towards false alarms on signed software, but one alert can also be a warning about a real trojan. We saw nothing on any PC, and a quiet check is never proof that a file is safe. Keep the file in AVG's quarantine, find out where it came from, and follow the check chapter.
Where the name has been reported
These are the cases we could read. They show how different the files are. They are not a list of what your alert is.
| File or case | What the source says | How it ended |
|---|---|---|
| UpdaterEngine.exe of Fantasy Grounds (7 October 2017) | A reader's AVG showed Threat: Win32/Heri for the updater in the Steam folder. The file was signed by SmiteWorks USA with a Comodo code-signing certificate dated 5 September 2017 | The maker wrote that AVG replied it was cleared. The reader called it a false positive |
| SDWSCSvc.exe of Spybot - Search and Destroy 2 (December 2016) | A reader on Windows XP found two Win32/Heri detections and could not update AVG afterwards. The last file named was in the Spybot folder | A BleepingComputer helper said it may be a false positive because Spybot uses that service. The thread has no further reply |
| A new Mp3tag download (November 2018) | A reader got the alert while downloading the latest Mp3tag from the maker's site | An AVG helper replied to another poster in the thread that the threat was quarantined and the AVG version was very old. No verdict on the file |
| Alert that kept coming back (December 2018) | Another reader wrote that Win32/Heri kept returning, with music files on the PC | No answer in the thread |
| wot.exe of a game launcher | A Reddit thread excerpt says AVG found Win32/Heri in wot.exe every time during a launcher update | We read only the search excerpt |
| AVG Rescue CD scan (thread started March 2017) | A reader wrote that a Rescue CD scan flagged several files with the name and asked if it was an infection or a mistake | An AVG helper asked for a screenshot. No verdict |
| AVG Business product (January 2019) | A reader said the alert came back after every restart even after Remove all | An AVG helper noticed it was a Business product and sent him to Business support |
| Battle.net-Setup.exe and Google Chrome | Named in our 2018 guide as files that users said were flagged | We found no source for these two. Not confirmed |
How the name has turned up, 2016 to 2019
Every report we found is from 2016 to 2019. The AVG threads were answered by helpers who asked for screenshots. None of them explained the name.
December 2016
A Windows XP PC and the Spybot service
A BleepingComputer thread: AVG found two Win32/Heri files and then the update failed with General Error. The last flagged file was Spybot's SDWSCSvc.exe.
March 2017
Rescue CD flags several files
A reader on the AVG Community asked whether many Win32/Heri detections from a Rescue CD scan were an infection or a mistake.
7 October 2017
A signed updater is flagged
Fantasy Grounds' UpdaterEngine.exe, signed five weeks earlier, triggered the alert. The maker said AVG had cleared it.
November 2018
The Mp3tag download
Readers who downloaded Mp3tag reported the alert, and an AVG helper said the threat was quarantined.
4 December 2018
Our first guide
Our guide treated the name as a heuristic AVG detection that can be a false positive, and showed an AVG window with Threat removal completed.
From our 2018 guide: an AVG Identity Protection window, Threat removal completed for C:\Windows\16706008.exe, 4 processes terminated, 2 files deleted, 2 registry keys deleted. The title was added to it. The window does not say Win32/Heri. 17 January 2019
A business product
A reader whose alert returned after every restart was sent to AVG Business support.
2026
No newer report found
We found no report of the name later than January 2019 in the sources we read. We did not check AVG's current virus database.
What the alert shows, and what to do about it
The detection name is only a clue. The path, the source and whether the file ran decide what to do. Open AVG's quarantine or its history and read these before you click anything.
| What the alert shows | What it points to | What to do |
|---|---|---|
| A file in a game or program folder of software you installed from its maker | Possibly a false positive, as with Fantasy Grounds, but not proven | Compare with the maker's download, check the signature, then send the file to AVG for review |
| A file you were just downloading from a crack, keygen or torrent site | The riskiest case. Free software bundles and cracks carry trojans | Leave it in quarantine. Do not run or restore it |
| A file in C:\Windows or a system folder that you did not install | Our 2018 picture shows C:\Windows\16706008.exe, a name made of digits. A number-like name in a system folder deserves a closer look | Check the publisher and startup items, then scan in Safe Mode |
| The same alert after every restart | Something recreates the file, or AVG is old | Update AVG, look at startup items and scheduled tasks, then scan in Safe Mode |
| The alert while a program downloads | Caught before it ran | Delete the download or keep it in quarantine, then download a fresh copy from the maker's site |
Why our 2018 guide mentioned Zbot
The old guide said a Win32/Heri alert might be tied to the Zbot trojan. We could not confirm a link between the name and Zbot, so read this chapter as background on the family, not as what your file is.
| Fact | What the source says | Status |
|---|---|---|
| What Zbot is | Proofpoint calls Zeus (Zbot) one of the oldest malware programs used to steal banking details; it later grew into a package with keyloggers, browser injection and ransomware | From Proofpoint |
| When | First spotted in 2007; the source code leaked in May 2011 and others made their own versions | From Proofpoint |
| How it arrives | Mostly a phishing email with a link, or an attachment that drops the malware when opened | From Proofpoint |
| What it does | Records keystrokes and web logins, and a web-inject part adds script to bank pages. The PC joins a botnet | From Proofpoint |
| Our 2018 file claim | The old guide said Zbot copies itself to %System%\sdra64.exe and sets registry keys so it runs at every boot | Not confirmed in the sources we read. We keep it as the old guide's claim |
| Link to Win32/Heri | The old guide said Heri might be associated with Zbot | Not confirmed. We found no source that ties the name to Zbot |
What Win32/Heri can steal or download
What a hidden trojan can cost you
None of the reports we read shows a real infection behind the name. The risks below are those of a real trojan, so they apply only if your file turns out to be one.
- High
Stolen logins and banking data
Zbot, the family our 2018 guide named, is described by Proofpoint as a banking-data stealer with a keylogger and web injects. Our guide listed recording keystrokes as a risk too.
- High
Remote control and a botnet
Proofpoint says a Zbot PC joins a botnet, which gives the owner control of the device and access to its data. Our guide said a trojan can access the video camera and spawn and shut down processes.
- High
More malware
Our 2018 guide said a trojan can download and install additional malware. Proofpoint adds that some Zeus variants deliver ransomware.
- Medium
A long silent stay
Our guide said many users do not know for months or years that they are infected. Proofpoint says Zeus is built to avoid detection so users can work without interruption.
- Medium
A damaged or unupdated security product
In the 2016 Windows XP thread the alert came with a failed AVG update. That is one reader's report, and it does not show the infection caused it.
- Low
Nothing at all
A false positive does no harm. Fantasy Grounds' updater shows that a signed file from a known maker can carry the name. The danger is the case you cannot tell apart yet, so check the file before you decide.
What you may notice, and what the sources show
Our 2018 guide said the infiltration cannot be noticed unless certain system settings are checked. The alert comes from your own antivirus, usually after a scan, a download or a program update.
| Sign | What we found |
|---|---|
| The AVG alert itself | The usual and sometimes the only sign. It appeared during a scan, a download or a program update in every report we read |
| The alert returns after a restart or Remove all | Reported in the AVG Business thread and by a reader with music files. It means a file or a startup item recreates it, or the product is old. It does not prove an infection |
| AVG cannot update | Reported once, on Windows XP, in 2016. One reader's report; no cause was found |
| Slow PC, high CPU, new programs | Not tied to this name by any source we read. These are reasons to scan, not proof of this detection |
| Nothing | Trojans and worms are made to avoid detection, which is why our 2018 guide said many users do not know for months or years |
How to check the PC for Win32/Heri
How a file like this gets onto a PC
No source we read says how an alert for this name arrives. These are the routes our 2018 guide listed, backed by Proofpoint for Zbot.
- 1
Deceptive entry
Our guide said trojans like this usually use deceptive methods to enter the system, so the first sign is often only the alert.
- 2
Malicious or hacked sites
Our guide listed malware hidden in malicious or hacked websites and transferred via a backdoor.
- 3
Spam email attachments
A spam email attachment is the route our guide listed, and Proofpoint says most Zbot installs start with a phishing email, either a link or an attachment that downloads the malware when opened.
- 4
Fake updates
Our guide listed fake updates. Proofpoint adds that pirated software often hides malware that installs with the legitimate program.
- 5
Third-party installers and torrents
The prevention list in our guide named installers from third parties and torrent sites as places to avoid.
The same few habits cover all of them: take software from its maker, open only attachments you expected, and keep Windows and your security product up to date.
Check your PC before you delete anything
Do not click anything in a pop-up and do not add an exception yet. Write down what the alert says first.
- 1
Copy the alert
Take a photo or screenshot. Note the full name, the file path or web address, the process and the time. AVG helpers in the threads asked for a screenshot and the product version first.
- 2
Check your AVG version
Open AVG, then Menu > About. The AVG helper in the 2018 thread said a very old version was in use and asked the reader to reinstall the current one. A product with old definitions can flag files wrongly or miss real ones.
- 3
Leave the file in quarantine
Do not restore it and do not add an exception while you are unsure. Before you remove Win32/Heri you need to know it is not a false positive, as our 2018 guide said.
- 4
Ask where it came from
Did you install a program, update a game or download a file just before the first alert? A file from a maker you know is different from one in an archive from a forum.
- 5
Look at the file's publisher
In File Explorer right-click the file, choose Properties and look for a Digital Signatures tab. A valid signature from a publisher you know is a good sign, and the Fantasy Grounds updater had one. It is not proof, because malware has also been signed.
- 6
Look at what starts with Windows
Press Ctrl + Shift + Esc, open Startup apps and note names you do not know. Open Settings > Apps > Installed apps and sort by install date to see what arrived recently.
- 7
Read every name in the scan report
Write down every detection, not only Win32/Heri. A second name beside it often identifies the family.
How to remove Win32/Heri
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Programs like Win32/Heri add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 2: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after Win32/Heri, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
A scan finds the parts of Win32/Heri that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Win32/Heri can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Remove it from Windows 11 and Windows 10
Do the steps in order and stop when a scan from outside normal Windows is clean and the alert has not returned. We did not run these steps on a live infection; they follow Microsoft's pages. Keep your own security product while you do them: our 2018 guide said to uninstall AVG, and we no longer advise that.
- 1
Disconnect, then back up documents
Turn off Wi-Fi or unplug the cable. Copy documents and photos, not programs, to an external drive that you unplug afterwards.
- 2
Start in Safe Mode with Networking
Open Settings > System > Recovery, click Restart now beside Advanced startup, then choose Troubleshoot > Advanced options > Startup Settings > Restart. On the Startup Settings screen press 5 or F5 for Safe Mode with Networking. Microsoft says Safe Mode starts Windows with only essential services and drivers, and that Safe Mode with Networking adds the network drivers you need to get online.
- 3
Update and run a full scan with your security product
Update it to the latest version first, then run the full scan. Our 2018 guide said the same: update, then scan the whole system. If the product flags something it will list it for quarantine or removal. A scan cannot promise to find every trace.
- 4
Run a second opinion with Microsoft Defender Offline
Open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan and click Scan now. Microsoft says it runs from a trusted environment outside the normal Windows kernel. Then open Protection history to read the result.
- 5
Uninstall what you do not know
In Settings > Apps > Installed apps remove programs that came with the file or that you did not install. Then check Startup apps in Task Manager again.
- 6
Try System Restore if the alert began after an install
Press Windows logo + R, type
rstrui.exeand choose a restore point from before the install. Microsoft says System Restore reverts system files, registry settings and installed programs, and leaves personal files alone. It will not help if no restore point exists. - 7
Update Windows
Install every update under Settings > Windows Update, then scan again.
- 8
Change passwords from another device
If the file ran, change your email password first, then banking and everything else, from a clean device.
- 9
Last resort: reset Windows
Back up documents, then use Settings > System > Recovery > Reset this PC and choose Remove everything. Restore only documents, no programs and no full system image.
Never download a removal program because a pop-up, a stranger or a phone number tells you to. A real threat does not need a payment page to fix. We name no product as a remover.
Could it be a false alarm? How to send it to AVG and, last, add an exception
Possibly. A false positive is a file your security software calls malicious when it is in fact useful, and Fantasy Grounds' updater is a case where the maker said AVG cleared the file. Heuristic detections can produce this, and users can be misled into thinking the PC is infected. Only AVG can confirm a false positive.
| Points to a real infection | Points to a false positive |
|---|---|
| The file came from a crack, a keygen, an email attachment or a fake update | The file came from the maker's own site, and you were expecting it |
| Other names appear next to it in the report, from other vendors or from Microsoft Defender | Only one product flags it |
| Unknown startup items, a changed browser, unknown programs | The PC works normally |
| The file has no signature or an unknown publisher | The file has a valid signature from a publisher you know |
| The alert returns after a restart | The alert came once and stayed quarantined |
- 1
Do not add an exception first
Our 2018 guide said you should not remove a detected file if it is legitimate, and that you should add the application as an exception. We add one condition: only after the checks above and, for a program from a maker, after the maker or AVG has confirmed the file.
- 2
Ask the maker and AVG
Fantasy Grounds' maker said they submit updates to the big antivirus vendors, which takes time to review. A reader can send the file for review through the AVG support pages. We did not open the current AVG form, so check its wording.
- 3
If you still add an exception
In the AVG Internet Security our 2018 guide used, open Options and pick Exceptions in the left pane. In current AVG versions the exception list is under Menu > Settings > General > Exceptions; we did not verify this path in a current AVG. Add the one file, not a whole drive.
- 4
What an exception does
Our 2018 guide said the false Win32/Heri notifications should stop. That is true, because the file is no longer checked. It also means that if the file was bad, AVG will no longer warn you.
After removal: passwords, accounts and prevention
Secure your accounts after the clean-up
Assume that whatever was saved in the browsers on this PC while the PC showed an AVG alert for Win32/Heri on a Windows file in the list of installed apps has been copied:
- passwords
- cookies
- autofill data
Work from a clean device, or from this PC once the offline scan finds nothing.
Start with your main e-mail account, because it can reset everything else, then banking and payment, then social and gaming accounts. Change each password, sign out of all sessions and turn on two-step verification: Turn on two-step verification / secure a hacked account.
The full order, including crypto wallets and card replacement, is in securing your accounts after malware.
If it was real: what to do about your accounts and files
The scans above deal with the PC. These steps deal with what the file could have seen or done.
- 1
Change passwords from another device
Email first, then banking, then everything else. Turn on two-step sign-in. Do this before you use banking on the infected PC.
- 2
Sign out everywhere
Use the sign out of all sessions option in your Google, Microsoft and social accounts so stolen cookies stop working. This matters most for stealers such as Zbot.
- 3
Check your money
Look at card statements and any wallets for payments you did not make. Proofpoint says Zeus aims at banking logins first.
- 4
If files are encrypted
Do not pay. Do not delete the encrypted files or the note, and do not reinstall Windows before you have copied them. Restore from a backup you kept disconnected. Nothing we read links Win32/Heri to ransomware; Proofpoint says only the GameOver Zeus variant adds it.
- 5
Check browser settings
If the homepage, new tab or search engine changed, remove the extension and reset the browser settings.
- 6
Scan again in a week
Run another full scan and a Defender Offline scan a week later and keep the alert screenshot.
Keep trojans off your PC
The advice from 2018 still holds: keep security software on, and keep it updated. Here it is with current details.
Do
- Keep one security product with Real-time protection on and always updated, because heuristic detection is how new viruses that the vendor has not seen before are caught. Microsoft Defender is built into Windows 11 and 10.
- Scan unknown files before you open them. Right-click the file and choose the scan option of your security product, or use Windows Security > Virus & threat protection.
- Download programs only from their makers' sites or the Microsoft Store, and use the Custom or Advanced option so bundled extras can be declined.
- Install Windows Update monthly, and update browsers and PDF readers.
- Keep a backup of documents on a disk you unplug (File History or OneDrive).
- Use a password manager and two-step sign-in so one stolen password does not open every account.
Don't
- Do not click links or open attachments in spam email, even when the sender looks known.
- Do not use installers from third-party sites or torrent sites, and do not run cracks.
- Do not click suspicious advertisements and pop-ups.
- Do not restore a quarantined file or add an exception to stop an alert you have not checked.
- Do not call a number shown in an alert.
Questions about Win32/Heri
What is Win32/Heri?
It is a detection name that AVG security products showed for Windows files, written Win32/Heri, and it is not one program. Our 2018 guide called it a heuristic detection, meaning a verdict from rules instead of a match with a known virus, but we found no AVG page that describes it.
In the sources we read it is reported for a game updater, a security tool's service file, a music tag editor download and a launcher file. Treat the alert as a prompt to find out which file triggered it, where it came from and whether it ran, not as the name of an infection.
Is Win32/Heri a virus or a false positive?
It can be either, and the name cannot settle it. In the reports we read, the Fantasy Grounds updater was said to be cleared by AVG, and a helper said the Spybot service file may be a false positive. None of the threads confirmed a real infection.
That does not clear your file, because a real trojan can carry an AVG label too. Look at where the file came from, whether it has a valid signature and whether other tools or other names in the report agree. Keep it quarantined until you know.
How do I remove Win32/Heri from Windows 11 or 10?
Leave the file in quarantine, then disconnect and back up documents, start in Safe Mode with Networking, update your security product and run a full scan. Run a Microsoft Defender Offline scan as a second opinion, remove programs you did not install, install all Windows updates and try System Restore if the alert began after an install.
Change passwords from another device if the file ran. We did not test these steps on a live infection. Reset Windows only as a last resort, and restore documents only.
Should I uninstall AVG, as the old advice says?
No. Our 2018 guide told readers to uninstall AVG, enter Safe Mode with Networking and install a different security program. We no longer advise it, because removing your protection leaves the PC open and does not answer whether the file is bad.
An AVG helper in the 2018 Mp3tag thread did ask a reader to reinstall AVG, but to get the current version, not to remove it for good. Update your product, scan in Safe Mode and run Microsoft Defender Offline as a second opinion instead.
Is Win32/Heri the Zbot trojan?
Not as far as we can show. Our 2018 guide said the detection might be associated with Zbot and described a file called sdra64.exe, but it gave no sample, and no source we read ties the name to Zbot.
Proofpoint describes Zbot, also called Zeus, as a banking trojan first seen in 2007 that records keystrokes, adds script to bank pages and joins the PC to a botnet. If you want to be careful, read every name in the scan report, because a second name beside Heri may identify the family.
Why does Win32/Heri keep coming back after I remove it?
Because a copy or a startup item may recreate the file, or because your AVG is old. In the threads we read, a reader said the alert returned after every restart even after Remove all, and an AVG helper found it was an AVG Business product and sent the reader to business support.
Open Startup apps and Installed apps, sort by date, remove what you do not know, update AVG and scan in Safe Mode. We found no source that explains repeats for this name.
Can I add the file to the AVG exceptions list?
Only after you have checked it. Our 2018 guide said to add the legitimate program as an exception, and the alert then stops. It stops because AVG no longer looks at the file, so a bad file would no longer warn you.
First check the source and the signature, ask the maker whether it is a known false alarm, and send the file to AVG for review. If you still add it, add the one file and not a whole folder or drive. The menu path differs by AVG version, so check yours.
Were Chrome and Battle.net really flagged as Win32/Heri?
Our 2018 guide said users complained that Battle.net-Setup.exe, FantasyGrounds.exe and even Google Chrome were detected, and we found no source for the Battle.net and Chrome cases. The threads we could read name the Fantasy Grounds updater, UpdaterEngine.exe, together with Spybot's SDWSCSvc.exe, an Mp3tag download and wot.exe. If a file you trust was flagged, the cases show the right move:
- do not delete it
- check its signature and source
- send it to AVG for review
A file you trust is worth a second look, not a panic and not a deletion.
Can antivirus software alone fix it?
Not always. A scan can remove a file it finds, but no scan can promise to remove every trace and a quiet scan never clears a PC. What helps is the combination:
- quarantine
- a Safe Mode scan with an updated product
- Microsoft Defender Offline
- Windows updates
- removing unknown programs
- changing passwords if the file ran
Run one security product with real-time protection and do not install a cleaner from a pop-up. Our 2018 guide said to keep the software updated because heuristic detection is for viruses the vendor has not seen before.
Will Fortect remove Win32/Heri?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Win32/Heri, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- AVG Community: What is the Win32/Heri is a virus or error and false positive? (thread from March 2017, replies to December 2018) (read October 6, 2026)
- AVG Community: Win32/Heri Virus (January 2019) (read October 6, 2026)
- BleepingComputer forums: Can't update AVG software, Win32/Heri virus (December 2016) (read October 6, 2026)
- Fantasy Grounds forums: AVG Detection Alert with latest UpdaterEngine.exe (7 October 2017) (read October 6, 2026)
- Reddit r/WorldofTanks: Virus detected while updating launcher (search excerpt) (read October 6, 2026)
- Windows 10 Forums: Having serious issues with virus/malware (search excerpt) (read October 6, 2026)
- Steam Community: Last beta update : AVG detect Virus : win32/Heri (search excerpt) (read October 6, 2026)
- Proofpoint: What Is Zeus Trojan (Zbot)? (read October 6, 2026)
- Microsoft Support: Windows startup settings (Safe Mode) (read October 6, 2026)
- Microsoft Support: System Restore (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline scan in Windows (read October 6, 2026)
- Microsoft Support: Virus and threat protection in the Windows Security app (read October 6, 2026)