What it is
Heuristic virus is an informal phrase for a file or process flagged by behavior-based or pattern-based analysis rather than an exact known signature. It is not a distinct virus family. Security software uses heuristics to identify new, modified, packed, or previously unseen malware that resembles dangerous code.
How it works
The engine may score actions such as injecting into another process, changing startup settings, unpacking hidden code, disabling security tools, or contacting suspicious infrastructure. Machine-learning models and emulation can contribute to the decision. The resulting label often includes terms such as heuristic, generic, suspicious, or Gen.
Key points
Heuristics catch threats before a precise signature exists, but they can also flag unusual legitimate software.
A digitally signed file is not automatically safe, and an unsigned file is not automatically malicious.
Source, publisher, prevalence, behavior, hash reputation, and surrounding alerts should be evaluated together.
What to do
Keep the item quarantined while you verify where it came from and what launched it.
Update the security product and rescan so the latest classification is used.
Submit a trusted business file for false-positive analysis instead of creating a permanent exclusion.
Run a broader system scan when the alert accompanies persistence, credential access, or unknown network traffic.