Home › AlYac (ESTsecurity) False Positive & Blacklist Removal

AlYac (ESTsecurity) False Positive & Blacklist Removal

Choose the right next step:

Content reviewed July 13, 2026.

By DrGlenn — USA-based WordPress security specialist· 290+ cleanups across 34 countries· Updated June 22, 2026

Is AlYac (ESTsecurity) flagging your website or file?

If AlYac (ESTsecurity) is flagging your site or a file — often showing up as generic malware/PUA detections (e.g. Misc.Malware-Gen, Trojan/Win.*) — it is either a real infection or a false positive from a past issue. Here is how to get it cleared.

Step 1 — Confirm it is really a false positive

Do not request removal while malware is still present, or the flag returns. Check first:

If anything turns up, get it fully cleaned first — deleting the visible malware is not enough if a backdoor remains.

Step 2 — Report the false positive to AlYac (ESTsecurity)

AlYac false positives go to the ESTsecurity Response Center (ESRC). Submit here: esrc@estsecurity.com (email)

  1. Visit en.estsecurity.com/support/report.
  2. Since the page only offers a downloadable reporter app, email esrc@estsecurity.com instead.
  3. Attach the file or paste the VirusTotal URL + AlYac detection name.
  4. State why it is legitimate.
  5. Request re-analysis and a signature correction.

Good to know: AlYac is built by ESTsecurity (spun off from ESTsoft in 2017); “esrc” = ESTsecurity Response Center. The report page does not expose a public form, so email is the route.

Step 3 — If the warning keeps coming back

A detection that returns after you have been cleared almost always means the infection was never fully removed — usually a backdoor in a theme file, a rogue admin user, or malware in the database. That is exactly what I fix. I am a USA-based WordPress security specialist: I remove the infection completely, submit the delisting on your behalf, and harden the site so it stays clean.

Get my site cleaned · See how it works · read my client reviews.

Frequently asked questions

How long does AlYac (ESTsecurity) take to clear a false positive? Once the site/file is genuinely clean and you have submitted the request, most are resolved within a few days. Submitting while still infected only restarts the clock.

It keeps coming back — why? Because the real infection (a backdoor, rogue admin, or database payload) is still there. A full cleanup stops the loop.

More removal guides: Webroot (BrightCloud), Kaspersky, Antiy-AVL · all vendor guides · full report-link directory.

Evidence to include with a ALYac/ESTsoft review

Include the ALYac detection label, SHA-256, product version, file source and scan date. State what the program is expected to do and how the submitted build can be reproduced.

Before submitting

Rescan the exact submitted version after review. A rebuilt file normally has a different hash and may require separate evaluation.

  1. Save the exact detection and affected URL, hostname or file hash.
  2. Rule out a real compromise and document what was checked or cleaned.
  3. Send one complete case through the route documented above.
  4. Retest the same indicator after the review.

Return to all vendor review links · Get cleanup help