Win64:Vitro [Inf] removal instruction

The Win64:Vitro [Inf] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win64:Vitro [Inf] virus can do?

Anomalous binary characteristics

How to determine Win64:Vitro [Inf]?


File Info:
crc32: AE668D1F
md5: 2e56d65ffe2e5afb3400cc575aed9ad5
name: 2E56D65FFE2E5AFB3400CC575AED9AD5.mlw
sha1: 4e1e3774cdd53e0f985bbf0cbd854bd2b5f3ab9a
sha256: 2e77fe0e253e9a66cda93f5ad93b97e1bddb03e0f97b540aac60e61805555856
sha512: cb338175ddc9947ad3e86b15699d01e04fe7c41016670b964509aec8923c7f3fe5a115d1932a068a0d38b6be0cf4ff471303ec50ab27f1fb4ea821e555bcbee5
ssdeep: 6144:duKgqohgiwG8NxzJ4B4Xkb/o7vLdWfkqY/W5R02qO7VKCyWQVeD2S/6:duKgqohgiwG8PJ4BY/Dd/q3nyQ36
type: PE32+ executable (GUI) x86-64, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: slui.exe
FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 6.1.7601.17514
FileDescription: Windows Activation Client
OriginalFilename: slui.exe
Translation: 0x0409 0x04b0

Win64:Vitro [Inf] also known as:

Bkav	W32.Vetor.PE
Elastic	malicious (high confidence)
DrWeb	modification of Win32.Virut.56
Cynet	Malicious (score: 100)
CAT-QuickHeal	W32.Virut.G
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Virus:Win32/Virut.631560b1
Cybereason	malicious.ffe2e5
Baidu	Win32.Virus.Virut.gen
Cyren	W64/S-e94006d5!Eldorado
Symantec	Trojan.Gen.6
ESET-NOD32	Win32/Virut.NBP
APEX	Malicious
Avast	Win64:Vitro [Inf]
Kaspersky	Virus.Win32.Virut.ce
BitDefender	Win32.Virtob.Gen.12
NANO-Antivirus	Virus.Win64.Virut-Gen.bwpxnc
MicroWorld-eScan	Win32.Virtob.Gen.12
Tencent	Virus.Win64.Remain.VriutCE.Gen
Ad-Aware	Win32.Virtob.Gen.12
Sophos	Mal/Generic-S
BitDefenderTheta	AI:FileInfector.C9457D4313
VIPRE	Virus.Win32.Virut.ce (v)
McAfee-GW-Edition	BehavesLike.Win64.Generic.fh
FireEye	Generic.mg.2e56d65ffe2e5afb
Emsisoft	Win32.Virtob.Gen.12 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Win32/Virut.bt
Avira	TR/Patched.Gen
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Win32.Virtob.Gen.12
GData	Win32.Virtob.Gen.12
Acronis	suspicious
MAX	malware (ai score=84)
Panda	W32/Sality.AO
Rising	Virus.Virut!8.44 (CLOUD)
Ikarus	Virus.Win32.Virut
MaxSecure	Virus.Virut.CE
Fortinet	W32/Virut.NBP!tr
AVG	Win64:Vitro [Inf]
Paloalto	generic.ml

How to remove Win64:Vitro [Inf]?

Win64:Vitro [Inf] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X