Win32:Vitro: what the Avast alert means and how to clean it
Win32:Vitro is the name Avast gave to a file-infecting virus of the Virut family, which adds its code to programs and opens a backdoor. Check how many files and drives are affected, scan in Safe Mode, and plan a reset if infected files remain.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Programs like an Avast alert for Win32:Vitro on a Windows program file usually arrive in groups; a free scan lists the companions that are easy to miss.
Do it yourself · free Remove Win32:Vitro yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Win32:Vitro: summary
| Type | File-infecting virus with a backdoor (the Virut family); Avast named it Win32:Vitro |
|---|---|
| Risk | High. It changes programs and Windows files, some beyond repair, and can download more malware |
| Symptoms | Many programs flagged at once, start-up trouble, start-up items that return; sometimes only the antivirus alert |
| How to get rid of it | Disconnect, scan in Safe Mode, run Defender Offline, back up documents only, and reset or reinstall Windows if infected files remain |
| Our check (6 October 2026) | Sources only: Avast, Dell, Malwarebytes, BleepingComputer, Microsoft and CERT Polska. No sample run, no PC test |
| First seen | Microsoft's entry is from July 2008; Avast thread March 2009; our first guide 19 April 2021 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Detection names | Avast: Win32:Vitro. No Microsoft detection name is known for Vitro itself. Microsoft's entry for the Virut family is Virus:Win32/Virut.AP, and we could not match it to a Vitro alert. Others: Win32/Virut, Virus.Win32.Virut.q |
|---|---|
| Spreads by | Cracks and keygens, downloaded programs, USB sticks, shared drives, infected web pages |
| Not to be confused with | Vundo / Virtumonde, Zlob, and fake codec scams. No source we read ties them to Vitro |
| Name | Win32:Vitro |
| Evidence | 0 write-ups by security sites; details still limited |
| Microsoft Defender name | Virus:Win32/Virut.AP |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against Avast, Dell, Malwarebytes and BleepingComputer threads from 2009 and 2010, Microsoft's entry for Virus:Win32/Virut.AP, CERT Polska's 2013 Virut report and Microsoft Support pages. We ran no sample and tested no PC; the removal steps follow Microsoft's pages and the helpers' advice and were not tried on a live infection. A quiet result from any check does not clear a PC.
What Win32:Vitro is, and what it is not
Win32:Vitro is Avast's name for a file-infecting virus of the Virut family, not a trojan from a fake codec. It adds its code to programs you already have, so one alert can mean many files.
- 1
What the name is
Win32:Vitro is the name the Avast antivirus gave to a file-infecting virus. A Malwarebytes helper wrote in 2009 that Vitro is the same thing as Virut, and a BleepingComputer moderator in 2010 called a reader's case a variant of Virut. Our 2021 guide called it a trojan; the sources we read call it a polymorphic file infector.
- 2
What it does to a PC
Microsoft describes the Virut family as a virus that adds its code to .EXE and .SCR files and may open a backdoor, which lets an attacker download and run more files on the PC. A file infector changes programs you already have, so the harm sits in many files and not in one.
- 3
Where it stands in 2026
We found no report newer than 2013 in the sources we read, and Polish investigators took over the botnet's control domains that year. An alert today may come from old infected files on a drive or a stick, or from a false alarm. We could not tell which from the name alone.
- Shown by
- Avast, as Win32:Vitro, with a colon. Other products wrote Win32/Virut, and one Microsoft entry is Virus:Win32/Virut.AP
- Kind
- Polymorphic file infector with a backdoor. It is not ransomware and not a browser hijacker
- Files it infects
- .EXE and .SCR, per Microsoft. Reports also name web files (.htm, .html, .php, .asp, .xml) with an added iframe, and some variants reach files inside archives
- Platform
- Windows only. The sources name Windows 98 to Windows 8; we found no report for Windows 10 or 11
- Oldest source we read
- Microsoft's entry, first published 30 July 2008; the Avast thread dates from March 2009
So the first questions are which files were flagged, whether the same name appears in a second scanner, and what else is on the drive. The chapters below take them in that order.
What Win32:Vitro does on an infected PC
Names that get mixed up with Win32:Vitro
Several names point at the same family, and one unrelated name from our 2021 guide does not. The table sorts them.
| Name | What it is | How it relates |
|---|---|---|
| Win32:Vitro | The Avast label, written with a colon | The name on this page. A Malwarebytes helper equated it with Virut in 2009 |
| Win32/Virut and Virus:Win32/Virut.AP | The names other products and Microsoft use for the same family | Microsoft lists Win32/Virut (AVG) and Virus.Win32.Virut.q (Kaspersky) as aliases of one entry. We did not match each alias to Vitro, so treat them as the same family, not the same file |
| Virux | A related infector named in a 2010 BleepingComputer answer | Its variants are said to put an iframe into web pages. Named in the source, not tested by us |
| Vundo / Virtumonde and Zlob | Other, older trojans that show fake security alerts | Our 2021 guide said Vitro is similar to them. No source we read ties Vitro to either, and Vundo has its own guide on this site |
| Fake codec installers | A delivery trick | Our 2021 guide made this the main route. We found no source for it. The reports we read name cracks, keygens and a downloaded TV program |
What we checked on 6 October 2026, and what we could not
There is no website to test and we ran no sample. What follows is what the sources show, and what we could not confirm.
Our reading of the sources, 6 October 2026
- The name is a real security labelAvast, Dell, Malwarebytes and BleepingComputer threads from 2009 and 2010 show it on real PCs. It is not a pop-up scam.
- It is a family with a Microsoft entryMicrosoft's entry for Virus:Win32/Virut.AP, published 30 July 2008 and updated 15 September 2017, describes a polymorphic file infector with a backdoor.
- Fake codec route in our 2021 guideNot confirmed. No source we read describes it. The routes they give are cracks, keygens, shared drives and a downloaded TV program.
- Rogue security programs by nameNot confirmed. Our guide named Antivirus 360 and System Protector. CERT Polska only says Virut activity can be linked to fake antivirus software.
- Any PC or file testNone. We ran no sample, opened no infected file and tested no PC.
- Anything from 2026We found no new report. That does not mean the family is gone; it means we did not see one.
- A clean second scanDoes not clear a PC. File infectors hide in programs a scanner may skip, and the 2009 helpers warned that scanners could not always disinfect them.
Treat an alert as a real infection until a scan says otherwise The threads we read describe real infections, and one reader who called the files false positives later wrote that he should not have. We saw nothing on any PC ourselves. Nothing here clears a PC, and a quiet scan is one result, not a clearance.
How a Virut-type infector works
The family works by infecting programs and switching off the Windows check that would stop it. That is why scanning alone often fails.
| Step | What the sources say | Source |
|---|---|---|
| Switches off protection | It injects code into WINLOGON.EXE and patches sfc_os.dll in memory, which turns off Windows System File Protection so it can infect protected files | Microsoft |
| Infects on access | It infects .EXE and .SCR files when they are used. Copying or viewing files in Explorer, including on shares with write access, is enough | Microsoft |
| Stays in memory | It hooks NtCreateFile, NtOpenFile, NtCreateProcess and NtCreateProcessEx in each running process | Microsoft |
| Calls home | It joins an IRC channel and can be told to download and run a file from a web address | Microsoft |
| Damages files | The infection code has bugs, so some files are corrupted beyond repair and some copies do not run | BleepingComputer, quoting McAfee and AVG |
| Spreads to drives | One reader found every connected drive infected, including .inf files on a USB stick | BleepingComputer, reader report |
| Spreads to web pages | Variants add an iframe to web files, and Google flagged a reader's website pages as malware | BleepingComputer, Avast Community |
How the name turned up, 2008 to 2021
The reports we read run from 2008 to 2013, and the family was hit by a takedown in 2013. We found nothing newer.
30 July 2008
Microsoft's entry
Microsoft published its entry for Virus:Win32/Virut.AP. It was last updated in September 2017.
March 2009
The Avast thread
A reader asked how to remove Win32:Vitro. An Avast employee said it was hard to clean, and a regular poster said XP users had no cure and had to format.
7 April 2009
A Dell laptop
A reader found Win32:Vitro in a taskmsgr.exe inside the Windows service pack uninstall folder. He had already reinstalled Windows many times.
28 December 2009
The Malwarebytes thread
A reader whose Avast kept finding Win32:Vitro in programs and old restore points was told it means a format and reinstall.
27 June 2010
A TV program download
A reader on Windows XP was infected by downloaded TV software. Almost every .exe file was flagged, and he had to reinstall Windows.
January and February 2013
The botnet's domains are taken over
NASK, the Polish domain registry, and CERT Polska took over 43 .pl domains that controlled the Virut botnet. They said about 270 thousand unique addresses connected every day.
19 April 2021
Our first guide
Our guide called Win32.Vitro a trojan from fake codec installers and showed these two windows.
From our 2021 guide, not a picture we took. Top: an avast File System Shield window that moved C:\Windows\cfdrive32.exe to the chest under the name Win32:Vitro. Bottom: another product's list in Indonesian, Virus ditemukan Win32/Virut, with four Windows program files marked Terinfeksi (infected). The title text was added by us. 2026
No newer report found
We found no report of the name newer than the 2013 takedown report and our 2021 guide.
What Win32:Vitro can steal or download
What an infection can cost you
The danger is damaged programs, a backdoor that downloads more malware, and a spread to every drive you plug in.
- High
Damaged programs and Windows files
Microsoft says Virut can damage files beyond repair and that a clean install of the system and programs may be needed. A BleepingComputer reader's PC stopped at start-up, sometimes before the Start menu appeared.
- High
More malware without your say
The backdoor lets an attacker download and run files. Our 2021 guide also said it installs more malware and spyware; the Microsoft entry confirms the download function.
- High
Fake security programs and payments
Our 2021 guide warned that victims may pay for useless security software or give card details to criminals. CERT Polska links Virut activity to fake antivirus software but does not name the programs. Never pay on a warning page.
- Medium
Your drives and your websites
Every connected drive can end up infected, and web files you upload while infected can carry the iframe. Readers on Malwarebytes and BleepingComputer were told to take such sites offline.
- Medium
Cost of waiting
A BleepingComputer moderator wrote that the longer the infection stays, the more system files it infects, so the damage grows with time.
- Medium
Your passwords
BleepingComputer's advice for a Virut infection is to treat every password used on that PC as stolen and change them from a clean computer.
What you may notice, and what the sources show
The signs below come from readers in 2009 and 2010. Some infections show nothing except the antivirus alert.
| Sign | What we found |
|---|---|
| Many programs flagged at once | Reported by every reader. Avast listed almost every .exe file, including files that were part of Windows such as explorer.exe |
| Start-up problems | A reader's PC froze at start-up and only Safe Mode worked. Another could not sign in after a restart, in Safe Mode too |
| New start-up items that return | The BleepingComputer reader found 717.exe and vsbntlo.exe in msconfig. They came back after he switched them off, because infected programs recreated them |
| Redirected searches and blocked security sites | The same reader could not open kaspersky.com and found Google searches redirected. Microsoft says some variants edit the hosts file; we did not check that file |
| Task Manager or Registry Editor blocked | Our 2021 guide said readers could not use them. We found no source for it, so we do not list it as a sign |
| No visible sign | Microsoft says there are no common symptoms and an antivirus alert may be the only one |
How to check the PC for Win32:Vitro
Win32:Vitro detection names
If Windows Security shows Virus:Win32/Virut.AP, it has found Win32:Vitro or a file that belongs to it.
Write the name down before you click Remove: it is the most useful search term later, and you will need it if you report the incident.
A family name in the label is more informative than a heuristic one. Our page on why one threat has many antivirus names lists the common formats and what each part means.
How it gets onto a PC
The sources name cracks, downloads, USB sticks and shared drives. The fake codec route in our 2021 guide is not confirmed.
- 1
Cracks, keygens and warez
BleepingComputer quotes Trend Micro: warez and crack pages were used as download sites for Virut and Virux, with malware found when people searched for serial numbers, cracks and even antivirus products. Banners and ads on those pages were also a route.
- 2
Downloaded programs
One reader was infected through downloaded TV software, another within days of a service-pack download on a PC that had been infected before. Treat any program from a file-sharing page as a possible carrier.
- 3
USB sticks and shared drives
BleepingComputer says Virut commonly spreads from USB sticks, and Microsoft says it spreads through shares with write access.
- 4
Infected web pages
The BleepingComputer moderator cited a security firm that found user pages carrying a malicious Virut link. A visit to such a page can start an infection.
- 5
Fake video codecs
This was the main route in our 2021 guide. We found no source that describes it for Vitro, so we cannot confirm it. Do not install a codec or player that a site says it needs. Browsers play common video on their own.
The habit that covers every route here is to take software from its maker, use no cracks, and scan a stick before you open anything from it.
Check the PC before you delete anything
Find out how many files and drives are involved before you delete anything. Do not hunt single file names by hand.
- 1
Write down the alert
Note the full name, the file path, the process and the time, or take a screenshot. Avast's alert has a line that lets you report a file as a false positive, which is why it matters whether the file is a real program.
- 2
Do not delete system files by hand
Our 2021 guide suggested deleting names such as 717.exe or vsbntlo.exe by hand and warned that you could remove useful files. Those two names come from one reader's 2010 start-up list, and the infection sits in programs that do work, so hand deletion misses it.
- 3
Look at how many files
One flagged file can be a false alarm. Dozens of programs and several Windows files flagged in one scan point to an infector.
- 4
See what else is connected
List the USB sticks, external drives and network shares that were plugged in or mapped. They count as possibly infected too.
- 5
Check start-up and new programs
Press Ctrl + Shift + Esc, open Startup apps and note unknown names. Open Settings > Apps > Installed apps and sort by install date.
- 6
Note the other names
Write down every detection in the scan report, not only Win32:Vitro. A second name can show a trojan or a rootkit; readers in 2009 reported both next to Vitro.
- 7
Do not use the PC for banking
Until it is clean, do not sign in to bank or email on it.
How to remove Win32:Vitro
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Open Task Scheduler from the Start menu and click Task Scheduler Library. Select each task you do not recognise and read the Actions tab:
- a task that starts a file in
%AppData%or%Temp% - runs
powershellwith a long encoded line - opens a web address belongs to Win32:Vitro or a similar program
Right-click such a task and choose Delete, and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
- a task that starts a file in
Step 2: Remove it from startup
Whatever Win32:Vitro installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through
%LocalAppData%,%AppData%, %ProgramData% and the two Program Files folders.Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold
.exe,.dll, .js or .ps1 files are the strongest sign.Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Assume that the passwords saved in this PC's browsers, and the accounts that were open in them, are known to the attacker. From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and gaming accounts.
Use each service's option to sign out of all other sessions, because stolen cookies keep a session open even after a password change. Turn on two-step verification on each account. Wait with the infected Windows 11 or Windows 10 PC until the scans are clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Remove it from Windows 11 and Windows 10
Do the steps in order. For this family the sources expect that a reset or reinstall may be the end of it.
- 1
Disconnect from the network
Turn off Wi-Fi or unplug the cable and unplug every USB stick and external drive. Infection spreads through shares and drives, and the backdoor needs the internet.
- 2
Start in Safe Mode with Networking
Open Settings > System > Recovery, click Restart now beside Advanced startup, then choose Troubleshoot > Advanced options > Startup Settings > Restart. On the Startup Settings screen press 5 or F5 for Safe Mode with Networking. Microsoft says Safe Mode starts Windows with only essential services and drivers, and that Safe Mode with Networking adds the network drivers you need to get online. The 2009 helpers also said cleaning should be done in Safe Mode.
- 3
Update your security product and run a full scan
Update it first, then scan every drive. Our 2021 guide gave the same order. Microsoft's own entry says to run a full-system scan with an up-to-date product.
- 4
Run Microsoft Defender Offline as a second opinion
Open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan and click Scan now. Microsoft says it runs from a trusted environment outside the normal Windows kernel. Read the result under Protection history.
- 5
Expect that cleaning may not work
Our 2021 guide said a reinstall is not needed in most cases. The sources say the opposite for this family: a Malwarebytes helper and a BleepingComputer moderator advised a format and reinstall, and Microsoft says a clean install may be needed because files can be damaged beyond repair. If the scan names Windows system files, or flags the same files again after cleaning, plan the reset.
- 6
Reset or reinstall Windows
Back up your documents first (see the next chapter). Then use Settings > System > Recovery > Reset this PC and choose Remove everything. We could not confirm that this clears an old file infector from every drive. The 2010 advice was to wipe the whole drive, and an install that only overwrites Windows files leaves the rest. If you want certainty, install from Microsoft's installation media and delete all partitions during setup. We did not test either route on an infected PC.
- 7
Scan the other drives before you use them
Scan every stick and external drive from the clean PC. Delete or format the infected ones, and do not reconnect them to the infected PC.
- 8
Change passwords and update Windows
From a clean device, change your passwords. Then install every update under Settings > Windows Update and scan again.
Do not download a cleaning program because a pop-up, a stranger or a phone number tells you to. We name no product as a remover, and our 2021 guide's pointers to a paid repair tool are not repeated.
Saving your files, drives and websites
What you copy decides whether the infection comes back. Copy documents and media, never programs or web files.
| What | What to do | Why |
|---|---|---|
| Documents, photos, music and video | Copy them to a new drive or a disc before you wipe the PC | The helpers in 2009 said back up these and nothing else |
| Programs and installers | Do not copy them. Download them again from the maker | They may be infected |
| .exe, .scr, .htm, .html, .xml, .zip and .rar files | Do not copy them | The Malwarebytes helper listed these as possibly infected, and replaced files would infect the new system again |
| Pictures and documents | Copy them, then scan the copy on a clean PC | The family is described as infecting programs and web files. No source we read says it infects pictures, and an Avast reader's scan found none, but one scan is one result |
| USB sticks and external drives | Scan them on a clean PC, then format the infected ones | A reader found .inf files on a stick still infected after the reinstall |
| Your own website files | Take the site offline, open files only in a text editor, never in a browser, and remove any iframe that was added | The Malwarebytes helper warned that opening an infected page in a browser can reinstall the infection |
| Network shares | Scan every share and take away write access you do not need | Microsoft's steps for a network infection say the same |
After removal: passwords, accounts and prevention
Accounts come next
Because the PC showed an Avast alert for Win32:Vitro on a Windows program file in the list of installed apps, a sign of a program that could read browser data, the clean-up is only half of the work. The other half happens in your online accounts.
Change passwords from a clean device, beginning with e-mail; sign out of all sessions; check forwarding rules and recovery phone numbers; and turn on two-step verification with an authenticator app or a passkey. Ask your bank to replace cards saved in the browser.
Why the order matters and what to check in each account: secure your accounts after malware.
After the cleanup: accounts, money and router
The scans deal with the PC. These steps deal with the accounts, money and router it touched.
- 1
Change passwords from another device
Email first, then banking, then the rest. Turn on two-step sign-in. BleepingComputer's advice was to treat every password used on the PC as compromised.
- 2
Reset your router password
BleepingComputer also advised resetting a router with a strong sign-in so malware cannot take it over before you reconnect.
- 3
Tell your bank
If you used banking or card details on the PC, look at your statements and tell the bank about a possible breach.
- 4
Sign out everywhere
Use the sign out of all sessions option in your Google, Microsoft and social accounts.
- 5
If you were asked to pay
If a window demanded payment for a security program, do not pay. Report the payment to your card issuer if you did.
- 6
Scan again in a week
Run a full scan and a Defender Offline scan a week later, and keep the alert screenshot.
Keep file infectors off your PC
Cracks, unknown downloads and unscanned sticks are how the sources say it spreads, so prevention starts there.
Do
- Keep one security product with Real-time protection on and updated. Microsoft Defender is built into Windows 11 and 10.
- Get programs from their makers' sites or the Microsoft Store, and pick Custom or Advanced during setup so extras can be declined.
- Scan a USB stick or a download before you open it. Use Windows Security > Virus & threat protection.
- Install Windows Update monthly, and update your browser and PDF reader.
- Keep a backup of documents on a disk you unplug (File History or OneDrive). Scan the backup before you restore it.
- Give shared folders the least write access they need.
Don't
- Do not use cracks, keygens or serial-number pages. A BleepingComputer source quoted Trend Micro naming them as the main carriers of Virut and Virux.
- Do not install a codec, player or update that a movie or streaming site says you need.
- Do not watch free copies of paid films on sites that push downloads. Their rules are loose and they have a bad record for malware, though we could not measure it.
- Do not mark a flagged file as a false positive just to quiet the alert.
- Do not call a number or pay a sum shown in an alert.
Questions about Win32:Vitro
What is Win32:Vitro?
Win32:Vitro is the name the Avast antivirus gave to a file-infecting virus. A Malwarebytes helper wrote in 2009 that Vitro is the same thing as Virut, and Microsoft describes Virut as a polymorphic file infector that adds its code to .EXE and .SCR files and may open a backdoor.
It is not ransomware and not a pop-up scam. Our 2021 guide called it a trojan from fake video codec installers; we could not confirm the codec route. An alert tells you a file was flagged, not how many others are infected, so check the scan report and the drives that were connected.
Is Win32:Vitro a virus or a trojan?
It is a virus, more exactly a file infector. A trojan hides inside something that looks useful, while a file infector adds its own code to programs that already work. Microsoft calls the family a polymorphic appending file infector with a backdoor, which means the code changes shape and sits at the end of each infected file.
The backdoor lets an attacker download more malware. Our 2021 guide used the word trojan loosely, and the effect on you is much the same, but the difference matters for cleaning: a trojan is often one file, an infector is spread through many.
Can I remove Win32:Vitro without reinstalling Windows?
Sometimes a scan cleans it, but the sources we read say not to count on it. A Malwarebytes helper in 2009 and a BleepingComputer moderator in 2010 both advised a format and reinstall, and Microsoft says infected files can be damaged beyond repair, so a clean install may be needed.
Our 2021 guide said a reinstall is not needed in most cases, and we no longer repeat that. Try Safe Mode with Networking, a full scan and a Defender Offline scan. If the same files are flagged again, or Windows files are infected, back up your documents and reset or reinstall.
Is my USB drive or backup infected too?
Treat every drive that was connected during the infection as possibly infected. A BleepingComputer reader found every connected drive infected, including .inf files on a USB stick that survived his reinstall.
Copy only documents, photos, music and video. Do not copy programs, installers or .exe, .scr, .htm, .html, .xml, .zip and .rar files, because a Malwarebytes helper warned they may carry the infection.
Scan the copy on a clean PC. Format a stick that scans dirty. We tested none of this on a live infection; it is the helpers' advice from 2009 and 2010.
Does Win32:Vitro come from fake video codecs?
We could not confirm it. Our 2021 guide said the virus spreads through fake codec installers on free-movie sites, but no source we read describes that route. They name cracks, keygens, serial-number pages, a downloaded TV program and USB sticks instead, and Trend Micro's finding, quoted on BleepingComputer, named crack pages as download sites for Virut and Virux.
The safe habit is the same either way: do not install a codec or player that a site says you need. Browsers play common video formats without extra files.
Are Windows 10 and Windows 11 safe from Win32:Vitro?
We found no report of it on Windows 10 or 11, and we cannot say it is impossible. The CERT Polska report on the Virut botnet counted infected machines on eight Windows versions, from Windows 98 to Windows 8.
In 2009 a regular Avast poster said Vista was not vulnerable, and a reader with a Vista laptop then answered that his was heavily infected. So no version was safe by default.
Newer Windows has better protection, but a program you run yourself, such as a crack, can still carry an infector. Keep Windows and your security product updated.
Can it infect my photos and documents?
No source we read says it infects pictures or documents. Microsoft says it infects .EXE and .SCR files, and other reports add web files such as .htm, .html, .php, .asp and .xml, and in some variants files inside archives.
An Avast reader asked the same question in 2009 and his scans found no infected pictures or documents, though one scan proves little.
The practical rule is to copy documents and photos, scan the copy on a clean PC, and leave programs and web files behind. If a document opens normally on the clean PC, treat it as fine until a scan says otherwise.
Could Win32:Vitro be a false positive?
It can, but the name does not tell you. Avast's alert has a link to report a file as a false positive, and one infected reader wrote in 2010 that people should not be too quick to call such alerts false.
A single flagged file in a program you installed from its maker is more likely a false alarm than dozens of programs flagged at once. Check where the file came from, send it for review through the vendor, and keep it quarantined until you know. Do not add an exception to stop the alert before you have checked.
Are 717.exe and vsbntlo.exe still the way to spot it?
No. Our 2021 guide told readers to look for 717.exe and vsbntlo.exe, and those two names come from one reader's start-up list in a 2010 BleepingComputer thread. They came back each time he switched them off, because infected programs recreated them.
The infection is in the programs that work, so a name hunt misses most of it. Use a full scan, a Defender Offline scan and the check chapter on this page. Do not delete system files by hand, because a wrong deletion can leave Windows unable to start.
Will Fortect remove Win32:Vitro?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Win32:Vitro, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Avast Community: win32:Vitro How to protect and how to remove? (March to June 2009) (read October 6, 2026)
- BleepingComputer forums: Win32:VITRO and possible Virut (June and July 2010) (read October 6, 2026)
- Malwarebytes Forums: Win32:Vitro Found But No Blatant Symptoms Present Yet (December 2009) (read October 6, 2026)
- Dell Community: Win32:Vitro - How can I delete it without reinstalling Windows? (April 2009) (read October 6, 2026)
- Microsoft Security Intelligence: Virus:Win32/Virut.AP (published 30 July 2008, updated 15 September 2017) (read October 6, 2026)
- CERT Polska: Virut botnet report (21 February 2013) (read October 6, 2026)
- Microsoft Support: Windows startup settings (Safe Mode) (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline scan in Windows (read October 6, 2026)
- Microsoft Support: Virus and threat protection in the Windows Security app (read October 6, 2026)