Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

posting here as prompted


  • Please log in to reply
4 replies to this topic

#1 awasner

awasner

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:09:44 PM

Posted 08 July 2014 - 03:32 PM

Hi, I'm here because I need help with something and I'm hoping the wise folks in these forums can help me.
I tried to post in the appropriate forums but got the message I wasn't allowed to.
 
I am trying to figure what vmhost.exe is. Removing it from the task manager with all associated processes also removes webdev.exe.
Searching the web for information about these two .exe's has been frustrating. I'm not having much luck trying to figure out what these are.
But elsewhere here in these forums is a post by a moderator that says:
 
"Posted Today, 09:30 AM
If the file is here it is legitimate.

C:\ProgramData\updatetask\vmhost.exe"
 
So I've written this mod and asked him for more information about vmhost, I mean what is it? Where does it come from?
I'm not good with these things, they are difficult for me. If anyone has information on what these processes are and where they come from, I would appreciate it. Elsewhere on the web some people are saying they're trojans. I've tried a bunch of anti-virus programs and the only thing I've found that even seems to notice vmhost.exe is malwarebytes. But on their site I'm not finding much info about this .exe.
 
Any help or info you can give about what this .exe is and where it comes from would be appreciated. If it's legit it would be good to know more about it so we can clear this up for people who are finding in their running processes and spending a lot of time trying to remove it. Thank you!

Edited by Andrew, 08 July 2014 - 03:52 PM.
Mod Edit: Moved from Intros - AA


BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,331 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:12:44 AM

Posted 08 July 2014 - 06:55 PM

See http://pubs.vmware.com/vsphere-51/index.jsp?topic=%2Fcom.vmware.powercli.cmdletref.doc%2FVMHost.html

AS I replied in your PM

if yours is here
C:\ProgramData\updatetask\vmhost.exe

It is most likely the legit one, any where else it is malware.


Vendor and version information [?]

vmhost.exe does not have any version or vendor information.


Digital signatures [?]


vmhost.exe is not signed.

VirusTotal report

1 of the 52 anti-virus programs at VirusTotal detected the vmhost.exe file.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 awasner

awasner
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:09:44 PM

Posted 09 July 2014 - 12:21 PM

boopme, thank you very much for your responses. I did go to the link you provided and, for me, I still have no idea what vmhost.exe is. weddev.exe is associated with it, and they all seem to come from mediadev.exe.  unhackme did remove them permanently whereas other anti-virus and anti-malware products either didn't think they were malware or did remove them only for them to come back.  Removing all traces of mediadev.exe and vmhost.exe from my pc and it's registry worked.  I have no idea if it was malware or not, but having processes running on my pc that I do not know what they are that suddenly appear one day is not something I want.  unhackme did view these .exe's as a threat.

 

So whatever it was, it's gone. vmhost.exe was using a lot of cpu.

Thank you again. You have a good community here, you do a well needed service and obviously help a lot of people.



#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,331 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:12:44 AM

Posted 10 July 2014 - 02:18 PM

best I can come up with is a product by TODO (it's Chinese).
Perhaps this
https://todo.ly/
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 awasner

awasner
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:09:44 PM

Posted 10 July 2014 - 02:44 PM

Thank you, if I find out more I'll let the community know.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users