malicious look alikes of vmware-vmx.exe

Harmful - Clones

Last Updated on Thursday, 13 June 2013 11:30 Sunday, 09 June 2013 19:33

How to find and remove malicious look alikes of vmware-vmx.exe

It is a legitimate program named VMware Player form VMware which uses similar file name. The default location for this file would be in its sub folder in Program Files folder. If VMware Player is installed on your computer, this file should display the company name as VMware. If this program is not installed on your computer, that is if you are not running any VMware Virtual Machine, then the presence of a file of this name should be suspicious. 

Inform me if you have updated information about default location of  vmware-vmx.exe.

A file by the name vmware-vmx.exe is also created by a computer virus program that affects the computers running on the Microsoft windows operating systems. It's analysis report is given below.

Files - view
C:\windows\system32\vmware-vmx.exe
%Temp%\svchost.exe
%Temp%\Server.exe

(You can also find file size, md5, sha-1 info on the above link)  

(Full path for the short folder names)  

This virus creates a malicious clone of a windows system file named svchost.exe in a temporary folder. 

This virus creates a malicious service named
"Windows Test My Test Server 1.0" 

There may be more files created by this virus program. You can find them out. First locate and note down the "date of creation" of the malicious look alike of vmware-vmx.exe, and after that, search the hard disk for other files created on that date or onward. See image

Necessary steps required to remove this virus program

Detailed instructions and free Tools
Preventive steps to avoid virus programs
Reprinted with permission from Threatexpert.com

Disclaimer 

malicious look alikes of acrord32.exe

Harmful - Clones

Last Updated on Sunday, 09 June 2013 08:17 Sunday, 09 June 2013 08:04

How to find and remove malicious look alikes of acrord32.exe

 It is a legitimate program named Acrobat Reader form Adobe which uses similar file name. The default location for this file is displayed in the image. You may also find the file mentioned in one or two places, which are backup copies etc. However each of these files should display the company name as "Adobe Systems Incorporated".

Also the name of the installation folder would be different with different versions of the Adobe Acrobat reader.  
Let me know if you have any updated info. 

A file by the name acrord32.exe is also created by a computer virus program that affects the computers running on the Microsoft windows operating systems. It's analysis report is given below.

Files - view
%AppData%\Acrobat\AcroRd32.exe
%Temp%\AppLaunch\taskhost.exe
Folders
%AppData%\Acrobat
%Temp%\AppLaunch 

(You can also find file size, md5, sha-1 info on the above link)  

(Full path for the short folder names)  

This virus installer adds a keylogger to the computer. Hence it is very harmful as it may steal your login ID and passwords of your different online accounts. 

There may be more files created by this virus program. You can find them out. First locate and note down the "date of creation" of the malicious look alike of acrord32.exe, and after that, search the hard disk for other files created on that date or onward. See image

Necessary steps required to remove this virus program

Detailed instructions and free Tools
Preventive steps to avoid virus programs
Reprinted with permission from Threatexpert.com

Disclaimer