What is vmhost.exe?

Malwarebytes says there is malware file contained in that somehow???? M wqre bytes quarentines it and I can re scan and M bytes finda it there again 3 scans in sequence. Malwarebytes names it as PUP.OPTIONAL.VMHOST.A

# 22 Jun 2014, 10:52

vmhost.exe in my case is an unwanted file that establishes itself every time I turn on my laptop. It uses a high percentage of cpu processes and I can tell when it's there when my PC's fan keeps cycling on. My attempts to delete haven't kept this file away. I do not know where it comes from and how it works it's way onto my PC. It is responsible for playing small advertisement audio files randomly in the background without authority. I then go to resource monitor and terminate processes each time. For me this is definitely malware and I am looking for a way to delete from my PC,

# 22 Jun 2014, 12:55

Reply to Jim okeefe, Jim I have not tried this yet, but, you may want to, if it works let me know as I am waiting for a response from tech at comodo here is link http://www.bleepingcomputer.com/forums/t/538174/background-audio-ad-vmhostexe/ good luck

# 22 Jun 2014, 19:17

I inherited the PUP.Optional.VMHost.A in my computer like all the others. I found this site and downloaded this free program called FreeFixer as Roger Karlsson suggested. It worked. It found VMHost and destroyed it. Thank you Roger. I do appreciate your help.

# 25 Jun 2014, 16:27

I have the vmhost like others. I downloaded freefixer and ran it several times. I check all the vmhost I can find, after that it tells me to reboot asap to remove it. After reboot the vmhost comes back. I don't know why it worked for others and not for me. Could it be because I'm running XP Pro?

Thanks,
Mike

# 30 Jun 2014, 16:08

can anyone tell me how many legs a cat has?
Now I am still having this vmhost showing up. It has to do with virtual machine software and the cloud I believe. I'm geting suspicious of Chrome drive or whatever chrome has using the clound. I see some programs associated during different scans I have done like WOW which is War of Worlds game that was around as a commercial and fee download. Whatever it is it seems to be spread around associating itself with a lot of systems. I put it on the deny list of my firewall and it seemed to slow it down and tonight Kaspersky 14 picked it up as malicious threat and did a complete scan and removal. We shall see, so far not sight of it. It has been a real bitch to get rid of. By the way the tried part of the free fixer that erases the file but it didn't work. I didn't really use the program to it's full ability. Are others having good luck with it.?

# 30 Jun 2014, 23:44

Disregard everything is my last post, all my feelings and suspicions are wrong. This is a real pain in my arse. I have a question about freefixer. Does the vmhost or whatever need to be active in processes. I am going to give your program another look since I haven't a clue. jim okeefe

# 3 Jul 2014, 21:03

I am having exactly the same experience as Jim Okeefe. I reported to Kaspersky and they added in their updates. Was gone for a few days and then back again! It may reinstall on boot up, but seems to be activated indiscriminately. I have not found a consistent program the causes it to appear. Some times Magic Jack, sometimes Explorer, sometimes Google, etc... Very frustrating.

# 4 Jul 2014, 8:42

Thanks Roger, that did it. Don't know what I would have done without you. Here is everything I checked to get rid of it...

-Processes
C:\Documents and Settings\All Users\Application Data\UpdateServer\1404082178\webdev.exe


C:\Documents and Settings\All Users\Application Data\UpdateTask\vmhost.exe


C:\Documents and Settings\All Users\Application Data\UpdateTask\vmhost.exe


-Services
MediaDevSrv MediaDevSrv c:\documents and settings\all users\application data\mediadev\1393528954\mediadev.exe

WinDevSvc WinDevSvc c:\documents and settings\all users\application data\updateserver\1404082178\webdev.exe


-Recently created or modified files
C:\Documents and Settings\All Users\Application Data\UpdateTask\vmhost.exe


-Csrss.exe's virtual memory files
C:\Documents and Settings\All Users\Application Data\UpdateServer\1404082178\webdev.exe


C:\Documents and Settings\All Users\Application Data\UpdateTask\vmhost.exe


Finished
The repair was successfully.

Scan again

Delayed removal
The following files could not be removed at the moment. They will be deleted when you reboot your machine. Please reboot as soon as possible.

c:\documents and settings\all users\application data\mediadev\1393528954\mediadev.exe
C:\Documents and Settings\All Users\Application Data\UpdateTask\vmhost.exe

Thanks again,
Mike

# 4 Jul 2014, 10:48

Found the same thing webdev.exe seemed to be my problem. Thanks.

# 4 Jul 2014, 11:51

Mike M's post of today 7/4/2014 is correct - there are a lot of executables that we need to remove. I have MS Sec Essent. and you need to hit the "show processes from all users" to see all that sh*t... Plus - MsMpEng.exe is the MS malware protection gives 20% processor time - it might be from the FreeFixer prog. Plus there is a malware- sv.exe, chinese hieroglyphs, product TODO - Even this PRODUCT IS COPYRIGHTED, mediadev.exe (chinese copyrighted) Who could believe in this -- that some a**fu***ng chinese id**t will copywright his malware!!!!!!! Will post another message

# 5 Jul 2014, 0:37

-continued...
MsMpEng.exe is not able to detect the malware.
freefixer was able to detect other problems on the computer.
I finished the removal and i'm happy with the results!
Thank you!

# 5 Jul 2014, 1:37

@Roger Karlsson, yes, one day after the clean up everything is OK! Microsoft Security Essentials was not able to detect it, despite the latest virus definitions were downloaded.
Hope you're OK!

# 5 Jul 2014, 23:43

vmhost is programmatically created by mediadev.exe and/or the other exe (don't remember the name right now). I renamed the vmhost.exe to vmhost.exenooo and it did not help because later i found out there was a new copy of vmhost.exe in the same folder where the renamed vmhost.exenooo was! How this sh*t came to my computer I could not tell, unless I have the same thing to be repeated. I have also my Windows Task Mgr permanently on the taskbar in order to visualize eventual non-welcomes to my comp.

# 6 Jul 2014, 22:23

Well I think I'm free of the vmhost.exe. I decided to remove the 2014 Kaspersky Internet Security. I have been using KIS for 3 years without issues until now. The user interface is really bad, continually resizing pages that open with upper right navigation choices out of sight. No help from customer service with issues. You get sent a tack sheet to accomplish and send back. I would guess 80 or 90 percent of people say screw it. And the biggest thing is it never flagged vmhost. Even when gave it a deny status and came back through. So I deleted it and sent a complaint to KIS. I downloads free antivirus (avast) and a free Malware remover Malwarebytes. Guess what, the vmhost was quicky shown to be suspicious and is keep out,mhout tried getting through and each time it was blocked. It doesn't seems to be even trying anymore. Between those 2 free software, doing a malwarebytes scan found many questionable programs and 'Avast has a much nicer graphic interface and for a free program it's fairly full of options and securities. No More vmhost.exe thank you free downloads. If I see it again on my PC which may happen I will surely let you know. Peace jim okeefe

# 8 Jul 2014, 16:46

thank you very much for this software.
I kept having an instance or 2 or vmhost.exe popping up on my computer that i could eliminate by stopping the 'process' or 'process tree' but every time i turned my computer back on it would return (I also shredded the file that was in 'c:\ProgramData\UpdateTask\' folder.)
through some research, I found that wevdev.exe was associated with it, but was unable to locate that file. Upon further investigation, (after using your software and finally being able to see webdev.exe and deleting it) I also found that mediadev.exe was also one of the culprates responsible for reloading vmhost.exe. But, after running your software and locating these 3 items and removing them, PROBLEM SOLVED. Again, THANK YOU FOR THIS FREE SOFTWARE

# 27 Jul 2014, 15:41

I had a bad case of vmhost.exe on my Windows XP. I deleted it several times, but it came back with vengeance. It would cause the active screen to flicker, and sometimes it would buzz in the background. It would sometimes grab up to 95% of the resources. It would also cause the PC fan to go up in speed.

Freefixer would delete it, but it would always come back. It is VERY important to delete it's 2 buddies, if present: mediadev.exe and webdev.exe. These seem to reboot vmhost.exe. After freefixer presents the scan results, delete everything that has any of these 3 names in it. This seems to have worked for me. Much faster, and no more instances.

# 6 Aug 2014, 18:49

bad on me...THANKS to Gary Smith for the tips, and a BIG THANKS to Roger for the software.

# 6 Aug 2014, 18:53

OK - I'll bite... I know the locations of the 3 files discussed. Try as I might I am unable to erase either
mediadev.exe or webdev.exe. No matter what I do I get
ACCESS DENIED. I've tried using attrib and several other utility programs I have available and can't get rid of the things. I constructed a batch file to get rid of vmhost.exe and that successfully erases it but the other two mentioned defy all attempts to get rid of them. Looking for any/all suggestions - PLEASE.

Thank you,
Joe

# 14 Aug 2014, 5:11

Hi Joe, when I did a "scan" with the free fixer software, there were at least 8 or so listed items that had those 3 malwares in them. They were not all .exe programs, but things like storage places etc. I'm not a computer geek so I can't get more specific. I simply clicked the box next to these items, then hit delete.

Also, make sure you do a complete scan of everything, so all the listings take place. It took about 10 mins for freefixers to go through everything on my XP machine.

John

# 15 Aug 2014, 12:44