Thursday, 1 March 2007

VMNET.exe VM Antivirus Malware!

Just had a small problem with a small piece of nasty malware, which wasn't caught by my anti-virus software.

If you are having a problem of Windows XP hanging just after choosing the username to login with, look for a file named vmnet.exe, if you do have it, it is the one which is causing you the headache. It was caught by Windows Malicious Software Removal tool, however it could not remove it.

Be warned that its "name" is VM Antivirus, but it is obviously a misleading name to discourage you from removing it.

This is how I solved my problem:

  • Seach for files named vmnet. You will find vmnet.exe in C:\Windows\System32.exe, and a VMNET..pf file, (which is reloaded if you remove the VMNET.exe). Delete all files with vmnet in the name.
  • Search in the registry (regedit) for vmnet (not vmnet.exe because there are explicit reference to just vmnet probably for reloading the file if you delete it), and remove all references to it.
  • Restart your pc and you now should be rid of this malware.