What is Vmnat.exe?
Vmnat.exe is a legitimate process file popularly known as VMware NAT Service. It is associated with VMware Workstation developed by VMware Player software company. It is located in C:\Windows by default. Malware programmers create files with virus scripts and name them after Vmnat.exe with an intention to spread virus on the internet.
Affected Platform: Windows OS
How to check if your computer is infected with Vmnat.exe malware?
Keep an eye for the following symptoms to see if your PC is infected with Vmnat.exe malware:
- Internet connection fluctuates
- Vmnat.exe takes too much CPU space
- PC slows down significantly
- Browser automatically redirects to some irrelevant websites
- Unsolicited ads and popups starts appearing
- Screen freezes constantly
Take the following steps to diagnose your PC for possible Vmnat.exe malware attack:
Step 1: Simultaneously press CTRL+ALT+DEL keys to open Task Manager.
Step 2: If you notice the file located outside C:\Windows, then you should run an antivirus scan to get rid of the malware.
How to remove Vmnat.exe malware from system using Comodo Antivirus?
Step 1: Download the award-winning Free Antivirus.
Step 2: Installation configuration frames will be displayed. Select the configuration you would like to apply.
Step 3: After network detection is complete, press “Close” button for a scan window.
Step 4: Restart your PC.
Step 5: It will take some time for the Comodo Internet Security to update the antivirus.
Step 6: Proceed with a quick scan that automatically begins after the update.
Step 7: If threats are found during the scanning, you will be prompted with an alert screen.
Step 8: Comodo Antivirus will remove the Vmnat.exe virus from your computer including all other malwares!
| No. | Company | File Type | SHA1 | MD5 | Malware Name |
Digitally Signed |
File Version |
Product Version |
Submitted From |
Malware Behavior |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | N/A | Executable | fbe4dc4041afb6cd 4bb4e290672063e1 d2da30b5 |
c085abf5ab2beec3 5b5e94c367693c07 |
Backdoor.Win 32.Hupigon.a vkm0 |
No | N/A | N/A | Internal Submission |
N/A |
| 2 | N/A | Executable | 1ae7d544af7dc7c3 1d94bb0d680ab56d ac33ecee |
75d914ee4a7b47c8 7f1f76fc00b37422 |
Backdoor.Win 32.DarkKomet .GH |
No | N/A | N/A | Romania |
N/A |
| 3 | VMware, Inc. | Executable | c267ed80a2cc4fd5 17792b15814f5fc5 947765af |
d6ec91f5e52cfa98 c7dcc54a5f724738 |
Worm.Win32.M abezat.b4 |
Yes | 6.5.3 build-1854 04 |
6.5.3 build-1854 04 |
176.16.15.19/32 |
N/A |
| 4 | N/A | Executable | 9e5dd3c26fe599f8 52a532b42dfdec5b fb738f39 |
0a7f4b8886154ca1 16e685f60a6b9922 |
Backdoor.Win 32.DarkKomet .GH |
No | N/A | N/A | Poland |
N/A |
| No. | Company | File Type | SHA1 | MD5 | Digitally Signed |
File Version |
Product Version |
Submitted From |
|---|---|---|---|---|---|---|---|---|
| 1 | VMware, Inc. | Executable | 290a12ae585cb8f0 7c7e7cecfb18ffdf 5c315848 |
240ec1879073d0d7 0df7150a5927580d |
Yes | 17.0.2 build-2158 1411 |
17.0.2 build-2158 1411 |
United States |
| 2 | VMware, Inc. | Executable | c6045887710e25d6 4f0a5f7d73913530 2c4c717a |
bbc9253e7f064791 f389852da6c855e5 |
Yes | 12.0.1 build-3160 714 |
12.0.1 build-3160 714 |
10.108.17.115/32 |
| 3 | VMware, Inc. | Executable | 470b1c1b9cc65e80 7d8cc04a5ff097b8 e0fe5ee0 |
428d30193e52653b 792688daf0c50d9b |
Yes | 6.0.3 build-8000 4 |
6.0.3 build-8000 4 |
United States |
| 4 | VMware, Inc. | Executable | 7adc54c6fa7db4eb 403b81ac25f2df63 fcd469b2 |
709b9008bcc9e037 5d0a45b08f4c48ed |
Yes | 9.0.1 build-8942 47 |
9.0.1 build-8942 47 |
10.224.1.53/32 |

Internal Submission
Romania
Poland
United Kingdom
Spain
Iran, Islamic Republic of
Indonesia
United States
Korea, Republic of
Brazil
Germany
Lithuania
Russian Federation
Singapore
Austria
India
Canada
Turkey
Japan
Netherlands
France
