[Win 10] How to fully hide VMware services in your virtual machine

Things you’ll need to have/have open:

  • 1. Resource Hacker (free program on download.net)

    https://download.cnet.com/g00/Resource-Hacker/3000-2352_4-10178587.html?i10c.encReferrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNhLw%3D%3D&i10c.ua=1&i10c.dv=14
  • 2. Regedit
  • 3. Icons to replace VMware's default one (you can get these on Google)
  • BEFORE PROCEEDING: make a fullbackup of your registry by opening regedit as admin and click File->Export. Alternatively you could just make a snapshot.

    Additional Info:
    - Be sure to run both Resource Hacker and Regedit as administrator.
    - Be sure to delete the uninstall registry so it doesn't appear in appwiz.cpl
    To do this go to:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
    In your registry and locate the VMware tools (it should be labled random numbers and letters, delete the whole folder affiliated with VMware Tools. Now it won't show up in appwiz.cpl :)
    Fully hide the VMware folder in program files by right clicking into the folders properties. Under attributes you should be able to tick the hidden option. Now it won't appear in program files :)

    Renaming VMware services to your choosing:
    -----You may need to inherit permissions and give yourself full access in Program Files to edit the .exe's----

    Run Resource Hacker as administrator and open C:\Program Files\VMware\VMware Tools\vmtoolsd.exe (file path maybe different if you chose to install elsewhere). Here you can change everything you need including icon (this will also change the icon in the process tab)

    For an example, I named mine "Pornhub Core Service"
    -To change the icon: Open the Icon Folder and select 1:0 <- RIGHT CLICK -> Replace Icon..
    to that of your choosing, just make sure its in ".ICO" format.

    -To change the .exe info: Open Version Info 1:1033 and replace anything related to VMware
    Example:
    12 VALUE "CompanyName", "Pornhub, Inc."
    13 VALUE "File Description", Pornhub Upload Service"
    14 VALUE "File Version", "3.8.12"
    15 VALUE "InternalName", "PHUS"
    16 VALUE "LegalCopyright", "Copyright \xA9 1998-2018 Pornhub, Inc."
    17 VALUE "OriginalFileName "phus.exe" ---REMEMBER THE .EXE NAME!, It's important!"
    18 VALUE "ProductName", "Pornhub Upload Service"
    19 VALUE "ProductVersion", "3.8.12"

    Just note: This is purely an example, you can go anyway you'd like with this.

    Now open the Manifest and change the remaining stuff to remove VMware (try to keep it the same) The only two things you only need to change here are these:
    - name="PHUS.PHUS.phus"
    <description. "Pornhub Upload Service" </description>

    Now save as the .exe (so for me its phus.exe) and save it to your desktop.

    Open task manager and stop vmtoolsd and the Vmtoolsd process in the process tab

    Now delete the vmtoolsd in the VMware program files folder and save your new .exe in there.

    Now open regedit and navigate to:
    Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMTools\

    Strings to edit:
    Description: Provides support for synchronizing uploads to the core server and the recipient.
    Display Name: Pornhub Core Service
    Image Path: C:\Program Files\VMware\VMware Tools\PHUS.exe

    Restart the virtual machine.
    If you can't use your mouse in your VM, you didn't copy the exact .exe name or image path to the registry, resulting in VMware Tools to not load at all.

    You can follow these exact same steps to rename all of the services in relation to VMware. It's a bit tedious but well worth it.

    The only thing left is figuring out a way to edit the information in MSINFO32, which I haven't been able to do yet, so thats the only thing I have disabled in my VM currently.

    PS, sorry if this guide is hard to follow, if you'd like I can do a youtube video in regards to this. Just let me know.

    Vyral
    aka Daniel O'Brien

    @MmorpgFanatic#60497 I can’t see VMWare tools anywhere in Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMTools</p>