Virtualization tools mostly install tools on the guest machine to enable clipboard synchronization, drag and drop, mouse synchronization, and other useful features. These tools can be easily detected by scanning for these processes using the CreateToolhelp32Snapshot, Process32First, and Process32Next APIs. Some of these processes are as follows:
- VMware:
- vmtoolsd.exe
- vmacthlp.exe
- VMwareUser.exe
- VMwareService.exe
- VMwareTray.exe
- VirtualBox:
- VBoxService.exe
- VBoxTray.exe