What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Software

Cannot log onto Windows on laptop attacked by vmmdiag32.exe

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi everyone … I need some expert help from the big guns. Over the past 2 days, I've had the following problems w my computer: 1. Last night, when I powered on the laptop, I got a dialog box that read "Cannot find file vmmdiag32.exe". I borrowed my wife's computer, and through some Internet searches, found that the vmmdiag32.exe is a trojan that attacks the startup and logon processes. At that time, from my infected laptop, I was able to log on to Windows 2. About 30 mins ago, I tried to log on to Windows from my infected laptop … but now it won't even let me log on. I typed in my usual Username and Password, but could not get in. I even used the Fn key (in blue) to get around those cases where the "O" in the password is replaced by a "6". Still no luck. I'm starting to fear that the vmmdiag32.exe has completely prevented me from "getting in" to my laptop. I have some important files stored on the hard drive, so I need to find a way to get in. From reading the forums on this website, I had hoped to be able to connect to Internet on the infected laptop, then download goodies like HijackThis and Ad-Aware. Now it looks like I won't be able to do so. Can you guys help me ? how can I get around my current problem … that is, find a way to log onto Windows ? And, in the worse case, what can I do to salvage the files on the hard drive ?? I'm really in a bind, and desperate for help. Thanks
Post #2
Hi HockeyFighter,

What Operating System is your machine running? for instance: Windows XP? Windows 2000?

If it is XP or 2000…
When you power up your machine, immediately begin tapping F8 continuously until the Boot Menu appears.
(black background with a list of Boot Options)….. Normal - Safe Mode - Safe Mode with Networking - Last Known Good Configuration - etc.

Select - Safe Mode with Networking
Create a New Folder and rename it as C:\HighJackThis\
Go on line to:
http://www.radiosplace.com
Download and Save HighJackThis.exe to your New Folder named C:\HighHackThis\

Run HighJackThis
Select "Run a system scan and save a log file"
HJT will scan your machine, and create a Notepad copy of the Log.
In that NotePad, highlight the entire Log and use crtl-C to copy the entire Log.
Post your log over in the Malware Removal Forum for assistance, here:
http://forums.tomcoyote.org/index.php?showforum=27

If you are unable to access the Internet via your problem machine, use a known-good machine to Download and Save HighJackThis to either Floppy Disk or CD for transfer to your problem machine.
Again Run HighJackThis, save the Log to Floppy or CD and use the known-good machine to post it into the Malware Removal Forum.

Let us know how you are progressing with the above.
____________________________

Next:
Are you able to use a DVD/CD-RW to back up you important documents, files and media?
What other options for back-up have you considered?

Do you have the Operating System CD and Driver installation CD as provided by the machine's manufacturer?

Keep us posted with your progress.

Best Regards
Post #3
I have Windows 2000 Professional. The computer was my mother's laptop from the school where she was a professor before she retired. They told her to keep the laptop after they downsized their IT staff. She basically annointed me as "Technical Support". Bad choice. So I do not have the driver installation CDs or System Oepration CDs. Will the prescription you gave above enable me to "get back into" the infected laptop ? Thanks
Post #4
Yes………(hopefully) When Windows fails to boot Normally, it is often possible to gain access to the Machine via SAFE Mode. Or to get the machine connected to the internet via SAFE Mode with Networking. Both of the above Boot Options allow the owner/user to enter their Windows machine without having Windows open or run active, the various additional applications and processes that Start in Normal Mode. SAFE Mode and SAFE Mode with Networking are for use when the owner/user is investigating problems or attempting to make changes to restore the machine to full functining. It sure would be handy to get copies of the Win2000 installation CD and the Driver CD. Ask for them, if you have any access to that IT department. What "brand name" is the laptop? Sometimes, Drivers are available online from the manufacturer. ***Caution, some Manufacturers, particularly Dell, have added specific scripts into the Windows operating system that "might" make things difficult for you if you eventually try to use a "non-Dell" installation CD. Keep us posted on your progress. Best Regards
Post #5
My laptop is a Dell Lattitude 600 series. I don't have access to the IT department that originally owned the laptop. My mother is your typical retired professor … she threw away her academic address book a few days after retiring. The laptop has C drive and D drive, been partitioned. Which of these drives should I put the HijackThis onto ?
Post #6 last edited
C:\HighJackThis\ Put it as a New Folder on C:\ so that the Folder looks like C:\HighJackThis\ Then when you download HJT.exe it will look like this C:\HighJackThis\HJT.exe Glad to hear that you have a D:\ Don't touch it for now! It is hopefully the "backup Partition" and probably has D:\i386 and D:\Drivers (the backup operating system that we may need to use for Repair) If that is a correct assumption, don't touch D:\ at this time. Get your HJT posted so the experts can have a good look. If more is needed after Malware Removal, you know where to find us. Best Regards
Post #7 last edited
I just started trying to get into Safe Mode. Tapped the F8 key, then selected Safe Mode with networking. Then I selected Windows 2000 Professional. The computer responded with a scrolling list of programs and drivers. How can I create a New Folder for C:\HighJackThis ??? The familiar Log On to Windows box came up, even in Safe Mode. Is that normal ? Or did something else go wrong ?
Post #8
All that is just fine.

Create a New Folder?

Open My Computer or Windows Explorer
Navigate to C:
Click on File (top left in the command line)
Select New
Select Folder

Now you have a New Folder called C:\New Folder
The Folder's name, "New Folder", will already be highlighted, so you can just "type-over" with "HighJackThis"
Now you have a New Folder renamed to C:\HighJackThis\
Post #9 last edited
I should've been clearer in my most recent post. When the "Log On to Windows" box came on in Safe Mode, I tried to enter my User name and Password. However, I ran into a mapping problem with the keys. That is, my user name contains an "O" (as in Oscar). However, when I went to type the "O", the key returned a "6". I had to depress the Fn key on the laptop. Then I typed in my usual password, but the computer still did not accept it. What should I do next ? Sorry for the confusion Thanks
Post #10 last edited
Got another keyboard to try? You probably have a PS/2 connector socket on that Laptop which will accept either a PS/2 mouse or PS/2 keyboard. As for saving the important documents and files that you've mentioned…. You "could" risk a Repair Installation with a Windows 2000 installation CD. Microsoft says it is "non-destructive" to do Repair Installation, but still recommends backing up data. Also, since it's a Dell, there may be some propriatary issues. I just don't know. _______________________________- You "could" remove the Laptop's Hard Drive, obtain an adapter to allow it to connect to a DeskTop machine's IDE ribbon, then use the Desktop to copy/save any files and documents. ______________ You "might" be able to go into BIOS and change the Boot Order, such that Windows would Boot from the D:\ drive, where we "hope" the Repair Console can be accessed for Repair Installation consistent with Dell proprietary issues. _______________________ More "drastically" you may be considering Reformat - Reinstall the Windows operating system. Unfortuanately, it's a Dell. Dell uses proprietary codes (in some cases) directly in the Operating System installation process. I "think" you could download the Drivers for that machine from the Dell Website. I "think" you could use any OEM Windows 2000 installation CD, plus the Product Identification Key from the outside of your machine (a sticker). But I don't know either of these answers regarding Format - Reinstall. More study will be necessary. You might get some answers at the Dell Forums. I'm not turning my back on your problem. I'm just "stuck" right now. But gee, maybe plugging an external keyboard in will get you going. Best Regards
Post #11
OK, will try tomorrow at office. What causes that kind of mapping error on a laptop ? Is there anything that I can do to fix it ? Thanks
Post #12
Dirt. Broken plastic barrier pieces beneath the keyboard. You can "inspect" for the above. Operating System corruption. Driver Corruption. You'd have to be able to boot the machine to test the above. Unknown conspiracy perpetrated by the IT department where the machine originated? :P You'd have to have a supernatural ability to determine this last one. Keep the faith. There will probably be a more knowledgeable Member coming along with the magic solution.
Post #13
OK, thanks for the several possible solutions. How can we send out a flare to get more help from the cavalry ? So, bottom line, even in Safe Mode, I would still need to have the ability to log on to Windows. Is that correct ? What about doing the "Last Good Configuration" in Safe Mode ? Will that alternative get me anything ?
Post #14
Yes, you can try: "Last Good Configuration" Your Documents, saved files, and saved media, should be safe when you do that. You "may" lose any MS Updates and new applications that you might have installed since that Configuration. You can always later go get MS Udates, and you can reinstall any such applications. Give it a try. Keep us posted with your progress. Best Regards
Post #15
My C drive is labeled WINME
C drive has folders like
Autodriver
Dell, which contains drivers

My D drive is labeled as W2K
D drive has subfolder called WINNT, which in turn has subfolders like:
Config
System32
System
DrWatson
etc.

I installed HighJackThis onto the C drive.
Ran the HighJackThis from the C drive.

is that the correct action ?
Or should I run HighJackThis on the D drive ?

Here is the HijackThis file:

Logfile of HijackThis v1.99.1
Scan saved at 4:28:49 PM, on 12/3/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\System32\Ati2evxx.exe
D:\Program Files\Yahoo!\Antivirus\ISafe.exe
D:\WINNT\System32\svchost.exe
D:\PROGRA~1\Iomega\System32\AppServices.exe
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\MSTask.exe
D:\WINNT\system32\stisvc.exe
D:\Program Files\Yahoo!\Antivirus\VetMsg.exe
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\explorer.exe
D:\WINNT\system32\Atiptaxx.exe
D:\Program Files\Real\RealPlayer\RealPlay.exe
D:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
D:\Program Files\BroadJump\Client Foundation\CFD.exe
D:\PROGRA~1\YAHOO!\browser\ybrwicon.exe
D:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
D:\PROGRA~1\YAHOO!\browser\ycommon.exe
D:\Program Files\Yahoo!\Antivirus\CAVTray.exe
D:\Program Files\Yahoo!\Antivirus\CAVRID.exe
D:\PROGRA~1\YAHOO!\YOP\yop.exe
D:\Program Files\QuickTime\qttask.exe
C:\361101032252966165.exe
C:\361101032252978853.exe
D:\WINNT\system32\wuauclt.exe
C:\361101032252978853.exe
C:\361101032252978853.exe
D:\Program Files\Internet Explorer\iexplore.exe
C:\361101032252978853.exe
C:\361101032252978853.exe
C:\361101032252978853.exe
C:\361101032252978853.exe
C:\361101032252978853.exe
C:\361101032252978853.exe
C:\361101032252978853.exe
D:\WINNT\System32\svchost.exe
c:\msupd01.exe
C:\HighJackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SBC Yahoo! DSL
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
F2 - REG:system.ini: Shell=explorer.exe " vmmdiag32.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - D:\Program Files\Yahoo!\common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - D:\Program Files\Yahoo!\common\YIeTagBm.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - D:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [RealTray] D:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "D:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKLM\..\Run: [BJCFD] D:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [YBrowser] D:\PROGRA~1\YAHOO!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Motive SmartBridge] D:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [CaAvTray] "D:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "D:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [YOP] D:\PROGRA~1\YAHOO!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [shell] "D:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O4 - HKCU\..\Run: [WinMedia] C:\361101032252966165.exe
O4 - HKCU\..\Run: [Winstl] C:\361101032252978853.exe
O4 - HKCU\..\Run: [Winstb] C:\361101032252978853.exe
O4 - HKCU\..\Run: [Winstd] C:\361101032252978853.exe
O4 - HKCU\..\Run: [Winstr] C:\361101032252978853.exe
O4 - HKCU\..\Run: [Winsty] C:\361101032252978853.exe
O4 - HKCU\..\Run: [Winstn] C:\361101032252978853.exe
O4 - HKCU\..\Run: [Winstw] C:\361101032252978853.exe
O4 - HKCU\..\Run: [Winstu] C:\361101032252978853.exe
O4 - HKCU\..\Run: [Winstt] C:\361101032252978853.exe
O4 - HKCU\..\Run: [Winstj] C:\361101032252978853.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: SBC Self Support Tool.lnk = D:\Program Files\SBC Self Support Tool\bin\matcli.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Uninstall.exe
O9 - Extra button: SBC Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - D:\Program Files\Yahoo!\common\yiesrvc.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINNT\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - D:\WINNT\System32\Shdocvw.dll
O10 - Unknown file in Winsock LSP: c:\sniffer.dll
O10 - Unknown file in Winsock LSP: c:\sniffer.dll
O10 - Unknown file in Winsock LSP: c:\sniffer.dll
O10 - Unknown file in Winsock LSP: c:\sniffer.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - D:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/0729a5739d4af7…ip/RdxIE601.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINNT\System32\Ati2evxx.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - D:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Iomega Corporation - D:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - D:\Program Files\Yahoo!\Antivirus\VetMsg.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI