#1
Inactive
Profile: Join Date: Oct 2006
Posts: 7
Computer Experience:
virus called vmmdiag32.exe wont go away(with hijackthis log)
Hi realised someone else had this virus on here and need to provide the hijackthis log so here it is. I think I may have a few virus because they keep poping up in avast and then when I try and delete them they wont delete. Thanks for any help I may recieve.SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.bbc.co.uk/ http://www.iqon.ie http ://www.iqon.iehttp://www.pcpitstop.com/pcpitstop/PCPitStop.CAB http://pcpitstop.com/internet/pcpConnCheck.cab http://spaces.msn.com/PhotoUpload/Ms...cab?10,0,911,0 http://scan.safety.live.com/resource...scbase5059.cab http://messenger.zone.msn.com/binary...t.cab31267.cab http://messenger.msn.com/download/Ms...Downloader.cab http://locator1.cdn.imagesrvr.com/si...reeInstall.cab http://static.zangocash.com/cab/Zang...d084361d36488e http://mvnet.xlontech.net/qm/fox/061...ie06101001.cab
Didn't find the information you thought to find?Similar Threads
#2
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
Hello and welcome to WindowsBBS Forums.haxfix.exe Double click on haxfix.exe to install haxfix. (standard installation path is c:\program Files\haxfix)
Checkmark "Create a desktop icon"
Click "Next"
When the installation is completed, make sure that the checkmark "Launch HaxFix" is placed
Click "Finish"
1. Make logfile
Select option 1. Make logfile by typing 1 and then pressing Enter
Haxfix will start scanning the computer. When it is finished a logfile will open: haxlog.txt
Copy the contents of that logfile and paste it into this thread. (c:\haxfix.txt)
#3
Inactive
Profile: Join Date: Oct 2006
Posts: 7
Computer Experience:
this is what came up.
#4
Inactive
Profile: Join Date: Oct 2006
Posts: 7
Computer Experience:
Hi just looking through my HJT log I seen this file
#5
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
Lets please get another HijackThis! log file before we go deleting anything, even tho we know that file is the baddie.
#6
Inactive
Profile: Join Date: Oct 2006
Posts: 7
Computer Experience:
Quote:
Originally Posted by TeMerc
Lets please get another HijackThis! log file before we go deleting anything, even tho we know that file is the baddie.
SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.bbc.co.uk/ http://www.iqon.ie http ://www.iqon.iehttp://www.pcpitstop.com/pcpitstop/PCPitStop.CAB http://pcpitstop.com/internet/pcpConnCheck.cab http://spaces.msn.com/PhotoUpload/Ms...cab?10,0,911,0 http://scan.safety.live.com/resource...scbase5059.cab http://messenger.zone.msn.com/binary...t.cab31267.cab http://messenger.msn.com/download/Ms...Downloader.cab http://mvnet.xlontech.net/qm/fox/061...ie06101001.cab
#7
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
Ok, lets fix what's left with HJT .check the boxes next to them and press the "Fix Checked" button with HijackThis . When you are doing this, make sure you have No IE windows, or other browsers open , including this one. Reboot if I have specified below, and post a fresh HijackThis log.R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.iqon.ie safe mode , this way:F8 > key. Safe Mode and press the <Enter > key. 'Show Hidden Folders' option, like this:Start . My Computer . Tools menu and click Folder Options . View Tab . Under the Hidden files and folders heading select Show hidden files and folders. Hide protected operating system files (recommended) option. Yes to confirm. OK .search for, then delete , if found, (some may not be present after previous steps) the following files/folders:vmmdiag32.exe<<<--this file exit Safe Mode, click the Start button, click Turn Off Computer , click Restart .HJT log back into this thread please.
#8
Inactive
Profile: Join Date: Oct 2006
Posts: 7
Computer Experience:
First I would like to say thank you for your easy to follow instructions. Some other sites I have been on tell you to do things like go into safe mode but they dont think that not everyone knows how to do this. Right here is my new HJT log and I deleted them 2 files and the message is gone so hopefully thats a good sign.SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.bbc.co.uk/ http ://www.iqon.iehttp://www.pcpitstop.com/pcpitstop/PCPitStop.CAB http://pcpitstop.com/internet/pcpConnCheck.cab http://spaces.msn.com/PhotoUpload/Ms...cab?10,0,911,0 http://scan.safety.live.com/resource...scbase5059.cab http://messenger.zone.msn.com/binary...t.cab31267.cab http://messenger.msn.com/download/Ms...Downloader.cab http://mvnet.xlontech.net/qm/fox/061...ie06101001.cab
#9
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
Glad to hear things are running better, and the log looks fine.
#10
Inactive
Profile: Join Date: Oct 2006
Posts: 7
Computer Experience:
Quote:
Originally Posted by TeMerc
Glad to hear things are running better, and the log looks fine.
http://www.iqon.ie
#11
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
Oh, ok those are not files but entries, the only file deletion was this one:TIF (Temporary Internet Files) C:\Windows\Temp folder Index.dat Suite new system restore point for your machine. Set New System Restore Point any other accounts on this machine, they too, must be cleaned with AdAware, Spybot S&D, then HJT . Not all infections are global, nor are all the HJT fixes global. You can post each user account here into this thread, but please, do only one at a time to avoid confusion. XP User Accts Security Apps Operation prevent the installation of ad /mal/spyware, DL the apps below, which are just as good the fight against ad /mal/spyware as AdAware & Spybot S&D:SpywareBlaster SpywareBlaster v3.5.1 , just DL, install and check for updates , enable Internet Explorer protection, and your done! I don't recommend using IE restricted sites protection as it's not a very large database. Use IE-SPYADs below.IESPY ADS MVPS Hosts File WinPatrol v10.0.5 SiteAdvisor Rogue/Approved Anti Security apps ALL your security needs here:Calendar of Updates here TeMerc Test Box Forum
#12
Inactive
Profile: Join Date: Oct 2006
Posts: 7
Computer Experience:
Quote:
Originally Posted by TeMerc
Oh, ok those are not files but entries, the only file deletion was this one:
vmmdiag32.exe
Well, you're good to go now.
We have 3 more things to do, to help ensure you have removed all the little 'leftovers' which may be hiding:
Empty the
TIF (Temporary Internet Files)
Delete all the files in (and any subfolders of) the
C:\Windows\Temp folder
The app below will help with temp files.
Index.dat Suite
Also, delete all your cookies, and empty your recycle bin. But remember, by deleting your cookies, you will have to re-enter any passwords and log-in info for any sites you are usually required to do so with.
This would also be a good time to set a
new system restore point for your machine.
Set New System Restore Point . Do not do this unless there are no other user accounts to be diagnosed.
Also, as you are an XP user, if there are
any other accounts on this machine, they too,
must be cleaned with AdAware, Spybot S&D, then HJT . Not all infections are global, nor are all the
HJT fixes global.
You can post each user account here into this thread, but please, do only one at a time to avoid confusion.
Here is a link which describes how security apps work with WIN XP machines.
XP User Accts Security Apps Operation
To further
prevent the installation of
ad /mal/spyware, DL the apps below, which are just as good the fight against
ad /mal/spyware as AdAware & Spybot S&D:
SpywareBlaster
With
SpywareBlaster v3.5.1 , just DL, install and
check for updates , enable Internet Explorer protection, and your done! I don't recommend using IE restricted sites protection as it's not a very large database. Use IE-SPYADs below.
To avoid known malware infested sites from loading in IE install
IESPY ADS .
And
MVPS Hosts File will accomplish a similar tactic and provide another layer of protection.
And to prevent unknown applications from being inserted to start up on your machine install
WinPatrol v10.0.5 .
Another thing I would suggest, is to install
SiteAdvisor . It gives sites a few different 'ratings' and while not fool proof, a good additional layer of information about many sites.
Links for tutorials for all the apps I mentioned can be found on my site as well.
Confused about which apps are good or not? Read about
Rogue/Approved Anti Security apps
And just because you have security apps installed, they are useless unless updated regularly. Keep track of updates for
ALL your security needs here:
Calendar of Updates
Subscribe to update alerts for all the above security apps
here .
You can also see my own ongoing security testing with all the above apps proving how securely you can safe with them installed.
TeMerc Test Box Forum
Happy surfing!!
Tom
Everything seems to be done now thanks alot for all the help. i know which site to come to if I ever need help and what site to recommend to people.
All times are GMT +1. The time now is 13:40 .
