I f you cannot access the disk online (except for reverting to the snasphot) you may consider to either attach the virtual disk (ensure you attach the latest snapshot!!!, i.e. the .vmdk file which shows up in the VM's .vmx file - you need to edit the helper VM's .vmx file manually for this.) as an additional virtual disk to a helper VM or use the VMware's diskmount utility to mount the virtual disk (again, the latest snapshot) to the host system. This will at least allow you to scan the disk for viruses etc. and check registry entries (e.g. Winlogon, Run, RunOnce, ... entries).
You may also be able to do this online (after reverting). In this case I'd alos use Sysinternal's/Microsoft's AutoRuns utility to see whether this shows something unusual.
André