SMART-Followed Fix But Some Files Still Hidden

[mcnamara9]

New member to the forum and this site has been great so far. Thanks everyone.

I followed the blog's steps to remove SMART virus and everything worked well except my shortcuts on the Start menu for my various programs were not restored. Program Folders are there, but the shortcuts are not. Also, the shortcuts that are at the top portion of the start menu were not restored either.

I saw on other threads that there were similar problems, but they use XP and the utilities suggested do not work with Win7.

Any help would be greatly appreciated.
-Brian

 

[Jack]

Hello mcnamara9,
This rogue has moved your saved pinned task bar items and other shortcuts into the temporary internet folder, so now we will have to copy them back to their original location.
Step 1: Enable on your system the 'Show hidden files, folders, and drives' option.
<ul>
<li>IGo to <>Computer</> → Click on the <>Organize</> tab → select <>Folder and search options</>.</li>
<img title="Enable the option to see hidden files" src="http://malwaretips.com/images/removalguide/view-hidden-items.png" alt="[Image: viewhiddenfiles.png]" width="338" height="351" border="0" /></li>
</ul>
In the new window that appeared select the <>View</> tab and choose the option <>Show hidden files, folders, and drives</> then click Apply and OK.
<img title="Show hidden files, folders, and drives" src="http://malwaretips.com/images/removalguide/see-hidden-files.png" alt="[Image: Show hidden files, folders, and drives.png]" width="297" height="360" border="0" />

Step 2: This rogue software has moved your shorcuts in a folder in the Temporary Internet files called <>smtmp</>, so now we will need to copy them back to their original locations.

You can find the <>smtmp folder</> in <>C:\Users\[Your Username]\AppData\Local\Temp</>

<img title="Copy the content of each folder to their original location" src="http://malwaretips.com/images/removalguide/path-to-hidden-files.png" alt="[Image: Show hidden files, folders, and drives.png]" width="708" height="183" border="0" />

The <>smtmp folder will contain 4 folders</> and you'll need to copy the content of this folders back to their original locations.

Copy the content from %Temp%\smtmp\1\ TO C:\ProgramData\Microsoft\Windows\Start Menu
Copy the content from %Temp%\smtmp\2\ TO C:\Users\[your username]\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\
Copy the content from %Temp%\smtmp\3\ TO C:\Users\[your username]\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
Copy the content from %Temp%\smtmp\4\ TO C:\Users\Public\Desktop

 

[mcnamara9]

Thank you for the reply. Much appreciated. I followed those steps, but I only have folders 1 and 4 (see attached screenshot showing folders 1 and 4 only). I'm missing 2 and 3. Any ideas on how I can fix my shortcuts on my start menu now?

 

[Jack]

Your start menu shortcuts should be in Folder no.1. Did you copy the content of this folder back to its original location? Can you show me a screen shot on how the start menu looks right now?
Lets try another trick....
1.Download this utility from tweaking.com: http://www.tweaking.com/content/page/repair_missing_start_menu_icons_removed_by_infections.html
2. After the download process has completed, double click on the icon and the Click the Start button.

 

[mcnamara9]

Thank you for the reply. Unfortunately, the start menu contents are not in there (see attached 2 screenshot of contents). I ran the Tweaking utility before I took these snapshots and checked my start menu, but still no shortcuts to start the application in the folders under program files. It just says "empty".

 

[Jack]

You are running on Windows 7 64bits right?
If Yes, then please download the following utility and run it : http://download.bleepingcomputer.com/grinler/fakehdd/win7-x64-sm-reset.exe
This should restore back you Start Menu items.....

 

[mcnamara9]

Jack, yes I have 64-Bit Win7 so thanks for the tip! I downloaded the utility and my start menu is beginning to look normal again, however, the various programs I have installed still do not have the shortcuts in their program folders (see attached image). I got the snipping tool back and other windows accessories, but still can't find the non-windows programs shortcuts that should be in my start menu program folders.

Everyone's help with this is much appreciated.

 

[Jack]

Really slim chance here,but lets try to run Unhide.exe - http://download.bleepingcomputer.com/grinler/unhide.exe
Please let the program run and when it will complete its task , it will generate a log.

 

[mcnamara9]

Thanks Jack, I downloaded and ran the utility. I even disabled my anti-virus as instructed and reran (log attached) and rebooted. Unfortunately, the shortcuts are still not there. The program folders on the start menu look the same as my last image I posted.

 

[Jack]

The main problem here is that you temp folder seem to be missing the shortcuts ,the only way to fix this right now is to manually re-create the shortcuts
A quick solution might be to find the EXE file in the Program Files folder--to just right-click on the EXE file and choose "Pin to Start menu." That will create a shortcut icon in the main level of the Start menu (Not the All Programs Folder!)

---

If you want to add the shortcuts back to the 'All programs folder' ,you'll need to do the following for each shortcut you want to add:

1.Go where your programs folders are located is and find the startup application (usually in the Program files/x86 folder) and right click on it and select 'Send to Desktop'

2.In the search box, type shell:start menu and press Enter. or browse to C:\Users\(user name)\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
4. Drag an drop the previous created shortcut from the Desktop in this folder if you want to create a direct link in All Programs menu or you can create a folder for it if it doesn't exist.

This is not a very quick restore process but it does the job

OR

1. Right click on your Windows Start menu and select Properties.
   
   
2. Next put a check mark on
   Store and display recently opened programs in the start menu
   Store and display recently opened items in the start menu and taskbar
   
   
3. Click on Customize and click on Use default settings at the bottom
   
   
4. Browse to
   

   C:\ProgramData\Microsoft\Windows

   
5. Right click on Start Menu folder and click on Restore previous versions
6. Now select a snapshot before you were infected by the rogue,click on restore

 

[Littlebits]

You can just simply re-install the programs missing from your Start Menu and they will re-create missing shortcuts and desktop icons. If manually adding them is too complicated.

Thanks.

 

[mcnamara9]

Jack, thanks for the walk through on restoring my shortcuts. I did a few of them last night and I will just need to spend some time fixing the rest. But at the end of the day, everything will be back to normal (is there such a thing when talking about computers?). Thanks again for taking the time to help. It is much appreciated!

Littlebits, I thought of the same thing and I may do that for some of the programs. Thanks for the input.

Have a great day everyone.
Brian

 

[Jack]

mcnamara, I would suggest that you start a thread in our Security Wizard forum : http://malwaretips.com/Forum-Security-Configuration-Wizard , we can help you build a solid security configuration so that this will never happen again