SMART-Followed Fix But Some Files Still Hidden

mcnamara9

New Member
Thread author
May 18, 2012
6
New member to the forum and this site has been great so far. Thanks everyone.

I followed the blog's steps to remove SMART virus and everything worked well except my shortcuts on the Start menu for my various programs were not restored. Program Folders are there, but the shortcuts are not. Also, the shortcuts that are at the top portion of the start menu were not restored either.

I saw on other threads that there were similar problems, but they use XP and the utilities suggested do not work with Win7.

Any help would be greatly appreciated.
-Brian
 

Attachments

  • protection-log-2012-05-18.txt
    2.1 KB · Views: 124

Jack

Administrator
Verified
Staff Member
Well-known
Jan 24, 2011
9,378
Hello mcnamara9,
This rogue has moved your saved pinned task bar items and other shortcuts into the temporary internet folder, so now we will have to copy them back to their original location.
Step 1: Enable on your system the 'Show hidden files, folders, and drives' option.
<ul>
<li>IGo to <>Computer</> → Click on the <>Organize</> tab → select <>Folder and search options</>.</li>
<img title="Enable the option to see hidden files" src="http://malwaretips.com/images/removalguide/view-hidden-items.png" alt="[Image: viewhiddenfiles.png]" width="338" height="351" border="0" /></li>
</ul>
In the new window that appeared select the <>View</> tab and choose the option <>Show hidden files, folders, and drives</> then click Apply and OK.
<img title="Show hidden files, folders, and drives" src="http://malwaretips.com/images/removalguide/see-hidden-files.png" alt="[Image: Show hidden files, folders, and drives.png]" width="297" height="360" border="0" />

Step 2: This rogue software has moved your shorcuts in a folder in the Temporary Internet files called <>smtmp</>, so now we will need to copy them back to their original locations.

You can find the <>smtmp folder</> in <>C:\Users\[Your Username]\AppData\Local\Temp</>

<img title="Copy the content of each folder to their original location" src="http://malwaretips.com/images/removalguide/path-to-hidden-files.png" alt="[Image: Show hidden files, folders, and drives.png]" width="708" height="183" border="0" />

The <>smtmp folder will contain 4 folders</> and you'll need to copy the content of this folders back to their original locations.

Copy the content from %Temp%\smtmp\1\ TO C:\ProgramData\Microsoft\Windows\Start Menu
Copy the content from %Temp%\smtmp\2\ TO C:\Users\[your username]\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\
Copy the content from %Temp%\smtmp\3\ TO C:\Users\[your username]\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
Copy the content from %Temp%\smtmp\4\ TO C:\Users\Public\Desktop
 
Last edited:

mcnamara9

New Member
Thread author
May 18, 2012
6
Thank you for the reply. Much appreciated. I followed those steps, but I only have folders 1 and 4 (see attached screenshot showing folders 1 and 4 only). I'm missing 2 and 3. Any ideas on how I can fix my shortcuts on my start menu now?
 

Attachments

  • 5-20-2012.jpg
    5-20-2012.jpg
    39.5 KB · Views: 131

Jack

Administrator
Verified
Staff Member
Well-known
Jan 24, 2011
9,378
Your start menu shortcuts should be in Folder no.1. Did you copy the content of this folder back to its original location? Can you show me a screen shot on how the start menu looks right now?
Lets try another trick....
1.Download this utility from tweaking.com: http://www.tweaking.com/content/page/repair_missing_start_menu_icons_removed_by_infections.html
2. After the download process has completed, double click on the icon and the Click the Start button.
repair-start-menu-icons.png
 

mcnamara9

New Member
Thread author
May 18, 2012
6
Thank you for the reply. Unfortunately, the start menu contents are not in there (see attached 2 screenshot of contents). I ran the Tweaking utility before I took these snapshots and checked my start menu, but still no shortcuts to start the application in the folders under program files. It just says "empty". :(
 

Attachments

  • Folder 1 Contents.jpg
    Folder 1 Contents.jpg
    43.1 KB · Views: 141
  • Folder 1-Program Folder Contents.jpg
    Folder 1-Program Folder Contents.jpg
    53.6 KB · Views: 146
  • tweaking-snapshot.jpg
    tweaking-snapshot.jpg
    55 KB · Views: 134

Jack

Administrator
Verified
Staff Member
Well-known
Jan 24, 2011
9,378
You are running on Windows 7 64bits right?
If Yes, then please download the following utility and run it : http://download.bleepingcomputer.com/grinler/fakehdd/win7-x64-sm-reset.exe
This should restore back you Start Menu items.....
 

mcnamara9

New Member
Thread author
May 18, 2012
6
Jack, yes I have 64-Bit Win7 so thanks for the tip! I downloaded the utility and my start menu is beginning to look normal again, however, the various programs I have installed still do not have the shortcuts in their program folders (see attached image). I got the snipping tool back and other windows accessories, but still can't find the non-windows programs shortcuts that should be in my start menu program folders.

Everyone's help with this is much appreciated.
 

Attachments

  • start-menu.JPG
    start-menu.JPG
    41.4 KB · Views: 142

Jack

Administrator
Verified
Staff Member
Well-known
Jan 24, 2011
9,378
Really slim chance here,but lets try to run Unhide.exe - http://download.bleepingcomputer.com/grinler/unhide.exe
Please let the program run and when it will complete its task , it will generate a log.
 

mcnamara9

New Member
Thread author
May 18, 2012
6
Thanks Jack, I downloaded and ran the utility. I even disabled my anti-virus as instructed and reran (log attached) and rebooted. Unfortunately, the shortcuts are still not there. The program folders on the start menu look the same as my last image I posted.
 

Attachments

  • unhide.txt
    2.2 KB · Views: 145

Jack

Administrator
Verified
Staff Member
Well-known
Jan 24, 2011
9,378
The main problem here is that you temp folder seem to be missing the shortcuts ,the only way to fix this right now is to manually re-create the shortcuts :)
A quick solution might be to find the EXE file in the Program Files folder--to just right-click on the EXE file and choose "Pin to Start menu." That will create a shortcut icon in the main level of the Start menu (Not the All Programs Folder!)




If you want to add the shortcuts back to the 'All programs folder' ,you'll need to do the following for each shortcut you want to add:
81yb5.png



1.Go where your programs folders are located is and find the startup application (usually in the Program files/x86 folder) and right click on it and select 'Send to Desktop'
7uoCi.png

2.In the search box, type shell:start menu and press Enter. or browse to C:\Users\(user name)\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
4. Drag an drop the previous created shortcut from the Desktop in this folder if you want to create a direct link in All Programs menu or you can create a folder for it if it doesn't exist.
8iSV7.png

This is not a very quick restore process but it does the job:)
Jjg7Y.png



OR



  1. Right click on your Windows Start menu and select Properties.
    Eu2Aq.png
  2. Next put a check mark on
    Store and display recently opened programs in the start menu
    Store and display recently opened items in the start menu and taskbar

    h0z5v.png
  3. Click on Customize and click on Use default settings at the bottom
    kxZSH.png
  4. Browse to
    Code:
    C:\ProgramData\Microsoft\Windows
    vZZUz.png
  5. Right click on Start Menu folder and click on Restore previous versions
  6. Now select a snapshot before you were infected by the rogue,click on restore
 

Littlebits

Retired Staff
May 3, 2011
3,893
You can just simply re-install the programs missing from your Start Menu and they will re-create missing shortcuts and desktop icons. If manually adding them is too complicated.

Thanks.:D
 

mcnamara9

New Member
Thread author
May 18, 2012
6
Jack, thanks for the walk through on restoring my shortcuts. I did a few of them last night and I will just need to spend some time fixing the rest. But at the end of the day, everything will be back to normal (is there such a thing when talking about computers?:)). Thanks again for taking the time to help. It is much appreciated!

Littlebits, I thought of the same thing and I may do that for some of the programs. Thanks for the input.

Have a great day everyone.
Brian
 

Jack

Administrator
Verified
Staff Member
Well-known
Jan 24, 2011
9,378
mcnamara, I would suggest that you start a thread in our Security Wizard forum : http://malwaretips.com/Forum-Security-Configuration-Wizard , we can help you build a solid security configuration so that this will never happen again :)
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top