# Solved: Start menu shortcuts missing after virus cleanup



## Bascotie

Hi guys,

I recently removed the Windows 7 Recovery virus, but now a bunch of my start menu shortcuts are just empty folders (no shortcut to Word/Excel for example). Any idea of a quick fix without having to recreate them all by going into program files?


----------



## egilst

I have the exact same problem. Has anyone figured this out?


----------



## Elvandil

Most cannot be recreated by "going into Program Files". Any that used the Windows Installer, for example, link to the installer folder and not to anything in Program Files.

Try a System Restore.


----------



## jamwaky

If it's the same virus as i've just removed a few of on client machines, it may have just hidden them, thats what I found from my encounters.


----------



## pete95

Hello, on 9 June I had a nasty fake security virus despite firewall and Microsoft Security Essentials. I have removed by running Malwarebytes and MSE. Then system restored to 8 June. Now the following are empty: IE favourites list, documents folder, and all photo gallery. I was able to briefly see my photos on clicking a link to a photo under "recently changed", but on doing this all the photos on the page disappeared one by one over about 10 seconds, and now it says there is nothing in the folder.
I wonder if the items have been hidden in some way. I have also run Microsoft sfc/scannow which didn't find any corrupted files. ....Can anyone advise on what to do to recover the lost files? Many thanks indeed.


----------



## Jack Hackett

Use Grinler's *Unhide.exe *to make your files visible again, download the following program to your desktop:
Unhide.exe

Once the program has been downloaded, double-click on the Unhide.exe icon on your desktop and allow the program to run. This program will remove the +H, or hidden, attribute from all the files on your hard drives. If there are any files that were purposely hidden by you, you will need to hide them again after this tool is run.


----------



## pete95

Hello Jack and thank you. I had seen the earlier reference ref to unhide.exe. I wondered if maybe it was safer to go through the recommended routine of uploading a Hijack This and DDS logs so these can be properly assessed in case virus remnants are still active. This is waht I am currently trying to do, however Hijack This will not save a log file for some reason (I am using Vista 32 bit). Do you feel this is appropriate?


----------



## Bascotie

Jack Hackett said:


> Use Grinler's *Unhide.exe *to make your files visible again, download the following program to your desktop:
> Unhide.exe
> 
> Once the program has been downloaded, double-click on the Unhide.exe icon on your desktop and allow the program to run. This program will remove the +H, or hidden, attribute from all the files on your hard drives. If there are any files that were purposely hidden by you, you will need to hide them again after this tool is run.


Thanks. Unhide works for the hidden files, but desktop shortcuts are still deleted =( It only shows the program folders, with no shortcuts inside of them.


----------



## slefishman1984

Bascotie said:


> Thanks. Unhide works for the hidden files, but desktop shortcuts are still deleted =( It only shows the program folders, with no shortcuts inside of them.


Having this isse ALOT with Windows XP Recovery and also Windows Crashes Delivery.

Watching this post for replies


----------



## slefishman1984

**** UPDATE *****

When getting Windows Recovery XP

The virus/scareware hides the start menu links in

c:\documents and settings\<infected User name>\Local Settings\TEMP\SNTMP ( Windows XP )

Make sure you do not run any temp cleaners as it will delete this folder and all your links!!

If you have ran combofix already!! Check the Qooo folder under Quarantine and look for that path mentioned above.

I am still looking for spot for vista and windows 7. I will update ASAP!!


----------



## Bascotie

slefishman1984 said:


> **** UPDATE *****
> 
> When getting Windows Recovery XP
> 
> The virus/scareware hides the start menu links in
> 
> c:\documents and settings\<infected User name>\Local Settings\APP DATA\SNTMP
> 
> Make sure you do not run any temp cleaners as it will delete this folder and all your links!!
> 
> If you have ran combofix already!! Check the Qooo folder under Quarantine and look for that path mentioned above.
> 
> I am still looking for spot for vista and windows 7. I will update ASAP!!


Thanks for that. So what is in that folder? All the shortcuts?


----------



## slefishman1984

Folder will be named 

1 2 4 etc etc

All shortcuts and .lnk's will be listed in there.

*******************************
Doing more research

1 = Start Menu Program shortcuts
2 = Current User Quick Start shortcuts
4 = All Users Desktop folders and shortcuts


----------



## slefishman1984

C\Users\Infected User \AppData\Local\Temp\smtmp

Vista and Win7 Shortcut Links!


----------



## Bascotie

slefishman1984 said:


> C\Users\Infected User \AppData\Local\Temp\smtmp
> 
> Vista and Win7 Shortcut Links!


Awesome thanks! And where can I restore those to? The startup items folder?


----------



## slefishman1984

Windows XP
c:\Documents and Settings\All Users\Start Menu

Drop them there. It will ask to replace the programs folder that is already there. Go ahead and replace it.

Windows Vista & 7

Still looking into it. I am getting Access Denied for Default user and also All Users

Will update asap!


----------



## Bascotie

Great job, thanks!


----------



## slefishman1984

C:\ProgramData\Microsoft\Windows\Start Menu\Programs and the all users desktop folder is C:\Users\Public\Desktop

Windows 7 / Vista!


----------



## tk6214

So I just followed all the steps, (thank you guys!) and the icons are not there in the start menu. 
with Windows XP
Would a system restore help?


----------



## slefishman1984

What o/s are you trying to fix?


----------



## tk6214

Edited, but windows XP


----------



## jamwaky

For a client I just dealt with I had to manually add all the icons back into the start menu as system restore did nothing. I don't think there is another way round that I know of, luckily she didn't have many icons on the start menu but still was a pain... If there is an automated way I will kick myself haha


----------



## jamwaky

Scratch that, ive just found this because one of our other clients has the same virus;

I hope that you have not deleted the temp folder (as I did with the other one)

Well in there, there may well be a folder named 'smtmp' and your start menu could be in there!


----------



## tk6214

Yes the start menu was in there but the .ink files were not.


----------



## jamwaky

Are they not located within the folders in the smtmp file?


----------



## tk6214

jamwaky said:


> Are they not located within the folders in the smtmp file?


No they are not. I'm having to go in and rebuild the entire start menu


----------



## jamwaky

ahhh, sorry i couldnt be more help


----------



## slefishman1984

When getting these types of viruses you have to be REALLY careful not to run any cleaners or virus tools untill you can get the sntmp folder completely out. ( I usually stick it in the root of c:\) Ineed sometimes the folders will be empty. Make sure you run the unhide.exe program after you have stopped the virus from starting up. ( This is another story ) One way i have managed to get this done.

1. Log into safe mode with networking ( unhook all connections to the internet)
2. First thing you need to do is go into mycomputer, then tools, folder options, show hidden files and folders, scroll down 3 or 4 lines, uncheck the box that says Hide protected operating system files.
3. Close all boxes, go to c:\Documents and Settings\All Users\App Data Scroll toward the bottom there will be files looking like <random>.exe could be 2 could be 1. Depending on which virus you are dealing with. Delete these manually. This will stop the pop ups in normal mode.

4. From there run the unhide.exe in safe mode.

5. Go to C\Users\Infected User \AppData\Local\Temp\smtmp

5. 1 2 4 <<< These folders will be listed. ( If these folders are empty after the unhide.exe. Then they are simply not there.

6. Office has a repair function ( ADD/REMOVE Programs ) that will restore the start menu items.

7. When restoring the start menu items, make sure you are in the c\document and settings\all users\start menu and paste there.


----------

