Virus deleted all my start menu shortcuts

I've seen this twice now, just last week a woman dropped off a computer in a sheer panic because ten years worth of photos had vanished and she thought they had been deleted. It turned out nothing was really missing at all, just marked as hidden by a rogue antivirus program which was claiming her hard drive had failed and asking for money to get her files back.

I saw both the XP and 7 versions of this within a week. Was able to get it cleaned up and then just made everything visible with the attrib command The Win7 version also had un-ticked the option under the taskbar menu that says something along the lines of "have shortcuts to recently-used programs on the start menu"--I ticked that again and all the shortcuts came back.

I think your way is better though and probably more complete--thanks! Tricky devil of a virus. It was a rogue anti virus malware type and it hid all of the documents, desktop icons, startmenu etc. It took a second and figured out they were just hidden..

Thanks for pointing this out because the startmenu items were the only thing I've just been "re making". I've seen this twice now, just last week a woman dropped off a computer in a sheer panic because ten years worth of photos had vanished.

All you do in that situation is tell her "It's ok we can just restore your files from your backup! I was working a computer yesterday that did the same as you, but I used System Restore after removing the malware to restore the icons.

I tried the beta of that MS bootable scanner and a few other methods to get rid of the malware. Yeah I mentioned making backups to her but she said she'd already bought a pack of blank DVDs that day. I think she learned her lesson. I've ran across variants of this virus that hides files on your PC.

I have fixed about a dozen or so of them. I usually run hitman pro, malwarebytes and then unhide. I have never had to manually move any shortcuts back through. Usually after running all three said programs everything is restored to the way it was before the PC was infected. I have never had to manually move back the start menu items, however, a co-worker of mine states that he ran combofix on one of these PC's and it removed the virus completely and restored all of the icons.

Usually I don't run combofix on these PC's because most of the time I am cleaning them remotely and combofix kills the network connection on the remote PC. However I'm going to give combofix a shot on the next users PC that has this virus that comes into the shop. I've also noticed a lot of fake av's coming in on PC's as well! I have the exact same problem. Has anyone figured this out? Joined Aug 1, Messages 51, Most cannot be recreated by "going into Program Files".

Any that used the Windows Installer, for example, link to the installer folder and not to anything in Program Files. Try a System Restore. Joined Apr 19, Messages If it's the same virus as i've just removed a few of on client machines, it may have just hidden them, thats what I found from my encounters.

Joined Jun 11, Messages 4. Hello, on 9 June I had a nasty fake security virus despite firewall and Microsoft Security Essentials. I have removed by running Malwarebytes and MSE. Then system restored to 8 June. Now the following are empty: IE favourites list, documents folder, and all photo gallery.

I was able to briefly see my photos on clicking a link to a photo under "recently changed", but on doing this all the photos on the page disappeared one by one over about 10 seconds, and now it says there is nothing in the folder.

I wonder if the items have been hidden in some way. Can anyone advise on what to do to recover the lost files? Many thanks indeed. Jack Hackett. Joined Nov 19, Messages 1, Use Grinler's Unhide. If there are any files that were purposely hidden by you, you will need to hide them again after this tool is run. Hello Jack and thank you. I had seen the earlier reference ref to unhide. I wondered if maybe it was safer to go through the recommended routine of uploading a Hijack This and DDS logs so these can be properly assessed in case virus remnants are still active.

This is waht I am currently trying to do, however Hijack This will not save a log file for some reason I am using Vista 32 bit. Do you feel this is appropriate? Jack Hackett said:. Many thanks in advance for your help!! Link to post Share on other sites More sharing options Hi, In addition to the above, a number of shortcuts on my desktop are also missing. Thanks again for your help. Much appreciated. To locate the files and verify that the entire infection has been removed, please do the following: Please read and follow the directions here , skipping any steps you are unable to complete.

One of the expert helpers there will give you one on one assistance when one becomes available. Posted May 28, Hope this helps! Posted May 29, Ged Posted June 11, Posted June 11, Posted June 12, Posted June 23, Posted June 25, Create an account or sign in to comment You need to be a member in order to leave a comment Create an account Sign up for a new account in our community. Register a new account. Sign in Already have an account? Sign In Now. Go to topic listing. Recently Browsing 0 members No registered users viewing this page.

Back to top. Sign In Sign Up. Important Information This site uses cookies - We have placed cookies on your device to help make this website better.