Cleanup after Win 7 Recovery Virus

greyolddave · 22 Jun 2011

I have no shortage of relatives who will not use a good AV program. This one got the Win 7 recovery virus. Its gone now. It had hidden all the user files. I was given a program named "unhide.exe" which really restored all user files.
The All Programs menu is the last problem. the unhide program restored the standard group of programs and any program that was there by itself. However, any folder of several programs, like MS Office for example, is now empty.
In an earlier Windows version it was rather easy to move this menu the way I wanted it. For Win 7 I cannot find how to add programs to the All Programs menu or correct what is there.
All I need (I think) is the method of adding programs to that All Programs menu. This is a Win 7 Home Premium version.
Thanks

Oaken · 22 Jun 2011

Hi Dave and welcome.

This forum tutorial may be just what you are looking for;

Start Menu All Programs - Add or Delete Shortcuts

gregrocker · 22 Jun 2011

I believe you'll have to reinstall the programs if they won't run if found or aren't found.

Infections this serious often require a clean reinstall, wiping the HD of any boot corruption: SSD - HDD Optimize for Windows Reinstallation

Sometimes running Factory Recovery from its partition is sufficient, or use the Recov disks after wiping HD.

Or clean reinstall using a Win7 retail installer for your version with the Product Key on the COA sticker: Reinstalling Windows 7

greyolddave · 23 Jun 2011

Actually so far it appears that I have been able to get rid of the virus and rebuild the Start Menu with your advice above. The basic method that seems to have worked was using Malwarebytes, Superantispyware (which found nothing) then a program named "unhide.exe" then go into the menu area following the instructions in this Start Menu Tutorial. I gave it back to the family this morning. Will report back if they have further trouble.

MacGyvr · 23 Jun 2011

Actually folks, your shortcuts are still there. They have been moved to a location where you wouldn't think to look for them. I hope you didn't clean out the temp folders.

Open windows explorer and look for the following folder: %userprofile%\local settings\temp\SMTMP You will notice there are a couple folders in here. The folder named "1" corresponds to the start menu. "2" is the quick launch, and "4" appears to be the desktop. Quick launch and desktop shortcuts dont get affected though so all we need is the "1" folder. For XP, copy the contents of "1" into C:\Documents and Settings\All Users\Start menu For Windows 7 machines copy the contents of "1" into C:\ProgramData\Microsoft\Windows\Start Menu.