Broken Taskbar Links, Missing programs and folders. Virus? Help!

[caligrown]

I've posted this in a few forums with no success so far, hopefully someone here can help!

I started my computer today and found some big problems....

Once logged in, I noticed that my desktop background had disappeared and was just black. I usually run about 5 desktop gadgets, and they have all disappeared as well and seem to have been deleted from my pc. All my taskbar links no longer work and I get an error saying "Can't open this item: It might have been moved, renamed, or deleted". On top of that, all the programs in the start menu programs folder are gone, and I can't find them in explorer.exe either!

I booted into safe mode and ran MSE Antivirus full scan, nothing found. I also ran full scans with Malwarebytes, Superantispyware, and Spybot Search and Destroy and nothing was found!

I'm not sure what to do now, as I had my PC set up just right and tons of settings which have just vanished!

I do not have any system restore points set up.

I'm tempted to just wipe my SSD which only has my OS and some small apps, and start a fresh install. If I were to do this, would it destroy any virus that I may have picked up? Could my secondary HDD be infected if there is a virus?

I only use this PC for gaming through Steam, and watching Netflix, youtube, light web-browsing. I never visit any "unsafe" sites or do any torrenting! What's going on?

What should I do?!

System Specs:
i5 3570K
Gigabyte GA-Z77X-D3H
EVGA GTX 670
8GB 1333 RAM
Crucial m4 128 GB SSD
Seagate Barracuda 2 TB HDD
Windows 7

 

[caligrown]

I am probably going to just wipe my SSD in an hour or so if I can't find any other solutions,

Really is a pain, because of all the settings I tweaked to make Win7 run just how I like. No viruses or spy/malware found after running multiple scans, not finding any errors anywhere. Tried logging in with different user, same problems. Tried running unhide.exe in case this has something to do with FakeHDD, no luck. I have no clue why all my settings, links, start menu programs and folders have all disappeared/don't work. I don't know what else to do!

 

[d00p98uy]

try running a scan with VIPRERescue scanner VIPRE Rescue Scanner Free Download it takes FOREVER to scan, but always comes up with something in my experiabnce

 

[caligrown]

Ok thanks, will try that now.

Does this sounds like a virus? So strange, did nothing out of the ordinary whatsoever. I literally update MSE and spy/malware programs and scan every single day. Don't download anything besides Steam games, only browse youtube, netflix.... All the unsafe activities happen on my laptop which has never had any problems lol.

 

[VistaKing]

RogueKiller for 32bit <==== Download Link

RogueKiller for 64bit <==== Download Link

:ar: Click on one of the links above that goes with your Windows 7 bit versions

:ar: Save to the Desktop.

:ar: Close all windows and browsers

:ar: Right click on

and choose

:ar: Press: SCAN

:ar: provide the RKreport.txt (Mode: Scan) in your reply.

 

[caligrown]

RogueKiller V8.6.2 _x64_ [Jul 2 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : hxxp://www.adlice.com/forum/
Website : hxxp://www.adlice.com/softwares/roguekiller/
Blog : tigzy-RK

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Philip Huffman [Admin rights]
Mode : Scan -- Date : 07/17/2013 00:01:01
| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] PCMeterV0.3.exe -- C:\Users\Philip Huffman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Meter Gadgets\PCMeter\PCMeter\PCMeterV0.3.exe [-] -> KILLED [TermProc]

¤¤¤ Registry Entries : 6 ¤¤¤
[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND
[HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK] HKCU\[...]\NewStartPanel : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 1 ¤¤¤
[V2][SUSP PATH] Startup : C:\Users\Philip Huffman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Meter Gadgets\PCMeter\PCMeter\PCMeterV0.3.exe [-] -> FOUND

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : Mal.Hosts ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 download-winmx-free.com --> Potentially malicious!
127.0.0.1 www.download-winmx-free.com --> Potentially malicious!
127.0.0.1 www.facebook.com.img335.tk --> Potentially malicious!
127.0.0.1 free-winmx-downloads.com --> Potentially malicious!
127.0.0.1 www.free-winmx-downloads.com --> Potentially malicious!
127.0.0.1 www.google.dospop.com --> Potentially malicious!
127.0.0.1 www.mp3winmx.com --> Potentially malicious!
127.0.0.1 mp3winmx.com --> Potentially malicious!
127.0.0.1 winmx.click-new-download.com --> Potentially malicious!
127.0.0.1 click-new-download.com --> Potentially malicious!
127.0.0.1 winmx-d0wnload.com --> Potentially malicious!
127.0.0.1 www.winmx-d0wnload.com --> Potentially malicious!
127.0.0.1 www.winmxfrance.com --> Potentially malicious!
127.0.0.1 winmxfrance.com --> Potentially malicious!
127.0.0.1 winmx-freebie.com --> Potentially malicious!
127.0.0.1 www.winmx-freebie.com --> Potentially malicious!
127.0.0.1 winmx-music-download.com --> Potentially malicious!
127.0.0.1 www.winmx-music-download.com --> Potentially malicious!
127.0.0.1 winmx-usa.com --> Potentially malicious!
127.0.0.1 www.winmx-usa.com --> Potentially malicious!

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 Ó¢»Ê¹ú¼ÊÓéÀÖ³Ç-www.0scan.com-³¯Ñô¶«Ìú¿ó²úÆ·ÏúÊÛÓÐÏÞ¹«Ë¾
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 ²©²Êͨ,²©²ÊÍø,½ð±¦²©188,²©²ÊͨÆÀ¼¶,°Ù¼ÒÀÖ,°ÂÃî°Ù¼ÒÀÖ
127.0.0.1 100888290cs.com
127.0.0.1 100sexlinks.com
127.0.0.1 www.100sexlinks.com
[...]


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: M4-CT128M4SSD2 +++++
--- User ---
[MBR] 6985e753883b8b13c60017a81c3492d5
[BSP] 755d449aa7e54115bee5b829f0b1ab50 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 122002 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: M4-CT128M4SSD2 +++++
--- User ---
[MBR] 2c7ddb6163221c0f185da7ea681278d2
[BSP] 4425283a1e99cfc7b04a02377e23dade : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 1907727 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_S_07172013_000101.txt >>

 

[VistaKing]

Do you see this folder

:ar: C:\Users\username\AppData\Local\Temp\smtmp

   Note

AppData is a hidden folder

   Tip

Show hidden files and folders

Click on the Start rb: button and select Computer
Press the Alt key on your keyboard and click on Tools or click on Organize
Select Folder Options
Click the View tab and make sure that Show hidden files and folders is selected under Hidden files and folders
Next, uncheck the box next to Hide protected operating system files (Recommended)
Then, uncheck the box next to Hide extensions for known file types
Click Apply then click OK

 

[caligrown]

For some reason, I don't have a temp folder located there, only a TMP folder. Inside TMP, I do not see any file named smtmp.

 

[VistaKing]

It should be a temp folder not a tmp folder inside C:\Users\your account name\Appdata\Local

 

[caligrown]

Yeah I'm not sure why but there doesn't seem to be a Temp folder.

In Environment Variables it shows the TEMP folder is set to C:\Users\Username\Appdata\Local\Temp, but it doesn't show up when I open the folder!

If I type %temp% in start menu run box it says "Windows cannot find 'C:\Users\Philip'

 

[VistaKing]

Is hidden folders showing up ?

 

[caligrown]

Yes, all hidden folders are shown, appdata etc., just no temp folder

Not sure what else to do, besides a fresh install?

 

[caligrown]

I did notice that all these problems seemed to occur after getting an error while trying to update the Nvidia Geforce Experience client, not sure if that has any relevance though...

 

[VistaKing]

Click here DDS

:ar: Click on Download Now button

:ar: When the download is complete . Drag the DDS program from the Downloads folder to your Desktop

:ar: Double click the DDS icon on the Desktop then click the Run button to run the tool.

:ar: Place a check next to attact.txt and click Start . When done, DDS will open two logs

• DDS.txt
• Attach.txt

:ar: Save two logs onto your desktop and upload them with your reply

 

[caligrown]

whoops

 

[caligrown]

whoops

 

[caligrown]

Sorry just noticed you said upload..
View attachment dds.txt

View attachment attach.txt

 

[VistaKing]

Did you have a virus before this incident ?

 

[caligrown]

No viruses, no error messages, I update MSE, malwarebytes, superantispyware, spybot S&D daily and run scans daily.

 

[VistaKing]

Lets see what this tool shows us

Farbar Recovery Scan Tool


64-Bit Version OS Farbar Recovery Scan Tool x64 <===== Download Link

Drag the FRST64.exe from the Downloads folder to your Desktop

Right click on FRST64.exe and choose

When the tool opens click Yes on the disclaimer window .

Press Scan button.

FRST will let you know when the scan is complete and has written the FRST.txt to file

   Note

The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt

Please upload both logs in your reply.(FRST.txt and Addition.txt)

:note: FRST.txt and Addition.txt will be on the Desktop :note:

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .Let's see what this tool shows us