Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Start menu programs hidden after unhide.exe


  • Please log in to reply
75 replies to this topic

#1 pdxcpa

pdxcpa

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:04 PM

Posted 09 June 2011 - 11:56 AM

I found myself with a virus last week and downloaded malwarebytes which appears to have successfully removed Trojan.FakeMS and Trojan.Agent, or so it appears. My files were still hidden so after a bit of looking around on this site, I was able to download the unhide.exe file, run it and obtained most of my icons and such. BUT, under my start menu only two items are in the quick list (which I'm not too concerned about) but under "All Files" the folders for all my programs are there but they say they're empty.

From my research it looks like a fairly common problem that I can fix but I wanted to make sure I didn't have any extenuating cicrumstances. Is there a way to obtain help without posting all the logs or posting them privately? I'm not sure what kind of data they contain but I'm not comfortable posting data I am unfamiliar with to the internet for all to see. Please forgive me if this is a silly concern.

Thanks for your help!

Edited by Andrew, 09 June 2011 - 12:17 PM.
Mod Edit: Moved From MRL To AII - AA


BC AdBot (Login to Remove)

 


#2 KIMATEC

KIMATEC

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:04 PM

Posted 10 June 2011 - 09:01 AM

I went through the same thing on a few computers and they were all different to restore the data back to the original state. In some instances I was able to just show all hidden files and folders so I could see the hidden files. Then I selected all the hidden files in Documents (example) and right clicked on 1 of them and unchecked the "hidden" box and they all became visible again.

The other thing I had to do in some cases was this:
http://www.vistax64.com/tutorials/159034-start-menu-restore-missing-default-shortcuts.html

Give them a try and post your results, I am happy to help if I can!


#3 ZPrime

ZPrime

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cleveland, OH
  • Local time:09:04 PM

Posted 10 June 2011 - 10:48 AM

After running unhide, make sure that Explorer is configured to show hidden and system folders (tools menu -> folder options -> View tab)

Dig around in C:\Documents and settings\[current user's name] or c:\users\[current user's name], I believe under Application Data and then Temp folder. Some of these viruses are moving a copy of all of the shortcuts to that area.

alternatively, you can just do a search on the whole hard drive - search for *.lnk which is a shortcut. Once you see familiar shortcuts, you'll know you've found the correct folder, and you can just put everything back.

#4 pdxcpa

pdxcpa
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:04 PM

Posted 12 June 2011 - 10:07 PM

...show all hidden files and folders so I could see the hidden files. Then I selected all the hidden files in Documents (example) and right clicked on 1 of them and unchecked the "hidden" box and they all became visible again.

Did this before I tried anything else. It just enabled me to see all the files that were hidden that appeared to be missing but not the programs or shortcuts.


After running unhide, make sure that Explorer is configured to show hidden and system folders (tools menu -> folder options -> View tab)

Dig around in C:\Documents and settings\[current user's name] or c:\users\[current user's name], I believe under Application Data and then Temp folder. Some of these viruses are moving a copy of all of the shortcuts to that area.

alternatively, you can just do a search on the whole hard drive - search for *.lnk which is a shortcut. Once you see familiar shortcuts, you'll know you've found the correct folder, and you can just put everything back.

Before and after unhide the system was configured to show hidden and system folders. So can't do anything there to fix this.


I found thsi thread (http://www.bleepingcomputer.com/forums/topic396978.html) which seems to address the same problem I'm having. I looked in the folders they suggested copying and pasting to various places on the computer but I can't get into the locked system folders - I'm told I don't have permission or something like that. (I'm logged in as the admin) It was also mentioned that there is an updated version of the unhide.exe program that should fix this but it doesn't help me. Any more ideas?

Thanks for your help!

#5 pdxcpa

pdxcpa
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:04 PM

Posted 12 June 2011 - 10:10 PM

The other thing I had to do in some cases was this:
http://www.vistax64.com/tutorials/159034-start-menu-restore-missing-default-shortcuts.html


I'm not running vista but I have seen this same method for windows 7. It just seems so cumbersome to move each program one by one... and honestly, I need them to tell me where to put them, not just to 'put them back'. I'm not a computer person. I have no idea where they were in the first place. :)

I was hoping to find that this is a common problem with this virus and that it's a fairly straight forward fix but maybe I'm wrong?

Thanks!!!

#6 KIMATEC

KIMATEC

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:04 PM

Posted 13 June 2011 - 11:32 AM

Did you try right clicking on the "unhide.exe" file and "run as administrator? You may also need to run it in safe mode.

#7 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 35,626 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:06:04 PM

Posted 13 June 2011 - 12:15 PM

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

64-bit users go HERE
  • Double-click SystemLook.exe to run it.
  • Vista\Win 7 users:: Right click on SystemLook.exe, click Run As Administrator
  • Copy the content of the following box into the main textfield:
    :dir
    %Temp%\smtmp /s
    
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif




#8 pdxcpa

pdxcpa
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:04 PM

Posted 13 June 2011 - 02:30 PM

Did you try right clicking on the "unhide.exe" file and "run as administrator? You may also need to run it in safe mode.


Tried both, neither seem to do the trick.

#9 pdxcpa

pdxcpa
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:04 PM

Posted 13 June 2011 - 03:06 PM

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

64-bit users go HERE

  • Double-click SystemLook.exe to run it.
  • Vista\Win 7 users:: Right click on SystemLook.exe, click Run As Administrator
  • Copy the content of the following box into the main textfield:
    :dir
    %Temp%\smtmp /s
    
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt


Hi Broni,
I've run the scan and I can see all the links in the ...\1 \3 and \4 folders as you helped another person here (http://www.bleepingcomputer.com/forums/topic396978.html). I copied the contents of ...temp\smtmp\1 to C:\Program Data\Start Menu and now evertything appears to be back, however my start menu has a couple more layers of folders to go through to get into the programs. To be more specific, my start menu still has all the empty folders but has a new folder named 1 which then contains 3 programs and another folder called programs which then contains the program folders.

So did I screw it up? How can I put them back in the proper locations in the start menu? Whenever I click on 'start menu' under ProgramData it denies me access.

Yikes! This is what happens when you have a non-computer person trying to play the role of computer person (me). And I know, I'll slap my hand for you, I didn't follow your directions specifically by pasting the lookup log in my post. Sorry!

#10 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 35,626 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:06:04 PM

Posted 13 June 2011 - 03:14 PM

I'll try to help you out, but I need to see the result of the above scan.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif




#11 pdxcpa

pdxcpa
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:04 PM

Posted 13 June 2011 - 03:22 PM

Oh, it looks like in my start menu I can click and drag them back to the original folders... Is this an okay way? Here's the scan:
The stuff in \4 had already found it's way back to my desktop so I didn't follow those part of your instructions for the other people.

SystemLook 04.09.10 by jpshortstuff
Log created at 13:23 on 13/06/2011 by Marson
Administrator - Elevation successful

========== dir ==========

C:\Users\Marson\AppData\Local\Temp\smtmp - Parameters: "/s"

---Files---
None found.

C:\Users\Marson\AppData\Local\Temp\smtmp\1 d------ [02:54 30/05/2011]
Default Programs.lnk ------- 1282 bytes [05:01 14/07/2009] [05:01 14/07/2009]
desktop.ini --ahs-- 442 bytes [04:49 14/07/2009] [05:01 14/07/2009]
HP Solution Center.lnk ------- 1323 bytes [06:49 31/01/2011] [06:49 31/01/2011]
Windows Update.lnk ------- 1266 bytes [04:49 14/07/2009] [04:49 14/07/2009]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs d------ [02:54 30/05/2011]
Adobe Photoshop Elements 8.0.lnk --a---- 1227 bytes [04:57 11/03/2011] [04:57 11/03/2011]
Adobe Reader X.lnk --a---- 2441 bytes [19:26 05/05/2011] [19:26 05/05/2011]
Apple Software Update.lnk --a---- 2519 bytes [04:20 09/03/2011] [04:20 09/03/2011]
Dell Help Documentation.lnk --a---- 1975 bytes [05:23 31/01/2011] [05:23 31/01/2011]
desktop.ini --ahs-- 1130 bytes [04:54 14/07/2009] [22:14 15/04/2010]
I.R.I.S. OCR Registration.lnk --a---- 1054 bytes [06:49 31/01/2011] [06:49 31/01/2011]
Media Center.lnk --a---- 1345 bytes [22:14 15/04/2010] [22:14 15/04/2010]
Microsoft Office PowerPoint Viewer 2007.lnk --a---- 2557 bytes [20:22 15/04/2010] [20:22 15/04/2010]
Microsoft Works Task Launcher.lnk --a---- 1149 bytes [20:21 15/04/2010] [20:21 15/04/2010]
PowerDVD DX.lnk --a---- 2084 bytes [20:26 15/04/2010] [20:26 15/04/2010]
Sidebar.lnk --a---- 1330 bytes [04:57 14/07/2009] [04:57 14/07/2009]
Windows Anytime Upgrade.lnk --a---- 1352 bytes [04:57 14/07/2009] [04:57 14/07/2009]
Windows DVD Maker.lnk --a---- 1326 bytes [22:13 15/04/2010] [22:13 15/04/2010]
Windows Fax and Scan.lnk --a---- 1210 bytes [04:54 14/07/2009] [04:54 14/07/2009]
Windows Media Player.lnk --a---- 1547 bytes [04:57 14/07/2009] [05:09 14/07/2009]
XPS Viewer.lnk --a---- 1246 bytes [04:57 14/07/2009] [04:57 14/07/2009]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Accessories d------ [02:54 30/05/2011]
Calculator.lnk --a---- 1230 bytes [04:55 14/07/2009] [04:55 14/07/2009]
Desktop.ini --ahs-- 1726 bytes [02:36 14/07/2009] [22:14 15/04/2010]
displayswitch.lnk --a---- 1266 bytes [04:54 14/07/2009] [04:54 14/07/2009]
Math Input Panel.lnk --a---- 1364 bytes [22:13 15/04/2010] [22:14 15/04/2010]
Mobility Center.lnk --a---- 1238 bytes [22:14 15/04/2010] [22:14 15/04/2010]
Paint.lnk --a---- 1242 bytes [04:54 14/07/2009] [04:54 14/07/2009]
Remote Desktop Connection.lnk --a---- 1367 bytes [04:53 14/07/2009] [04:53 14/07/2009]
Snipping Tool.lnk --a---- 1272 bytes [22:14 15/04/2010] [22:14 15/04/2010]
Sound Recorder.lnk --a---- 1330 bytes [04:57 14/07/2009] [04:57 14/07/2009]
Sticky Notes.lnk --a---- 1351 bytes [22:14 15/04/2010] [22:14 15/04/2010]
Sync Center.lnk --a---- 1254 bytes [04:54 14/07/2009] [04:54 14/07/2009]
Welcome Center.lnk --a---- 1579 bytes [04:57 14/07/2009] [04:57 14/07/2009]
Wordpad.lnk --a---- 1322 bytes [04:54 14/07/2009] [04:54 14/07/2009]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Accessories\Accessibility d------ [02:54 30/05/2011]
Desktop.ini --ahs-- 370 bytes [02:36 14/07/2009] [04:57 14/07/2009]
Speech Recognition.lnk --a---- 1388 bytes [04:57 14/07/2009] [04:57 14/07/2009]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Accessories\System Tools d------ [02:54 30/05/2011]
Character Map.lnk --a---- 1248 bytes [04:55 14/07/2009] [04:55 14/07/2009]
Desktop.ini --ahs-- 1338 bytes [02:36 14/07/2009] [04:57 14/07/2009]
dfrgui.lnk --a---- 1290 bytes [04:54 14/07/2009] [04:54 14/07/2009]
Disk Cleanup.lnk --a---- 1252 bytes [04:54 14/07/2009] [04:54 14/07/2009]
Resource Monitor.lnk --a---- 1242 bytes [04:53 14/07/2009] [04:53 14/07/2009]
System Information.lnk --a---- 1250 bytes [04:53 14/07/2009] [04:53 14/07/2009]
System Restore.lnk --a---- 1246 bytes [04:54 14/07/2009] [04:54 14/07/2009]
Task Scheduler.lnk --a---- 1268 bytes [04:54 14/07/2009] [04:54 14/07/2009]
Windows Easy Transfer Reports.lnk --a---- 1320 bytes [04:57 14/07/2009] [04:57 14/07/2009]
Windows Easy Transfer.lnk --a---- 1316 bytes [04:57 14/07/2009] [04:57 14/07/2009]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Accessories\Tablet PC d------ [02:54 30/05/2011]
Desktop.ini --ahs-- 343 bytes [07:44 14/07/2009] [22:14 15/04/2010]
ShapeCollector.lnk --a---- 1436 bytes [22:14 15/04/2010] [22:14 15/04/2010]
TabTip.lnk --a---- 1386 bytes [22:14 15/04/2010] [22:14 15/04/2010]
Windows Journal.lnk --a---- 1316 bytes [22:14 15/04/2010] [22:14 15/04/2010]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Accessories\Windows PowerShell d------ [02:54 30/05/2011]
desktop.ini --ahs-- 216 bytes [04:57 14/07/2009] [04:57 14/07/2009]
Windows PowerShell (x86).lnk --a---- 1989 bytes [05:32 14/07/2009] [05:32 14/07/2009]
Windows PowerShell ISE (x86).lnk --a---- 1468 bytes [04:57 14/07/2009] [04:57 14/07/2009]
Windows PowerShell ISE.lnk --a---- 1468 bytes [04:57 14/07/2009] [04:57 14/07/2009]
Windows PowerShell.lnk --a---- 1899 bytes [05:32 14/07/2009] [05:32 14/07/2009]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Administrative Tools d------ [02:54 30/05/2011]
Component Services.lnk --a---- 1242 bytes [04:57 14/07/2009] [04:57 14/07/2009]
Computer Management.lnk --a---- 1294 bytes [04:54 14/07/2009] [04:54 14/07/2009]
Data Sources (ODBC).lnk --a---- 1270 bytes [04:53 14/07/2009] [04:53 14/07/2009]
desktop.ini --ahs-- 1674 bytes [04:53 14/07/2009] [04:57 14/07/2009]
Event Viewer.lnk --a---- 1298 bytes [04:54 14/07/2009] [04:54 14/07/2009]
iSCSI Initiator.lnk --a---- 1274 bytes [04:54 14/07/2009] [04:54 14/07/2009]
Memory Diagnostics Tool.lnk --a---- 1268 bytes [04:53 14/07/2009] [04:53 14/07/2009]
Performance Monitor.lnk --a---- 1232 bytes [04:53 14/07/2009] [04:53 14/07/2009]
services.lnk --a---- 1288 bytes [04:54 14/07/2009] [04:54 14/07/2009]
System Configuration.lnk --a---- 1246 bytes [04:53 14/07/2009] [04:53 14/07/2009]
Task Scheduler.lnk --a---- 1262 bytes [04:54 14/07/2009] [04:54 14/07/2009]
Windows Firewall with Advanced Security.lnk --a---- 1274 bytes [04:53 14/07/2009] [04:53 14/07/2009]
Windows PowerShell Modules.lnk --a---- 2741 bytes [05:32 14/07/2009] [05:32 14/07/2009]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Coupons d------ [02:54 30/05/2011]
Coupons.com - Print Coupons.lnk --a---- 1902 bytes [06:49 31/01/2011] [06:49 31/01/2011]
Uninstall Coupon Printer for Windows.lnk --a---- 2069 bytes [06:49 31/01/2011] [06:49 31/01/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\DELL d------ [02:54 30/05/2011]
Dell Dock.lnk --a---- 1012 bytes [20:33 15/04/2010] [20:33 15/04/2010]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\DELL\OSD d------ [02:54 30/05/2011]
Uninstall OSD Utility.lnk --a---- 2313 bytes [20:20 15/04/2010] [20:20 15/04/2010]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Dell Support Center d------ [02:54 30/05/2011]
About Dell Support Center.lnk --a---- 2781 bytes [20:24 15/04/2010] [20:24 15/04/2010]
Dell Support Center Alerts.lnk --a---- 2675 bytes [20:24 15/04/2010] [20:24 15/04/2010]
Dell Support Center User Settings.lnk --a---- 2691 bytes [20:24 15/04/2010] [20:24 15/04/2010]
Dell Support Center.lnk --a---- 2581 bytes [20:24 15/04/2010] [20:24 15/04/2010]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Dell Webcam d------ [02:54 30/05/2011]
Dell Webcam Central Help.lnk --a---- 2194 bytes [20:24 15/04/2010] [20:24 15/04/2010]
Dell Webcam Central.lnk --a---- 2194 bytes [20:24 15/04/2010] [20:24 15/04/2010]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Dell Webcam\Live! Cam Avatar Creator d------ [02:54 30/05/2011]
License Agreement.lnk --a---- 2222 bytes [20:24 15/04/2010] [20:24 15/04/2010]
Live! Cam Avatar Creator Help.lnk --a---- 2412 bytes [20:24 15/04/2010] [20:24 15/04/2010]
Live! Cam Avatar Creator.lnk --a---- 2398 bytes [20:24 15/04/2010] [20:24 15/04/2010]
Read Me.lnk --a---- 2215 bytes [20:24 15/04/2010] [20:24 15/04/2010]
Uninstall Live! Cam Avatar Creator.lnk --a---- 2635 bytes [20:24 15/04/2010] [20:24 15/04/2010]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\e-Sword d------ [02:54 30/05/2011]
e-Sword.lnk --a---- 1949 bytes [13:47 03/03/2011] [13:47 03/03/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\FastAccess Facial Recognition d------ [02:54 30/05/2011]
Check for updates.lnk --a---- 1167 bytes [20:23 15/04/2010] [20:23 15/04/2010]
Configure FastAccess.lnk --a---- 1151 bytes [20:23 15/04/2010] [20:23 15/04/2010]
FastAccess Help.lnk --a---- 1183 bytes [20:23 15/04/2010] [20:23 15/04/2010]
Uninstall.lnk --a---- 1836 bytes [20:23 15/04/2010] [20:23 15/04/2010]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Foxit Reader d------ [02:54 30/05/2011]
Foxit Reader.lnk --a---- 1250 bytes [04:50 02/02/2011] [04:50 02/02/2011]
Uninstall.lnk --a---- 1235 bytes [04:50 02/02/2011] [04:50 02/02/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Games d------ [02:54 30/05/2011]
Chess.lnk --a---- 352 bytes [22:14 15/04/2010] [22:14 15/04/2010]
Desktop.ini --ahs-- 1128 bytes [05:32 14/07/2009] [22:14 15/04/2010]
FreeCell.lnk --a---- 364 bytes [04:55 14/07/2009] [04:55 14/07/2009]
GameExplorer.lnk --a---- 258 bytes [04:54 14/07/2009] [04:54 14/07/2009]
Hearts.lnk --a---- 356 bytes [04:57 14/07/2009] [04:57 14/07/2009]
Internet Backgammon.lnk --a---- 474 bytes [22:14 15/04/2010] [22:14 15/04/2010]
Internet Checkers.lnk --a---- 470 bytes [22:14 15/04/2010] [22:14 15/04/2010]
Internet Spades.lnk --a---- 466 bytes [22:14 15/04/2010] [22:14 15/04/2010]
Mahjong.lnk --a---- 360 bytes [22:14 15/04/2010] [22:14 15/04/2010]
Minesweeper.lnk --a---- 376 bytes [04:57 14/07/2009] [04:57 14/07/2009]
More Games from Microsoft.lnk --a---- 370 bytes [04:57 14/07/2009] [04:57 14/07/2009]
Purble Place.lnk --a---- 378 bytes [04:57 14/07/2009] [04:57 14/07/2009]
Solitaire.lnk --a---- 368 bytes [04:55 14/07/2009] [04:55 14/07/2009]
Spider Solitaire.lnk --a---- 392 bytes [04:57 14/07/2009] [04:57 14/07/2009]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\HP d------ [02:54 30/05/2011]
HP Solution Center.lnk --a---- 1335 bytes [06:49 31/01/2011] [06:49 31/01/2011]
HP Update.lnk --a---- 2111 bytes [06:49 31/01/2011] [06:49 31/01/2011]
Shop for HP Supplies.lnk --a---- 1057 bytes [06:48 31/01/2011] [06:48 31/01/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\HP\HP Photosmart Essential 3.5 d------ [02:54 30/05/2011]
HP Photosmart Essential 3.5.lnk --a---- 2191 bytes [06:49 31/01/2011] [06:49 31/01/2011]
Uninstall HP Photosmart Essential 3.5.lnk --a---- 2365 bytes [06:49 31/01/2011] [06:49 31/01/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\HP\HP Smart Web Printing d------ [02:54 30/05/2011]
HP Smart Web Printing Help.lnk --a---- 2423 bytes [06:49 31/01/2011] [06:49 31/01/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\HP\Photosmart C309a series d------ [02:54 30/05/2011]
Add A Device.lnk --a---- 1289 bytes [06:48 31/01/2011] [06:48 31/01/2011]
Help.lnk --a---- 1175 bytes [06:48 31/01/2011] [06:48 31/01/2011]
Product Registration.lnk --a---- 912 bytes [06:48 31/01/2011] [06:48 31/01/2011]
Product Support Website.lnk --a---- 1154 bytes [06:48 31/01/2011] [06:48 31/01/2011]
Readme.lnk --a---- 1271 bytes [06:48 31/01/2011] [06:48 31/01/2011]
Uninstall.lnk --a---- 1550 bytes [06:48 31/01/2011] [06:48 31/01/2011]
USB to Wireless.lnk --a---- 1319 bytes [06:48 31/01/2011] [06:48 31/01/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Intuit d------ [02:54 30/05/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Intuit\ProLine Tax Import d------ [02:54 30/05/2011]
Launch Tax Import.lnk --a---- 2739 bytes [00:38 19/02/2011] [00:38 19/02/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\iTunes d------ [02:54 30/05/2011]
About iTunes.lnk --a---- 2107 bytes [04:21 09/03/2011] [04:21 09/03/2011]
iTunes.lnk --a---- 1803 bytes [04:21 09/03/2011] [04:21 09/03/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Lacerte d------ [02:54 30/05/2011]
2009 Lacerte Appointment Calendar.LNK --a---- 1625 bytes [00:37 19/02/2011] [16:42 21/03/2011]
2009 Lacerte Tax.LNK --a---- 1591 bytes [00:37 19/02/2011] [16:42 21/03/2011]
2009 Lacerte Web Setup.LNK --a---- 2206 bytes [00:37 19/02/2011] [16:42 21/03/2011]
2010 Lacerte Appointment Calendar.LNK --a---- 1625 bytes [01:06 19/02/2011] [22:36 07/04/2011]
2010 Lacerte Tax.LNK --a---- 1591 bytes [01:06 19/02/2011] [22:36 07/04/2011]
2010 Lacerte Web Setup.lnk --a---- 2206 bytes [00:58 19/02/2011] [22:36 07/04/2011]
NTR Support.LNK --a---- 2192 bytes [00:37 19/02/2011] [22:36 07/04/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Lacerte\Update Scheduler d------ [02:54 30/05/2011]
Update Scheduler.LNK --a---- 2407 bytes [00:37 19/02/2011] [22:36 07/04/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Maintenance d------ [02:54 30/05/2011]
Backup and Restore Center.lnk --a---- 1304 bytes [04:57 14/07/2009] [04:57 14/07/2009]
Create Recovery Disc.lnk --a---- 1248 bytes [04:57 14/07/2009] [04:57 14/07/2009]
Desktop.ini --ahs-- 606 bytes [02:36 14/07/2009] [04:57 14/07/2009]
Remote Assistance.lnk --a---- 1212 bytes [04:57 14/07/2009] [04:57 14/07/2009]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Microsoft Office d------ [02:54 30/05/2011]
Microsoft Excel 2010.lnk --a---- 2951 bytes [04:15 11/02/2011] [04:15 11/02/2011]
Microsoft OneNote 2010.lnk --a---- 2879 bytes [04:15 11/02/2011] [04:15 11/02/2011]
Microsoft PowerPoint 2010.lnk --a---- 2937 bytes [04:15 11/02/2011] [04:15 11/02/2011]
Microsoft Word 2010.lnk --a---- 3021 bytes [04:15 11/02/2011] [04:15 11/02/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Microsoft Office\Microsoft Office 2010 Tools d------ [02:54 30/05/2011]
Digital Certificate for VBA Projects.lnk --a---- 2977 bytes [04:15 11/02/2011] [04:15 11/02/2011]
Microsoft Clip Organizer.lnk --a---- 2917 bytes [04:15 11/02/2011] [04:15 11/02/2011]
Microsoft Office 2010 Language Preferences.lnk --a---- 2751 bytes [04:15 11/02/2011] [04:15 11/02/2011]
Microsoft Office 2010 Upload Center.lnk --a---- 2837 bytes [04:15 11/02/2011] [04:15 11/02/2011]
Microsoft Office Picture Manager.lnk --a---- 2875 bytes [04:15 11/02/2011] [04:15 11/02/2011]
Office Anytime Upgrade.lnk --a---- 2530 bytes [04:15 11/02/2011] [04:15 11/02/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Microsoft Works d------ [02:54 30/05/2011]
Getting Started.lnk --a---- 2577 bytes [20:21 15/04/2010] [20:21 15/04/2010]
Microsoft Works Calendar.lnk --a---- 2597 bytes [20:21 15/04/2010] [20:21 15/04/2010]
Microsoft Works Database.lnk --a---- 2605 bytes [20:21 15/04/2010] [20:21 15/04/2010]
Microsoft Works Portfolio.lnk --a---- 2647 bytes [20:21 15/04/2010] [20:21 15/04/2010]
Microsoft Works Spreadsheet.lnk --a---- 2629 bytes [20:21 15/04/2010] [20:21 15/04/2010]
Microsoft Works Task Launcher.lnk --a---- 1155 bytes [20:21 15/04/2010] [20:21 15/04/2010]
Microsoft Works Word Processor.lnk --a---- 2649 bytes [20:21 15/04/2010] [20:21 15/04/2010]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\NVIDIA Corporation d------ [02:54 30/05/2011]
NVIDIA PhysX Properties.lnk --a---- 1786 bytes [20:16 15/04/2010] [20:16 15/04/2010]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\NVIDIA Corporation\3D Vision d------ [02:54 30/05/2011]
3D Vision Photo Viewer.lnk --a---- 1689 bytes [20:17 15/04/2010] [20:17 15/04/2010]
3D Vision preview pack 1.lnk --a---- 1701 bytes [20:17 15/04/2010] [20:17 15/04/2010]
Disable 3D Vision Discover.lnk --a---- 1707 bytes [20:17 15/04/2010] [20:17 15/04/2010]
Enable 3D Vision Discover.lnk --a---- 1705 bytes [20:17 15/04/2010] [20:17 15/04/2010]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\PrimoPDF d------ [02:54 30/05/2011]
Online User Guide.lnk --a---- 1238 bytes [04:36 02/02/2011] [04:36 02/02/2011]
PrimoPDF Settings.lnk --a---- 1165 bytes [04:36 02/02/2011] [04:36 02/02/2011]
Uninstall.lnk --a---- 1180 bytes [04:36 02/02/2011] [04:36 02/02/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Quicken 2010 d------ [02:54 30/05/2011]
Billminder.lnk --a---- 1892 bytes [06:01 31/01/2011] [06:01 31/01/2011]
Install ERO.lnk --a---- 1977 bytes [06:01 31/01/2011] [06:01 31/01/2011]
Install QHI.lnk --a---- 1952 bytes [06:01 31/01/2011] [06:01 31/01/2011]
Quicken 2010.lnk --a---- 1856 bytes [06:01 31/01/2011] [06:01 31/01/2011]
Quicken Online Backup.lnk --a---- 1983 bytes [06:01 31/01/2011] [06:01 31/01/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\QuickTime d------ [02:54 30/05/2011]
About QuickTime.lnk --a---- 2441 bytes [04:20 09/03/2011] [04:20 09/03/2011]
PictureViewer.lnk --a---- 2471 bytes [04:20 09/03/2011] [04:20 09/03/2011]
QuickTime Player.lnk --a---- 2441 bytes [04:20 09/03/2011] [04:20 09/03/2011]
Uninstall QuickTime.lnk --a---- 1818 bytes [04:20 09/03/2011] [04:20 09/03/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Roxio d------ [02:54 30/05/2011]
Roxio Burn.lnk --a---- 1027 bytes [20:33 15/04/2010] [20:33 15/04/2010]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Startup d------ [02:54 30/05/2011]
desktop.ini --ahs-- 174 bytes [04:54 14/07/2009] [04:54 14/07/2009]
HP Digital Imaging Monitor.lnk --a---- 2101 bytes [06:48 31/01/2011] [06:48 31/01/2011]
OSD Utility.lnk --a---- 796 bytes [20:20 15/04/2010] [20:20 15/04/2010]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Tablet PC d------ [02:54 30/05/2011]

C:\Users\Marson\AppData\Local\Temp\smtmp\1\Programs\Windows Live d------ [02:54 30/05/2011]
Windows Live Call.lnk --a---- 1961 bytes [20:29 15/04/2010] [20:29 15/04/2010]
Windows Live Mail.lnk --a---- 2214 bytes [20:30 15/04/2010] [20:30 15/04/2010]
Windows Live Messenger .lnk --a---- 2110 bytes [20:30 15/04/2010] [20:30 15/04/2010]
Windows Live Movie Maker.lnk --a---- 1295 bytes [20:32 15/04/2010] [20:32 15/04/2010]
Windows Live Photo Gallery.lnk --a---- 2230 bytes [20:32 15/04/2010] [20:32 15/04/2010]
Windows Live Writer.lnk --a---- 2197 bytes [20:32 15/04/2010] [20:32 15/04/2010]

C:\Users\Marson\AppData\Local\Temp\smtmp\3 d------ [02:54 30/05/2011]
desktop.ini --ahs-- 146 bytes [05:27 31/01/2011] [16:59 09/02/2011]
Internet Explorer.lnk ------- 1445 bytes [05:27 31/01/2011] [05:27 31/01/2011]
Microsoft Excel 2010.lnk ------- 2951 bytes [15:47 11/02/2011] [04:15 11/02/2011]
Microsoft Word 2010.lnk ------- 3021 bytes [15:47 11/02/2011] [04:15 11/02/2011]
Windows Explorer.lnk ------- 1228 bytes [05:27 31/01/2011] [04:49 14/07/2009]

C:\Users\Marson\AppData\Local\Temp\smtmp\4 d------ [02:54 30/05/2011]
2009 Lacerte Tax.LNK ------- 1573 bytes [00:37 19/02/2011] [16:42 21/03/2011]
2010 Lacerte Tax.LNK ------- 1573 bytes [01:06 19/02/2011] [22:36 07/04/2011]
Adobe Photoshop Elements 8.0.lnk ------- 1215 bytes [04:57 11/03/2011] [04:57 11/03/2011]
Adobe Reader X.lnk ------- 2021 bytes [19:26 05/05/2011] [19:26 05/05/2011]
desktop.ini --ahs-- 174 bytes [04:54 14/07/2009] [04:54 14/07/2009]
e-Sword.lnk ------- 1931 bytes [13:47 03/03/2011] [13:47 03/03/2011]

-= EOF =-

#12 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 35,626 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:06:04 PM

Posted 13 June 2011 - 03:25 PM

Very well.

Re-run SL with the following code:

:dir
C:\Program Data\Start Menu /s

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif




#13 pdxcpa

pdxcpa
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:04 PM

Posted 13 June 2011 - 03:27 PM

SystemLook 04.09.10 by jpshortstuff
Log created at 13:29 on 13/06/2011 by Marson
Administrator - Elevation successful

========== dir ==========

C:\Program Data\Start Menu - Unable to find folder.

-= EOF =-

???

#14 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 35,626 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:06:04 PM

Posted 13 June 2011 - 03:35 PM

hmmm....

Let's see this scan...

:dir
C:\Program Data /s

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif




#15 pdxcpa

pdxcpa
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:05:04 PM

Posted 13 June 2011 - 03:36 PM

Should it be ProgramData without the space?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users