BleepingComputer.com: Lost System Tools and other files

Another one...

:dir
C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools /s

Broni,

SystemLook 04.09.10 by jpshortstuff
Log created at 21:43 on 06/06/2011 by GERALD A SHUBA
Administrator - Elevation successful

========== dir ==========

C:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools - Parameters: "/s"

---Files---
None found.

No folders found.

-= EOF =-

Aha, we some problem there.

Let's check the original folder.
Run SL with this code:

:dir
C:\DOCUME~1\GERALD~1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools /s

Broni,

SystemLook 04.09.10 by jpshortstuff
Log created at 21:49 on 06/06/2011 by GERALD A SHUBA
Administrator - Elevation successful

========== dir ==========

C:\DOCUME~1\GERALD~1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools - Parameters: "/s"

---Files---
None found.

No folders found.

-= EOF =-

There we go...
Apparently, the infection moved your items to \Temp\smtmp\1 folder, but what happened with subfolders and files, I don't know.
As you can see "System Tools" folder exist in \Temp\smtmp\1\Programs\Accessories\, but it's empty.

I'd like to check something, if you don't mind.
Re-run SL with this code:

:filefind
Disk Cleanup

I'm looking for Disk Cleanup.lnk shortcut, which normally would be located in "System Tools" folder.

Broni,

It is still scanning. Wait a minute, it is done.

SystemLook 04.09.10 by jpshortstuff
Log created at 22:05 on 06/06/2011 by GERALD A SHUBA
Administrator - Elevation successful

========== filefind ==========

Searching for "Disk Cleanup"
No files found.

-= EOF =-

Yeah, it's gone for good.

Why?
Hard to say.
Since this method worked fine on number of other computers, something was done on your computer by you (while cleaning), or by infection itself.

You'll have to restore all those items manually....

You can restore the defaults for the Start Menu, Accessories and Administrative Tools as follows:

• Restore Accessories Program Files Menu with accrestore.zip for XP
  
  • Extract (unzip) the tool, double-click on it to run and ensure that the following check boxes are checked (as shown below):
  
  
  
  • Then click on the Restore button.

==============================================================================

To manually recreate "All Programs" entries, follow these steps...

• Download App Paths
  
• Double click on AppPaths.exe to run the program.
  
• Keep the program open.

In this example I'll recreate an entry for Avast antivirus program.

• Go Start>All Programs.
  
• Right click on Avast entry, click "Properties".

NOTE. Make sure, you right click on Avast program, NOT on Avast folder.

• You'll see this window:

Due to the damage caused by the infection, you'll find "Target" box empty.

• Go back to AppPaths window and find Avast entry.
  
• Right click on Avast line, click "Edit".
  
• A pop-up window will open:

• Highlight everything in "Path" box, right click on it, click "Copy"
  
• Go back to Avast "Properties" window, right click inside "Target" box, click "Paste".
  
• IMPORTANT! Add quotation marks at the beginning of the path and at the end
  
• Click OK and you're done.

In case, program's link shows as (empty):

• Open Windows Explorer, navigate to Avast folder in Program Files
  
• Right click on Avast ".exe" file, click "Create shortcut":

• Copy that shortcut, go back to Start menu.
  
• Right click on avast!Free Antivirus, click "Paste".
  
• You'll see Avast shortcut recreated replacing (empty) entry.

Alternatively....
...you paste that shortcut in:
(XP) - C:\Documents and Settings\All Users\Start Menu\Programs\Avast
(Vista/7) - C:\Program Data\Start Menu\Programs\Avast

Broni,
Thanks again, for your help, patience and interest. The restore accessories seemed to work just fine. I have just sat down to attempt the manual recovery of the other files. The Disk cleanup said I couled reclaim over 2,951,102 bytes of disk space. I did not delete the files until I try thr manual restore. I can only work on this for an hour or so tonight. But, I do feel a little better despite losing some info. Thanks for your persistence. I will continue to update my progress.

You're very welcome

Broni,
I hope you are still following this post. Ispent a lot of time exploring yesterday and did not do much. However, my Properties boxes are different than yours. By this I mean that I have 3 tabs--General, Sharing and Customize, when choosing properties from the START menu. There is no TARGET field.If I have an Icon on the desktop as in the case of QuoteTracker, I do have the TARGET field. QuoteTracker appears on my START Menu (empty), but I can access it via the desktop Icon.
I am thinking I need to pin these items and the ones I can find via the START, SEARCH folder to the START menu.
I actually learned a little about how the system and paths work. Not enough to try anything on my own, as a little knowledge can be dangerous.
Thanks,

Broni,
Sorry, my computer crashed. I guess I need to run Cleanup.

I was going to try the manual paste you suggest: "Alternatively....
...you paste that shortcut in:
(XP) - C:\Documents and Settings\All Users\Start Menu\Programs\Avast"

But, I wanted to check with you before I tried anything, as I do not know how to get there. When I go to Explorer and C:\Documents and Settings\All Users\Start Menu\Programs, do I create a new folder and then rename it?

I apologize for my ignorance. That is probably how I got the virus in the first place.
Thanks,

Quote

No need. You're doing very right thing - asking

Quote

No.
That method applies only for shortcuts, where a folder for given program exist, but it leads to (empty) shortcut.
If a folder for an existing program doesn't show at all in Start>All Programs, the best way is to reinstall program.

If you give me an example of some specific program on your computer, I cab give you more specific instructions.

This post has been edited by Broni: 08 June 2011 - 05:15 PM