Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


hidden folders

  • Please log in to reply
3 replies to this topic

#1 dmh


  • Members
  • 57 posts
  • Local time:08:26 PM

Posted 13 June 2011 - 09:14 AM

The start menu folder has stopped appearing in Windows Explorer (C:\Documents and Settings\All Users\as well as the other user names) even though it still shows up if I do a search for it. "Folder Options" in the Control Panel is set to show hidden files and folers. Has anyone run into this?

Inconvenience aside, I recently had a brief virus scare which didn't materialize but I worry that this small change could indicate something else going on. I've run all the usual virus and rootkit scans and no problems were found. The computer runs normally otherwise.

As always, thank you everyone.

Edited by hamluis, 13 June 2011 - 10:24 AM.
Moved from XP to Am I Infected.

BC AdBot (Login to Remove)


#2 USN Vet


  • Members
  • 190 posts
  • Gender:Male
  • Local time:08:26 PM

Posted 13 June 2011 - 11:11 AM

Since you think you might have had an 'inconvenience' You might check this out:

After running the unhide tool you may still be missing most of your start menu shortcuts… They can be found in a folder named smtmp inside:

(XP)- C:\Documents and Settings\Username\Local Settings\Temp
(W7)- C:\Users\(Username)\AppData\Local\Temp

These will be there unless you have removed temp files / folders

There might be three numbered folders inside C:\Documents and Settings\Your User Name\Local Settings\Temp\smtmp folder. The folders will be numbered 1, 2 and 4.

Inside the 1 folder is a folder named “Programs.” This folder should be copied / pasted to (using XP) to C:\Documents and Settings\All Users\Start Menu, which will already have a folder named Programs but it is safe to overwrite it since Windows will replace the subfolders without creating duplicates.

Inside the 2 folder are the quick launch items specific for the user. Select ALL of these shortcuts and copy / paste to (using XP) C:\Documents and Settings\Your User Name\Application Data\Microsoft\Internet Explorer\Quick Launch.

Inside the 4 folder are the desktop items that should be copied to C:\Documents and Settings\All Users\Desktop.

For Windows 7 users, the all users start menu is C:\ProgramData\Microsoft\Windows\Start Menu\Programs and the all users desktop folder is C:\Users\Public\Desktop
Feel free to ignore my comment, just another user !

#3 dmh

  • Topic Starter

  • Members
  • 57 posts
  • Local time:08:26 PM

Posted 13 June 2011 - 11:48 AM

Thank you. I'm running XP but in the C:\Documents and Settings\Username\Local Settings\Temp folder there's never been any numbered folders.

The Start Menu folders somehow are there, but don't show up. If I do a search for a subfolder, like Programs, that shows up with the path. I can go into that sub-folder and then move up a level into the Start Menu folder but it shouldn't work that way.

When you mentioned running the unhide tool, did you mean the Control Panel-Folder Options-View sequence and choosing "show hidden files and folders" or something else? I also DON'T check off to hide protected operatins system files so everything should be showing, as it was very recently.

Thank you again!

#4 quietman7


    Bleepin' Janitor

  • Global Moderator
  • 51,758 posts
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:26 PM

Posted 13 June 2011 - 11:53 AM

The symptoms you describe are indicative of a side effect from the HDD Defrag family of rogue security programs which changes file attributes to "hidden", making them appear invisible so the user thinks some of their files have been deleted. Newer variants of the FakeHDD rogue delete Quick Launch and Start Menu items/folders and store them in a %Temp%\smtmp folder.

See this example guide which includes removal instructions and using unhide.exe (Step 17), a tool which will remove the "hidden" attribute on all files and attempt to restore Quick Launch and Start Menu items to their proper location. When done you will need to restore the hidden attributes to those files manually. To do that, open Windows Explorer, go to Tools > Folder Options > View and make that change there.When done Vista/Windows 7 users should right-click on the Start Menu and choose Properties. Under Privacy, ensure the boxes are cheked to Store and display a list of recently opened files and programs.

Note: Do not clean out your temporary files/folders until this issue is resolved. If the tool does not work, there are manual ways of restoring the hidden items if the temporary folders are not wiped clean.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users