Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows 7 Repair Virus (varient of Windows Diagnostic) Deleted Links in ProgramData Start Menu


  • Please log in to reply
6 replies to this topic

#1 Cindy_C

Cindy_C

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:43 PM

Posted 17 June 2011 - 07:05 AM

I had the lovely experience of catching the Windows 7 Repair virus (a varient of the Windows Diagnostic virus). It did all its nasty things like hide all your files, block the Task Manager, Locks your Desktop to Black, etc.

Using your guide I was able to clean everything up, re-set the registry, unhide the files and get things in much better shape. But I was dissapointed to find that the .lnk files in \ProgramData\Microsoft\Windows\Start Menu
had actually been deleted. not just hidden. When I ran "unhide.exe" from your side it did unhide all the folders, but all the folders are empty and missing their .lnk files.

lnk files in the roaming profile Start Menu did re-appear so the user Start Manu pieces are fine.cd

So my question there is, what is the best way to rebuild the common part of your Start Menu?

I am going to assume that creating a new profile is not going to do it, because it is the common parts of the Start Menu that were destroyed. I am also guessing that repairing installed applications will also restore some of the shortcuts... but what a pain!

Any thoughts on how to repair this last step easily?

Edited by Blade Zephon, 17 June 2011 - 10:40 AM.
Moved to AII for initial assistance. ~BZ


BC AdBot (Login to Remove)

 


#2 Cindy_C

Cindy_C
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:43 PM

Posted 17 June 2011 - 07:15 AM

Also, sorry this is a Windows 7 64bit machine. Scans are not showing any trace of any active virus left. Just the missing LNK files. from the start menu.

#3 Blade

Blade

    Strong in the Bleepforce


  • Site Admin
  • 12,704 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:US
  • Local time:08:43 PM

Posted 17 June 2011 - 10:42 AM

Hello.

Before proceeding, have you run any temp file cleaning programs since your problems began?

~Blade

Posted Image

If I am helping you, it has been 48 hours since your last post, and I have yet to reply to your topic, please send me a PM
Become a BleepingComputer fan: Facebook
Follow us on Twitter!
Circle us on Google+


#4 Cindy_C

Cindy_C
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:05:43 PM

Posted 17 June 2011 - 01:08 PM

Nope, no temp cleaning.
I have start either repairing or re-installing apps (there were that many, really only office and adobe suites were the really pains) to restore the start menu links.

#5 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,617 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:08:43 PM

Posted 17 June 2011 - 01:13 PM

Please try this:

If you are still having a problem, please try this version of unhide and tell us if it resolved the issue:

http://download.bleepingcomputer.com/grinler/beta/unhide.exe

#6 Sunflower609

Sunflower609

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:07:43 PM

Posted 21 June 2011 - 06:17 PM

Hello, I have the Windows 7 Repair virus. I have run malware bytes but once I reboot, I am infected again. Before I run malware bytes I run
FIX NCR ands RKILL, then Malwarebytes, but I am still infected. Can someone please tell me how to remove this? Thanks

All my dessktop is black too, no icons at all.

#7 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,617 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:08:43 PM

Posted 21 June 2011 - 06:27 PM

Hello, I have the Windows 7 Repair virus. I have run malware bytes but once I reboot, I am infected again. Before I run malware bytes I run
FIX NCR ands RKILL, then Malwarebytes, but I am still infected. Can someone please tell me how to remove this? Thanks

All my dessktop is black too, no icons at all.


Why are you running FixNCR.reg? That is for a different rogue. What you need to do is outlined here:

http://www.bleepingcomputer.com/virus-removal/remove-windows-7-repair




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users